- Meta was fined $414 million by Ireland's Data Protection Commission on Wednesday.
- It violated EU privacy laws by forcing personalized ads, but the Facebook owner plans to appeal.
Meta is planning to appeal its $414 million fine for forcing targeted ads on users, amid disagreements over whether it needs to ask users for consent.
The company was hit with two fines on Wednesday – one for Facebook and one for Instagram – by Ireland's Data Protection Commission for violating the Europe's General Data Protection Regulation (GDPR) laws.
Meta was previously fined $403 million by Irish authorities last September for failing to protect children's privacy. According to filings seen by Politico, it has set aside more than $3 billion for EU privacy fines in 2022 and 2023.
In a statement after the decision, Meta said it "strongly believe our approach respects" Europe's GDPR rules, and announced its intention to appeal.
The company's insistence that the fines "do not mandate the use of consent" has also raised eyebrows.
This refers to one of the GDPR act's six legal bases for processing users' data. The company previously relied on "Contractual Necessity," which meant users could only use the platform if they accepted they would be tracked.
Consent would mean users have the option to withdraw Meta's right to process their data at any time.
Meta said: "The suggestion that personalized ads can no longer be offered by Meta across Europe unless each user's agreement has first been sought is incorrect."
But Max Schrems, a privacy activist and honorary chairman of Noyb — the organization that made the complaint against Meta – told Insider this was misleading.
It is understood that Meta is considering numerous options besides consent as the basis for its appeal, although Schrems said it was the only one that could work. He said Meta could have used "legitimate interest"– but the company would need to have announced it beforehand.
"Facebook tries to say 'oh they haven't said we have to use consent,' but if you basically do the math and look at the other five options, you realize that consent is the only one that's left," Schrems told Insider. "The law simply doesn't have a seventh or eighth or ninth option. It simply doesn't exist."
The European Commission and Irish Data Protection Commission did not immediately respond to requests for comment from Insider.