Socially Acceptable? EDBP Guidelines on the Targeting of Social Media Users

Editor’s Note: The European Data Protection Board (EDPB) is an independent European body, which contributes to the consistent application of data protection rules throughout the European Union, and promotes cooperation between the EU’s data protection authorities. Recently, having regard to Article 70(1)(e) of Regulation 2016/679/EU of the European Parliament and of the Council of April 27 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, the EDPB adopted guidelines on the targeting of social media users. Those guidelines were adopted on September 2, 2020, for public consultation and a complete copy of the recently published guideline document is provided for your consideration.

EDPB Guidelines 8/2020 on the Targeting of Social Media Users

Guideline Extract

A significant development in the online environment over the past decade has been the rise of social media. More and more individuals use social media to stay in touch with family and friends, to engage in professional networking, or to connect around shared interests and ideas. For the purposes of these guidelines, social media are understood as online platforms that enable the development of networks and communities of users, among which information and content is shared. Key characteristics of social media include the ability for individuals to register in order to create “accounts” or “profiles” for themselves, to interact with one another by sharing user-generated or other content, and to develop connections and networks with other users.

As part of their business model, many social media providers offer targeting services. Targeting services make it possible for natural or legal persons (“targeters”) to communicate specific messages to the users of social media in order to advance commercial, political, or other interests. A distinguishing characteristic of targeting is the perceived fit between the person or group being targeted and the message that is being delivered. The underlying assumption is that the better the fit, the higher the reception rate (conversion), and thus the more effective the targeting campaign (return on investment).

Mechanisms to target social media users have increased in sophistication over time. Organizations now have the ability to target individuals on the basis of a wide range of criteria. Such criteria may have been developed on the basis of personal data that users have actively provided or shared, such as their relationship status. Increasingly, however, targeting criteria are also developed on the basis of personal data which has been observed or inferred, either by the social media provider or by third parties, and collected (aggregated) by the platform or by other actors (e.g., data brokers) to support ad-targeting options. In other words, the targeting of social media users involves not just the act of “selecting” the individuals or groups of individuals that are the intended recipients of a particular message (the ‘target audience’), but rather it involves an entire process carried out by a set of stakeholders which results in the delivery of specific messages to individuals with social media accounts.

The combination and analysis of data originating from different sources, together with the potentially sensitive nature of personal data processed in the context of social media, creates risks to the fundamental rights and freedoms of individuals. From a data protection perspective, many risks relate to the possible lack of transparency and user control. For the individuals concerned, the underlying processing of personal data which results in the delivery of a targeted message is often opaque. Moreover, it may involve unanticipated or undesired uses of personal data, which raise questions not only concerning data protection law, but also in relation to other fundamental rights and freedoms. Recently, social media targeting has gained increased public interest and regulatory scrutiny in the context of democratic decision making and electoral processes.

Read the Complete EDPD Guidelines (8/2020) on the Targeting of Social Media Users (PDF)

Read the original public consultation post from the EDPB on Guidelines 08/2020

Additional Reading

• You Want Answers? EDPB FAQ on CJEU Schrems II Decision
• The Age of Consent? European Data Protection Board Guidelines on Consent Under the GDPR

Source: ComplexDiscovery