Social media accounts have seen a massive boom in usage in the past decade. Today, there are 3.80 billion social media users relying on platforms like Whatsapp, Instagram, Facebook, etc. Granted, people get real-time updates, and they can connect to people around the world in a matter of seconds, but there are risks too. Many people have fallen victim to unwanted advances from unknown people, social bullying and hacking.
The situation worsened amid the COVID-19- circulation of false information, increase in hacking, social media targeting, etc. However, on Monday, September 7, 2020, the European Data Protection Board (EDPB) issued draft Guidelines 8/2020 on the targeting of social media users. The guidelines offer revised rules and regulations for social media platforms, adtech companies, advertisers, etc.
So, let us now take a look at the main takeaways below:
1. Joint Control between Advertiser and Platform
As per the latest rules set by EDPB, the social media targeting instance involves an advertiser using social media accounts for promotional purposes. Until now, the advertisers could customize options concerning the demographics, but now they can also indicate when the ads should be displayed. And as usual, the advertisers will get to know about the metrics while the campaign takes place.
The EDPB specifically clarifies that the social media platforms and the advertisers are the joint controllers. This is because the platform has developed the targeting criteria and holds the relevant data, whereas the advertiser defines the specific campaign criteria. Both legitimate interest and consent could be the legal bases for data processing.
2. Consent Required for Location-Based Targeting
As per the latest regulations, EDPB opines that the companies must achieve consent for location-based targeting as it constitutes monitoring of individuals’ behavior. Location-based marketing allows firms to target consumers at a granular, personal level with online or offline messaging. Using physical location data, marketing teams reach consumers based on qualifiers like proximity to a store, events happening in their region, and more.
The different types of location-based marketing are geotargeting, geofencing, beaconing, mobile targeting, and geo-conquesting. Currently, more than 84% of marketers use location in their marketing ad campaigns. This is the reason why EDPB felt the need to revise the policies as the advertisers and the social media platforms are joint controllers.
3. Behavioral Targeting May Call for Automated Decision-Making
Behavioral Targeting is a marketing technique that allows advertisers to recommend products and services based on consumer activities and preferences. This form of targeting relies on data like pages viewed, amount of time spent on a website, prior search items, ads, content and button clicked, last date of website visit, etc.
Here, the EDPB proposes that if the collection of behavior involves cookies, or similar technologies, then consent is always required. Moreover, companies should clearly specify whether the cookies include profiling and automated decision-making, for which permission has to be taken from the consumers. There should be proper transparency in the process.
4. Further Arrangement for Joint-Controllers
In order to comply with the General Data Protection Regulation (GDPR) obligations, certain policies have to be followed. The advertisers and social media platforms are required to determine their respective responsibilities as joint-controllers. The EDPB must have detailed information regarding the processing operations taking place by the social media provider and the targeter.
Both parties must include the purposes of the processing and the corresponding legal basis together with GDPR stipulation information. Both controllers will be held responsible for ensuring the availability of the essence of the arrangement to the customers. Furthermore, there should be enough information to determine who should carry out a Data Protection Impact Assessment (DPIA), or who will reply to data subject requests.
5. Derivatives to Constitute Special Category Data
This is one of the most important guidelines that EDPB has included in the recent revision of the targeting of users’ norms. Besides the special category data provided by the individuals on their social media, they have to mention derivative data such as inferences and assumptions. And, this data might be subjected to the special category data classification.
In principle, the processing of special category data is prohibited. This is why both the advertisers and the social media platforms must ensure that they can rely on one of the exceptions included in the GDPR to process such data. The processing can be considered lawful if the data has been manifestly made public by the data subject. However, companies might need to obtain consent in special circumstances.
With the policies in place, social media users will be more secured, and they would not be prone to cyber attacks as before. If you are writing a social media user information protection, you can include the above-mentioned points in your paper. But, if you struggle to write the paper, you can take assignment help from the professional experts.
What the New Policies Mena for the Regular Users?
Targeting of social media users involves the use of personal data which is beyond an individual’s expectations. This infringes applicable data protection rules and principles. Profiling activities include inference of interests, which the user might not have disclosed earlier.
There is also an added risk of the possibility of exclusion and discrimination on the basis of ethnicity, religion, sexual orientation, etc. The second category of risk involves the possible manipulation of the users. However, one need not worry about it anymore as the EDPB has made it mandatory for the advertisers and the companies to obtain permission first. So, if you are being asked for extra information, do go through the notice and act accordingly.
With concerned authorities taking stringent measures, the world will soon be a better place. The customers won’t have to divulge confidential data, and they will be given an option whether they would like to or not.
