Spanish Media Sues Meta For Ignoring GDPR And Harvesting Data

A group representing some of Spain's largest media outlets have sued Meta, demanding €550 million ($596 million) in recompense for Zuckercorp's "systemic and massive" disregard for EU privacy regulations that have left them at risk of collapse.

The lawsuit, filed by the Information Media Association (AMI) on behalf of 83 Spanish outlets – including industry leaders El Mundo, El País and others – accuses Meta of violating the EU General Data Protection Regulation (GDPR) since it came into effect in 2018 until mid-2023, when Meta finally bowed to regulator pressure and promised it would begin explicitly asking for EU users' permission when seeking to collect data for advertising purposes.

According to AMI, Meta "failed to comply with [the GDPR], ignoring the regulatory requirement that citizens must consent to the use of their data for advertising profiling," and that its scofflaw practices contributed to its dominant advertising position across the EU. The Register was unable to obtain a copy of the lawsuit.

Meta's dominance – which it owes in large part to the sheer volume of data it has collected on EU citizens – has left Spanish outlets unable to compete, argued AMI president José Joly. The sustainability of the Spanish media is therefore at risk, he added.

Meta hasn't responded to questions from The Register.

One GDPR lawsuit after another

Because Meta isn't accused of violating Spanish law, but EU bloc rules, similar lawsuits could appear elsewhere.

"Of course, in any other EU country, the same legal proceeding could be initiated," lawyer Nicolás González-Cuéllar, who is representing AMI in its suit, told Reuters.

Indeed, Meta is already fighting other GDPR-related matters.

After giving in to GDPR regulations that force it to notify users explicitly that their data was being collected to serve targeted advertisements, Meta in October introduced paid versions of Facebook and Instagram that eliminate ads entirely.

• Meta facing third fine of 2023 for mishandling EU user data under GDPR
• Norway court upholds miniscule fine against Meta for flouting privacy rules
• Meta threatens to pull all news from California rather than pay El Reg a penny
• Europe bans Meta from using personal data to target ads

According to Meta, the EU's top court "expressly recognized that a subscription model, like the one we are announcing, is a valid form of consent for an ads funded service." In other words, if you choose not to pay for Facebook in the EU, consider yourself opted in to providing your data for ad targeting.

Privacy activist group None of Your Business (NOYB) filed a data protection complaint in Austria against Meta over its pay-or-okay subscription model last week, calling Meta's premium model a "privacy fee" – at odds with the spirit of EU privacy regulations.

NOYB noted that Meta's rivals are likely watching the progress of the social media kraken's attempts to justify its argument that not subscribing represents opting into data harvesting – which could eventually lead to widespread charging for what it considers a fundamental right to privacy.

"EU law requires that consent is the genuine free will of the user," argued NOYB data protection lawyer Felix Mikolasch. "Contrary to this law, Meta charges a 'privacy fee' of up to €250 per year if anyone dares to exercise their fundamental right to data protection." ®