Norway’s Privacy Battle With Meta Is Just Getting Started

This new, bolder approach was illustrated in August, when Coll’s team ruled that the way Meta carried out behavioral advertising in Norway was illegal, and started fining the company $100,000 per day until it changed its business model. The fine, which remains unpaid, currently stands at over $7 million. (Pollard says Meta is in touch with the relevant agency about payment.)

Coll says she had long discussions with her team about whether they should take on the case. There were concerns about reputational risk if the regulator lost, spending all its resources in the process, just to strengthen Meta’s position, she says.

But instead, Coll won—in a way. The fines were upheld by a Norwegian court, where her team confronted an array of Meta’s lawyers in August. “They were there with three Norwegian lawyers, three US lawyers, and I also think they had lawyers online from Ireland,” she says. “It was a show of legal muscle.” By comparison, Coll was able to send only three people from her team of 62.

Meta might not have paid the fine, and Coll still doesn’t believe they’ve complied with the Norwegian order—although Pollard says Meta has complied by introducing optional ad-free subscriptions in Norway. But in October, Coll received more good news. The data regulator for the European Union, the European Data Protection Board, decided to extend Norway’s ban on Meta’s behavioral advertising to all 30 countries within the EU and European Economic Area. The EDPB decision was a “win for privacy and data protection,” Coll says, adding that it sends a clear message to Meta and to other tech companies that Europe does not accept business models that rely on European individuals’ data.

Coll says that she doesn’t believe Meta launched its ad-free subscription model in response to her agency’s ruling on behavioral ads, but that it did so because of the EU’s Digital Markets Act, which comes into force in 2024. That’s what European authorities were told, she says. Article Five in the Digital Markets Act, an EU law designed to make the technology industry more competitive, states that Meta needs consent to combine users’ personal data over different platforms. “This is probably the real incentive for them to do this,” Coll says. “This would have happened regardless of us taking on our Meta case or not.”

Coll says her team won’t take on any other social media platforms and will instead continue to focus its limited resources on Meta. She believes their success this year is making people pay attention to privacy, beyond expert circles. “We’re blowing their cover,” she says. “Because they’ve done this silently for years. They’ve collected our data and profiled us for years.”