When it comes to privacy nightmares, Pinterest is unlikely to be the first social app that comes to mind. But the visible discovery engine's use of tracking ads is the target of the latest complaint from a European nonprofit that advocates for privacy rights. noybque accuses it of violating the block's Basic Data Protection Regulation (GDPR) by failing to obtain users' consent to be tracked and profiled for advertising purposes.
The GDPR allows penalties of up to 4% of global annual turnover for confirmed violations, so such complaints can lead to substantial penalties for tech giants.
While Pinterest has generally flown under the radar when it comes to online privacy issues, especially compared to other ad-supported social services (like Facebook), it's worth remembering that the company's tracking and profiling took up a central place in the tragic case of the 2017 suicide of British schoolgirl Molly Russell. Several applications, including Pinterest, inserted pro-suicide content on their social networks.
A 2022 report on “Preventing Future Deaths” by a UK coroner found that the “negative effects of online content” were a factor in his death. It was the result of widespread tracking and profiling of users by advertising-funded platforms.
In the noyb-backed complaint against Pinterest, which was filed with France's data protection authority, the platform is also accused of failing to comply with a GDPR data access request. It did not provide information about the categories of data about the complainant that were shared with third parties.
In addition to requiring companies to have a valid legal basis for processing people's data, the GDPR provides people in the EU with a set of access rights, such as the ability to request a copy of their information.
'Secret tracking'
Pinterest relies on a legal basis to process people's data for ad targeting, known as legitimate interest (LI). However, noyb argues that this use does not comply with the GDPR.
It points to a July 2023 ruling by the EU's top court that denied Facebook owner Meta's ability to establish its own surveillance ad business through LI*, stating that Pinterest must therefore get the consent of Europeans to run their own “personalized ads” business.
As it stands, Pinterest, which has about 130 million regional users, tracks them all by default to “personalize” ads.
Any Pinterest user in Europe who wishes not to be tracked or profiled in this way must take the active step of objecting to processing (the GDPR requires that users have the ability to object to processing if LI is the legal basis), instead rather than being asked affirmatively if they agree to their information being used in this way, as noyb believes should be the case here.
“Pinterest is secretly tracking European users without asking for their consent,” Kleanthi Sardeli, data protection lawyer at noyb, said in a statement about the complaint. “This allows the social media platform to illegally profit from people's personal data without them knowing.”
“It appears that Pinterest is actively ignoring a ruling from the European Court of Justice (ECJ) to maximize its profits. The CJEU made it clear that personalized advertising cannot be based on a legitimate interest,” Sardeli added.
Data access problem
noyb's complaint against Pinterest was filed on behalf of an anonymous user who she said did not realize she was being tracked by the platform without consent.
He only discovered Pinterest tracking when he looked at the “privacy and data” settings, where he discovered that “ads personalization” was turned on by default. It also discovered that the platform uses information from “visited websites” and other third parties to display ads, in addition to tracking your activity on the site for this purpose. In short, Pinterest is in the watchdog ad business.
“This practice has been clearly illegal since the introduction of the GDPR in 2018,” noyb wrote in a press release. “In his ruling in case C252/21 Bundeskartellamt In 2023, the Court of Justice of the European Union (CJEU) again determined that personalized advertising cannot be based on legitimate interest under Article 6(1)(f) of the GDPR.”
The whistleblower also took the step of submitting a data access request to Pinterest. But the copy of your data you received did not include any information about the recipients of your data, according to noyb.
“Even after two additional requests, Pinterest did not provide details about the categories of data that were shared with third parties,” he wrote, adding: “In other words: Pinterest did not adequately respond to the access request under Article 15(1). (c) GDPR.”
The complaint demands that Pinterest delete all data it has processed for ads and inform users that it has done so. The company must also comply with the whistleblower's request for access to data. Additionally, noyb is pushing for a fine level that will serve as a deterrent to future GDPR violations.
Pinterest has been contacted for a response to the complaint.
While noyb has brought this case in France, where the regulator (CNIL) has a strong reputation for enforcing privacy complaints (including around the issue of consent), it may be moved to the Data Protection Commission from Ireland because Pinterest has its regional platform. Headquarters in Dublin. (And thanks to the GDPR's “one-stop shop” mechanism to streamline oversight of complaints that cross EU borders.)
However, noyb told TechCrunch that it filed the complaint against the US-based Pinterest entity, noting that the company's privacy policy names both Pinterest Europe and Pinterest, Inc (i.e. the entity of the USA) as joint data controllers for the processing.
“Therefore, the CNIL is the competent authority and should not send the complaint to Ireland,” he suggested. “But of course we don't know if they will do it anyway.”
*For its part, Meta has since switched to a consent-based legal basis for its tracking ads. Although it is a version of “consent” that forces users to choose between paying you for an ad-free subscription or accepting your tracking ads to access your services for free; that is now also subject to privacy, consumer protection and competition complaints. But that's another story.
ACJ">Source link