Meta, the company formerly known as Facebook, recently announced changes to its privacy policy that will take effect on January 4, 2022. These updates give Meta additional ways to collect data across its platforms, which include Facebook, Instagram, Messenger, and WhatsApp.
What user data does Meta’s new privacy policy allow them to collect?
Meta’s new privacy policy allows the company to collect user data from across its family of platforms in order to “provide services” and “personalize content.” This means Meta can utilize data from Facebook to improve ads on Instagram, for example. Specifically, Meta can collect:
- Content you create, such as posts or stories
- Information about how you use Meta products, such as likes and shares
- Information about transactions you make, such as purchases through Meta services
- Information from third-party partners, advertisers, and publishers
- Device data such as location, signal strength, operating system, and browser info
How does Meta link data across platforms?
Meta has the ability to link data across its platforms by utilizing unique identifiers that are tied to individual users. This includes:
- Linked accounts – If you use the same email or phone number across Meta services
- Linked devices – If you access Meta services on the same computer or mobile device
- IP addresses and other technical data about devices
- Cookies or similar tracking technologies to identify browsers and devices
By connecting these data points, Meta can construct detailed profiles on users’ interests, behaviors, and habits across its platforms.
How does Meta use this linked data?
Meta states in its updated privacy policy that it uses linked data for the following purposes:
- Providing integrated services across Meta platforms, such as cross-posting
- Showing relevant and customized ads based on your interests and activities
- Providing measurement, analytics, and other business services
- Promoting safety, integrity, and security across Meta platforms
While Meta claims to use data to improve and personalize services, the practice has raised concerns among privacy advocates. The linking of data across platforms gives Meta an unprecedented view into users’ activities, which could violate expectations of privacy.
Does Meta share linked data with third parties?
Meta’s privacy policy discloses that it shares certain data with third party partners, including:
- Advertisers – For serving targeted ads. Meta may share identifiers, user demographics, interests and online behaviors.
- Measurement partners – For providing analytics services and measurement of ads. Data shared may include app usage data, device/browser data and location.
- Partners offering goods and services in Meta apps – User data may be shared when transacting through Meta services.
- Research partners and academics – For conducting research that advances Meta’s business interests.
- Law enforcement or in response to legal requests – Meta will share user data with authorities when required by law.
Meta states that they do not sell user data to third parties. However, their sharing of data for business purposes still raises privacy concerns for many users.
Can users opt out of Meta’s data collection practices?
Meta provides some options for users to limit data linking and collection:
- Not using the same account across Meta services
- Turning off personalized ads
- Disconnecting devices identified as belonging to you
- Limiting third-party app permissions
- Using privacy browser settings to prevent tracking
However, many of these options severely limit functionality. There is no way to completely opt out while still using Meta’s platforms.
Could Meta’s data linking violate antitrust laws?
Some experts have argued that Meta’s data linking could be viewed as anti-competitive behavior in violation of antitrust laws. By leveraging data across its platforms, Meta makes it difficult for potential competitors to challenge its dominance in social media and digital advertising. However, Meta claims the practice benefits consumers by improving services.
Whether regulators take action likely depends on if Meta is deemed to have an unfair advantage that hurts competition and consumer choice. But for now, Meta maintains that its data use complies with applicable laws and regulations.
How has the privacy community responded?
Privacy advocates have raised serious concerns about Meta’s expanded data collection under the new privacy policy. Some key criticisms include:
- Violates user expectations – Users reasonably expect privacy controls and data to remain siloed by app and service.
- Lack of meaningful consent – Broad privacy policy disclosures do not constitute informed user consent.
- Insufficient transparency – Full details on how data is linked and used are not disclosed.
- No option to opt-out – Users cannot realistically avoid cross-platform tracking.
- Enables surveillance marketing – Deep data linking enables monitoring of user behaviors for ad targeting.
Digital rights groups have called for lawmakers to enforce stronger privacy regulations in response to Meta’s policy changes.
What requirements did European regulators impose?
While Meta updated its global privacy policy, European users are subject to additional protections under GDPR data privacy laws. As a result of regulatory scrutiny, Meta agreed to the following requirements for European users:
- Obtain explicit consent for data linking between Meta companies
- Explain legal bases relied on for data processing
- Clarify purposes and methods of automatic data linking
- Limit data retention periods
- Conduct periodic privacy assessments
- Enhance user controls and settings
EU regulators will monitor if Meta complies with these conditions. Still, critics argue the requirements do not go far enough in giving users control over their data.
Could Meta face legal repercussions?
It remains to be seen if Meta will face lawsuits or regulatory enforcement actions over its privacy policy changes. Potential legal risks include:
- FTC privacy lawsuit – The FTC previously fined Facebook for privacy violations and could argue Meta is violating its consent decree.
- State AG lawsuits – Privacy focused states like California and New York may claim violations of consumer protection laws.
- Class action lawsuits – Users could sue over invasion of privacy or lack of disclosure/consent. Platform linking may bolster claims.
- International regulatory actions – Ex. EU privacy regulators could issue fines under GDPR if they find consent lacking.
For now, Meta is defending its policy as compliant. But regulators and class action attorneys are monitoring the issue closely, so legal challenges could arise – especially if evidence emerges that Meta is acting anti-competitively or deceiving consumers.
Conclusion
Meta’s privacy policy changes significantly expand its data collection and linking abilities across Facebook, Instagram, Messenger and WhatsApp. This allows Meta to construct more detailed user profiles for ad targeting and service improvements. However, privacy advocates argue it violates user expectations, enables surveillance marketing, and deprives consumers of meaningful privacy choices. While Meta maintains its practices are legal and ethical, the policy remains highly controversial with many calling for stronger regulations to rein in Meta’s data practices.