I can't see that argument going well: Since they let users opt-out of targeted advertising, which is probably the only thing "tracking" is useful for, they tacitly admit that "tracking" is not necessary for them to providing their service.
Just because they chose a specific business model doesn't mean it's necessary. Nobody says the lunch must be free, just that not every avenue of funding is allowed.
I'd have to quote too much. Essentially you only have six allowed reasons for processing personal data (article 6). The only ones that could apply are (a) consent or (b) necessary for performance of contract.
(b) isn't applicable because it only applies when it's directly necessary to provide for that particular user (like processing a CC number when paying for a product). That you business model generally needs it is not enough (see the ICO FAQ on the issue[1]).
(a) Consent is valid, but it must be freely given, that is, the provision on the service can't be conditional on the consent (article 7 (4)).
The GDPR talks about "executing a contract, which includes the provision of services" (not the exact wording, but something like that). So if you define "using the social network in return for having targeted ads displayed" as the contract, it is necessary.
> just that not every avenue of funding is allowed
Funding by targeted ads isn't illegal last time I checked.
Performance of the contract does not mean whatever they want it to mean. Here's the ICO FAQ on the GDPR (emphasis mine):
"The processing must be necessary to deliver your side of the contract with this particular person. If the processing is only necessary to maintain your business model more generally, this lawful basis will not apply and you should consider another lawful basis, such as legitimate interests."
> Funding by targeted ads isn't illegal last time I checked.
It is if you don't get consent. And you can't make that consent required to provide a service, since then it won't be "freely given", as per Article 7.
Yes, I that's the way I read it (from Recital 43), and the ICO seems to agree:
"Avoid making consent to processing a precondition of a service (...) If you make consent a precondition of a service, it is unlikely to be the most appropriate lawful basis."
That would be interesting! That would probably mean they'd need to ban me, since I use an ad-blocker, right?
What about someone who uploads a lot of pictures but doesn't have many friends? That person might be using more resources than the ad revenue they generated...
> That would probably mean they'd need to ban me, since I use an ad-blocker, right?
Are you saying they should be forced by law to block you?
> What about someone who uploads a lot of pictures but doesn't have many friends? That person might be using more resources than the ad revenue they generated...
That is a flat-fee/pricing issue, just like someone binge watching Netflix might be using more resources than they generate in revenue. It isn't relevant to the discussion.
> "We require tracking to pay for the costs of providing this free service".
> No such thing as a free lunch.
Please square that with the fact (which I already pointed out) that they already provide their free service without targeting, based on user settings.
They can't using tracking to "pay the costs of providing this free service" without ad targeting (unless they're selling the tracking data, which they publicly deny).
I'm making an educated guess that mere declarations of necessity tracking are not sufficient legal justification for it in the EU.
