Norway becomes latest country to pressure Meta’s ad business

“This decision would have major impacts on the standard business processes across industries,” said Dan Felz, a partner at the law firm Alston & Bird. “It goes well beyond the decision about ads personalization issued in January by the Irish Data Protection Commissioner. The closest thing I have seen is German regulators attempting to move financial services providers towards a consent-first model for customer profiling for advertising purposes.”

The decision comes after other key decisions related to Meta’s advertising operations in Europe including the EU’s top court ruling earlier this month that Meta was violating EU privacy laws by collecting users’ data for behavioral advertising.

By raising new questions about the legal basis of consent when it comes to ad-tracking, others say Datatilsynet’s decision could prompt companies to explore other advertising models — such as shifting toward contextual targeting or going dark on Meta platforms — rather than risk regulatory action.

“We’re seeing privacy regulators show their teeth a bit more this year,” said Joe Jones, director of research and insights at the IAPP. “… There’s something in this judgment for everyone.”

Meta did not respond to Digiday’s request for comment, but some privacy advocates celebrated Monday’s ruling by issuing their own statements. In a press release published by NOYB — an Austria-based digital rights group that helped spark a privacy investigation in France against the Parisian ad-tech firm Criteo — Program Director Romain Robert described Norwegian DPA’s decision as “exciting.”

“It clearly seems to be an attempt to bypass the Irish DPC, which wasn’t enforcing its own decision against Meta give years after NOYB’s complaints,” Robert said in a statement.

In a blog post published by Amnesty International, Sherilyn Naidoo, Amnesty International’s policy adviser on technology and human rights, said using social media and protecting privacy “should not be a tradeoff” and urged other governments in Europe and elsewhere to take similar actions.

“Data protection authorities across the EU and the wider world should follow suit in taking similar action in the short term,” Naidoo said in the statement. “And in the long term should enact binding regulation to ban targeted advertising on the basis of invasive tracking practices.”