What you need to know

• Meta's problems with its pay and consent model extend far beyond Europe's borders.
• The EU's approach could well be a preview of what's to come in our own regulatory landscape, says Chris Brinkworth, managing partner, Civic Data.
• It's the latest example of regulators bringing a digital giant to heel.
• Google's third-party cookies reversal last week was reportedly triggered in part by the oversite of Britain's Competition Watchdog.
• Regulators are increasingly cooperating around the world, and in Australia that's formalised under groups such as the Digital Platform Regulators Forum, which met last week.

Meta's user consent problems in Europe in the face of the Digital Markets Act might seem literally a world away, but there are important implications for Australian marketers. It also reinforces how regulators are now hunting in packs and collaborating closely in their determination to bring the digital giants to heel after two decades of unfettered growth.

At the heart of the story in Europe is a complex debate involving multiple laws, multiple regulatory bodies, and ethical considerations, according to Chris Brinkworth, managing partner, Civic Data.

"While the DMA [Digital Markets Act] doesn't directly apply to the Australian market, its ripple effects will be felt here. Australian digital businesses need to watch this space closely and be prepared to adapt quickly," he says. "The EU's approach could well be a preview of what's to come in our own regulatory landscape.

“Australian businesses with a significant EU presence must now navigate two regulatory landscapes: the evolving domestic framework shaped by the ACCC's Digital Platforms Inquiry, and the EU's stringent DMA requirements”

According to Brinkworth, the EU's DMA decision could also force Australian adtech companies and digital publishers to develop dual strategies: One for the EU market emphasising user consent and data minimisation, and another for the domestic market. "This bifurcation could significantly impact operational costs and technological development."

Beyond GDPR

According to Brinkworth, Meta initially created its pay or consent model to comply with the GDPR, a privacy law that requires companies to get clear permission to use people's personal data. However, he stressed this issue is not specific to GDPR. Instead, it’s based on a new law called DMA, or Digital Markets Act, which establishes a set of clearly defined objective criteria to qualify a large online platform as a 'gatekeeper'. It's designed to ensure these gatekeepers behave in a fair way online and leave room for contestability.

“European users are currently given two options by Meta: Pay a monthly fee for ad-free services, or use the services for free but agree to personalised ads based on their data," Brinkworth explains.

This raises a number of ethical issues including;

• Privacy as a Luxury: This model potentially turns privacy into a paid privilege, raising questions about digital equality.
• Coerced Consent: Users might feel forced to consent to data processing just to access essential social networking services.
• Lack of Middle Ground: There's no option for users who want free services with less invasive data collection and ad targeting.
• Data Combination Across Platforms: Users can't easily control how their data is combined across Meta's different services (e.g., Facebook, Instagram, WhatsApp).
• Transparency Issues: The full extent of data collection and its use for advertising may not be clear to users.
• Children and Vulnerable Users: Concerns about how this model affects younger users or those who may not fully understand the implications of their choice.
• Market Dominance Exploitation: Meta's size and importance in social networking might unfairly pressure users into accepting invasive data practices.
• Long-term Privacy Implications: Questions about how consenting to data use now might affect users' privacy in the future as data analytics technologies advance.

Brinkworth told Mi3, “The newer law called the Digital Markets Act [DMA] is now being applied to Meta’s model [alongside other tech platforms]. The DMA ultimately aims to control how big tech companies use people's data and ensure fair competition.”

Regulators are arguing Meta’s approach does not offer a genuine fair choice since it requires users must either pay or give up their privacy rights.

“Regulators are saying there should be a third option - a free version that shows ads but doesn't use as much personal data for targeting," Brinkworth says, noting this is also very much in line with the recent ACCC Data Products and Services review findings.

“The other key issue is how Meta combines data across its different services for advertising without separate, clear consent for each.”

Again here, Brinkworth sees parallels with the ACCC’s Fair And Reasonable proposal, which lies at the heart of the forthcoming Privacy Act overhaul. If Meta is found to be in violation (which currently it is not) it could face massive fines and might have to change how it operates in Europe, affecting millions of users and its business model, he argues.

"We won’t understand the scale of disruption until there is a ruling," he adds.

Collaboration

Regulators are increasingly collaborating, and not just in Europe. Last week, the Office of the Australian Information Privacy Commission (OAIC) affirmed on LinkedIn how closely it is working with the ACCC, ACMA and the eSafety Commissioner under the auspices of the Digital Platform Regulators Forum.

According to the post, "We agreed to goals that guide the purpose, direction, and objectives of DP-REG; to build capacity, to promote regulatory coherence, and to respond to emerging risks and opportunities.

"DP-REG members have also agreed on strategic priorities for 2024–26 to progress these goals with a view towards ensuring Australia’s digital economy is a safe, trusted, fair, innovative and competitive space."

In a statement after the meeting, ACCC Chair Gina Cass-Gottlieb noted, “In a year which has seen an unprecedented uptake in the use of artificial intelligence tools, the ACCC has been closely considering interactions between AI services and competition and consumer regulation. This technology has serious implications for our work; from potentially generating misleading advertising, scams, and fake reviews, to enabling the possible use of AI to engage in anti-competitive conduct. The ACCC is clear on the need to ensure healthy competition in markets affected by AI."

And per eSafety Commissioner Julie Inman Grant: "The Digital Platform Regulators Forum [DP-REG] has established itself as a critical mechanism for achieving regulatory consistency, clarity and collaboration as technologies continue to evolve. By enhancing our capacity, promoting regulatory coherence, and addressing emerging risks, we aim to encourage a digital environment that is innovative, safe, and fair for all Australians.”

“Just as a joined-up approach by regulators delivers efficiency and effectiveness for the regulated community, the same approach is vital in sharing information and expertise through DP-REG members to prepare for the emerging issues of tomorrow,” Australian Privacy Commissioner Carly Kind added.

Across Europe meanwhile, different agencies have a deep history of working on different areas of regulation in EU. Some focus on privacy (GDPR), while others on market competition, such as the UK's (CMA). According to Brinkworth, that means tech companies must now navigate multiple agency agendas and evolving EU regulations. 

“For example, a solution previously designed for one law like GDPR is now being challenged under another, like the DMA, even though both deal with data use and user rights. Again, in Australia with both privacy reform, the ACCC's Digital Platforms Inquiry and the proposed underlying ‘fair and reasonable test’ under the new Privacy Act – this will be something that may well be reflected locally and the question in the air is ‘Are businesses in Australia thinking this way?’" he says.

Fine balance

As a result, the core challenge Meta - and others - have now in the EU is finding a balance between providing free, ad-supported services, protecting user privacy, ensuring genuine user choice, and maintaining fair competition in the digital market.  

The reason there is so much focus on Meta’s European travails is that the case will set a precedent for how digital services balance user privacy, free services, and personalised advertising in Europe and possibly beyond.  

“Australia doesn't have DMA-equivalent regulations, however, the ACCC's Digital Platforms Inquiry has been shaping the country's approach to digital market issues," Brinkworth points out.

It’s an ongoing process that allows for a more tailored response to Australia's unique digital landscape, potentially leading to gradual changes in how digital platforms operate, how data is handled, and how competition is managed in the Australian market, he believes.

“This is evidenced by the recent data brokers review that expanded its scope beyond ‘data brokers’ to ‘data users and highlighted where data is being used beyond the notice originally given," he says.

The challenge now for Australian policymakers and businesses will be to balance these insights from international developments like DMA cases with the specific needs and characteristics of the Australian digital economy. All in all, while it seems like a ruling in the EU that’s of no consequence to the majority of Australian businesses, in actual fact it’s very much one to watch.

"Forward-thinking Australian digital publishers and adtech companies should consider how their business models might need to evolve if similar regulations are adopted domestically. This could involve diversifying revenue streams beyond targeted advertising," Brinkworth says. “Australian companies will likely need to elevate their data transparency and user control mechanisms to EU standards, potentially setting new industry benchmarks domestically."