EDPB guidelines on targeting social media users published in September 2020 bring new GDPR compliance obligations that social media service providers and targeters need to adopt.
EDPB guidelines on targeting social media users published in September 2020 bring new GDPR compliance obligations that social media service providers and targeters need to adopt.
Before we take a deeper look at the new requirements, the key takeaways you need to know are;
joint controllership is when there is the participation of two
or more entities in the determination of the purposes and means of a processing operation
The new guidelines follow the rulings made by Europe’s top court, the CJEU, in high profile cases involving the practice of social media targeting with the notable ones being Wirtschaftsakademie and Fashion ID:
Explore more privacy compliance insights and best practices
The court stated that the means of processing are determined jointly because even though the plugin is provided and made available by Facebook, Fashion ID added it on its website with full knowledge that it enables the collection and transmission of its website visitors’ data to Facebook Ireland.
Following up from these judgments, The EDPB guidelines on targeting social media users seek to shed more light on your responsibilities when you are handling the personal data of your users while providing a social media service or targeting ads. Read more on the EU Cookie Guidelines.
EDPB’s guidelines;
Therefore, this article highlights 4 quick compliance tips you need to know to comply with EDPB Guidelines on Targeting Social Media users.
Table of Contents
Who Needs to Comply with the EDPB Guidelines on Targeting Social Media Users?
According to the EDPB, the following entities take part in the targeting process on social media;
1. Social media providers
According to the EDPB guidelines on targeting social media users, you are a social media provider if;
This definition covers any online platform that has a social function ranging from Facebook, Twitter, LinkedIn, Instagram, to online dating sites, video-streaming services, and gaming service providers.
The EDPB notes that social media service providers collect large volumes of personal data about the behavior of your users, both on and outside the platform, which needs to be handled in a way that does not violate the privacy rights of the users.
2. Targeters
The EDPB guidelines on targeting social media users, categorize you as a targeter if;
The aim of microtargeting is to achieve among others, political or business interests such as increasing brand awareness.
3. Users
Users are persons who either:
4. Other Actors
In this case, the scope of the EDPB guidelines on targeting social media users may be relevant depending on the type and structure of targeting.
For Example: it may extend to participants in the adtech industry such as ad networks and ad exchanges.
What Categories of Personal Data do the EDPB Guidelines on Targeting Social Media Users Apply To?
The new guidelines from the EDPB on targeting social media users define the categories of personal data that will require you to comply with the GDPR if you decide to use the information for your online targeting activities.
a). Provided data: this is the personal data that a user actively surrenders to you such as their email address, location, age, or name.
b). Observed data; this is the personal information a user passively gives you by using your social media service e.g based on their activity on your website or the devices he/she uses to access your service.
c). Inferred data; If you decide, as a data controller, to generate insights from either the provided or observed data from your users, the resulting insights are described as inferred data.
For Example: you can make a comprehensive conclusion that a user is interested in a specific product based on their behavior on your website or how they interact with other users in your network.
What Did the EDPB Guidelines on Targeting Social Media Users Clarify?
i). Joint Controllers
The guidelines clarify that you are a joint controller under the GDPR if you are a social media service provider or targeter who ;
It does not end there. In some cases you can be considered a joint data controller even in scenarios where you do not have direct access to the personal data of your users according to the new EDPB guidelines on targeting social media users.
ii) Legal Bases
When it comes to the processing of personal data, the EDPB guidelines on targeting social media users direct that you can only rely on two legal bases defined by Article 6 of the GDPR. They are;
Concerning legitimate interest, you should allow your users to reject the display of targeted advertising when they first come to your website just before you start processing their data.
Additionally, you should also give them assurance that you do not process their personal data for ad targeting reasons once they decline to give consent for it.
Concerning consent, the EDPB guidelines on targeting social media users consider it valid if;
If a user gives you consent to process their data for ad targeting, it can only be valid if it is;
You can check out our blog to learn more about the EDPB’s guidelines on valid GDPR Cookie Consent here.
You need to be aware that even in cases where you rely on cookies and other similar technologies for your targeting activities, the cookie consent you receive must satisfy the conditions listed above.
If you process special categories of personal data from a user such as their race, political views, health status, or sexual preference, You need to comply with an additional legal base referred to as explicit consent in line with Article 9 of the GDPR.
iii). Transparency and Data Subject Rights
Since targeters can rely on provided, observed, or inferred user data from social media platforms, there is always a risk that you may end up processing this data in ways your users do not expect.
Similarly, the EDPB guidelines on the targeting of social media users acknowledge that there is a general lack of transparency when social media service providers or targeters process some categories of personal data for targeted advertising and who should be held accountable.
To ensure you do not violate the EDPB guidelines on targeting social media users, you must make it easy for users to exercise their data subject rights especially, the rights to access, objection, and erasure.
iv) Data Protection Impact Assessments (DPIA)
The EDPB guidelines on targeting social media users clarify that before activating the intended targeting activities, you need to;
How Do I Comply with the EDPB Guidelines on Targeting Social Media Users?
The Joint Controllership Requirement
As a social media provider or targeter, you must enter into a joint controller agreement that specifies all the obligations and liabilities for all the parties involved in processing your users’ data.
Ensure that this agreement covers all the processing activities for which you are jointly accountable.
Without a clear and complete agreement, you will end up in trouble with your Data Protection Authority (DPA) for GDPR violations that will result in unnecessary fines for your business.
The Legal Bases Requirement
As a joint controller, you must determine each purpose of processing personal data and identify the relevant legal base for this type of processing individually.
While the GDPR does not stop you from using a variety of legal bases, it is advisable to apply the same basis for a specific targeting strategy and purpose whenever it is practical.
Overall, you should ensure;
The Transparency and Data Subject Rights’ Requirement
To comply with the EDPB guidelines on targeting social media users, you must ;
Compliance with DPIA Requirement
To comply with this requirement, you need to evaluate whether conducting a DPIA is necessary before you start any data processing activity.
Once this is done, you should also ensure whether you need to carry out a DPIA alone or whether your joint controller needs to execute the same..
Your DPIA needs to;
EDPB Guidelines on Targeting Social Media Users and Secure Privacy
Secure Privacy is the #1 Consent Management Platform (CMP) in the market with powerful and reliable enterprise features that help both social media service providers and targeters comply with GDPR requirements.
The features you can leverage to comply with the EDPB guidelines on targeting social media users include;
As your CMP, Secure Privacy ensures that consumers are aware of what data is processed and for what purpose, such that they know what they are giving their consent to by helping you generate a GDPR-compliant privacy policy.
Our powerful privacy policy generator also allows you to customize your privacy notices to your unique business.
Adding a privacy policy to your website with Secure Privacy is a breeze. Adding a privacy policy button on your website is equally easy. And if you use Magento and need Magento cookie compliance with a privacy policy, or you use Hubspot, we’ve got you covered.
Our solution ensures you give your users a way to give consent to the use of cookies based on true choice as opposed to coercing them into accepting their placement, which can attract GDPR fines.
Using Secure Privacy as your CMP ensures that cookie consent is provided through affirmative and unambiguous action in accordance with both GDPR and the ePrivacy Directive.
Our solution also ensures that you can send an alert to your users before the initial data processing occurs.
According to the GDPR, you must make it easy for consumers to withdraw consent. Secure Privacy’s Universal Preference Center gives users control over their consent choices and ensures that they can withdraw consent as easily as they gave it.
If you have additional questions or need further clarification, get a free assessment of your website and have all your concerns answered by a data privacy expert by booking a 30-min call.
Schedule a call to learn more
Alternatively, you can sign up for your 7-day free trial of our IAB-certified CMP.
Learn more about the other EDPB Guidelines you may need to comply with here;
Schrems II Decision: Privacy Shield Invalid for EU-US Transfers
EDPB Schrems II Guidance: GDPR Data Transfers to Third Countries
GDPR Cookie Consent: The Latest EDPB Guidelines on Cookie Walls
Also, Learn about the EU Digital Markets Act (DMA) and its impact on digital markets in the European Union. Understand its benefits, key provisions, and how it compares to the Digital Services Act (DSA). Find out what the DMA means for consumers and businesses and how it will reshape the digital landscape in the EU.
