Privacy Crusaders Accuse X Of Ad-targeting That Flouts EU Rules

An EU privacy rights group has filed a complaint against Elon Musk's X, alleging the platform unlawfully targeted advertisements from the bloc's Home Affairs directorate in a bid to build public support for hotly contested "chat control" legislation.

Austria-based noyb (none of your business) alleges that the EU Home Affairs account in September paid X to promote a post in the Netherlands about the necessity of chat control legislation (which would make it permissible to scan devices and messages – even encrypted ones – for child abuse material.) Crucially, noyb accuses it of targeting users based on their political views and religious beliefs in order to do so.

If true, it would mean X isn't only violating its own targeted advertising rules, but the EU's General Data Protection Regulation (GDPR) and the Digital Services Act (DSA) as well, noyb contends. 

"On paper, X prohibits the use of sensitive data for political ads, but in reality they still profit from techniques that we know are harmful ever since the Cambridge Analytica scandal in 2018," says noyb data protection lawyer Maartje de Graaf.

The complaint [PDF], filed today with the Dutch data protection authority, is a follow-up to an earlier complaint that noyb filed in the Netherlands directed at the EU Commission's Directorate for Migration and Home Affairs in September, which made the illegally promoted post.

Coincidentally or not, the European Commission decided the day after noyb's September complaint to stop all advertising on X, citing concerns over disinformation on the platform as well as that targeting ads on X could violate the DSA. 

• German Digital Affairs Committee hearing heaps scorn on Chat Control
• Wrong time to weaken encryption, UK IT chartered institute tells government
• First Brexit, now X-it: Musk 'considering' pulling platform from EU over probe
• The UK's bad encryption law can't withstand global contempt

"After we filed our first complaint in this matter, the EU Commission has already confirmed to stop advertising on X," says noyb data protection lawyer Felix Mikolasch. "However, to put an end to this in general, we need enforcement against X as a platform used by many others."

The latest X complaint alleges the Home Affairs post was only promoted to people who did not show interest in keywords like Brexit, the EDL, right-wing German populist party Alternative für Deutschland or Christian – all politically and religiously loaded terms that noyb claims are exempt from ad targeting.

Per the complaint, Article 9(1) of the GDPR prohibits "processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs." Additionally, the EU Data Protection Board has previously determined that social media firms processing observed data "to categorise users as having certain religious, philosophical or political beliefs … must obviously be seen as processing of [a] special category of personal data," which, noyb contends, makes X's promotion of the EC post illegal. 

X didn't respond to questions from The Register.

Noyb is seeking a full investigation by Dutch data protection officials, as well as a prohibition on X from processing special categories of data for advertising purposes. Noyb is also asking officials to fine X, which under the GDPR could be forced to fork over up to €20 million for a violation of GDPR article 9, or 4 percent of its annual turnover, whichever is higher.

Given X's financial state, that €20 million could be devastating. ®