Pinterest may not be the first social media platform that comes to mind when discussing privacy concerns. Nevertheless, the visual discovery tool has come under fire from the European privacy advocacy group noyb, which alleges that it breached the General Data Protection Regulation (GDPR) by not securing user consent before tracking and profiling them for advertising purposes.
Under the GDPR, companies can face fines of up to 4% of their global annual revenue for confirmed violations, making these types of complaints potentially costly for tech giants.
Although Pinterest tends to maintain a lower profile regarding online privacy issues compared to other popular ad-driven platforms like Facebook, it’s important to remember that the platform was implicated in the tragic case of Molly Russell, a U.K. schoolgirl who committed suicide in 2017. Many apps, including Pinterest, presented her with pro-suicide content.
A 2022 report titled “Prevention of Future Deaths” issued by a U.K. coroner concluded that the “negative effects of online content” contributed to her death, highlighting the risks associated with extensive tracking and profiling by ad-supported platforms.
The noyb-backed complaint against Pinterest has been lodged with the data protection authority in France, accusing the company of not honoring a GDPR data access request. Specifically, it allegedly failed to disclose what categories of data related to the complainant were shared with third parties.
In addition to requiring that organizations have a legitimate legal basis for processing personal data, the GDPR grants individuals in the EU a range of access rights, enabling them to request copies of their data.
“Undisclosed tracking”
Pinterest is relying on a legal basis for processing personal data for advertising purposes known as legitimate interest (LI). However, noyb contends that this practice violates the GDPR.
The group references a July 2023 ruling by the European Court of Justice (ECJ) that dismissed Meta’s capability to operate its advertising business based on LI. This ruling implies that Pinterest must obtain consent from users in Europe for its “personalized ads” initiative.
Currently, Pinterest, which boasts around 130 million users in the region, automatically tracks all its users by default to “personalize” advertisements.
Users in Europe who wish to opt-out of being tracked and profiled must actively object to this processing. The GDPR stipulates that users must have the option to refuse processing when LI is the legal basis, rather than being asked to approve the use of their data as noyb believes should be the case.
“Pinterest is covertly tracking users in Europe without obtaining their consent,” stated Kleanthi Sardeli, a data protection attorney at noyb, in a comment on the complaint. “This enables the social media platform to profit unlawfully from users’ personal information without their awareness.”
“It appears that Pinterest is willfully disregarding a ruling from the European Court of Justice (CJEU) to maximize its profits. The CJEU has clarified that personalized advertising cannot rely on legitimate interest,” Sardeli further mentioned.
Concerns over data access
noyb has filed the complaint on behalf of an anonymous user who was unaware that Pinterest was tracking her without her consent.
She discovered this tracking only when she checked the “privacy and data” settings and found that “ads personalization” was enabled by default. She also realized that the platform utilized data from “visited websites” and other third parties for advertising purposes, along with monitoring her on-site activity. Essentially, Pinterest operates in the realm of surveillance advertising.
“Such practices have been illegal since the introduction of the GDPR in 2018,” noyb explained in a news release. “According to its ruling in case C252/21 Bundeskartellamt in 2023, the Court of Justice of the European Union (CJEU) reiterated that personalized advertising cannot be justified by legitimate interest under Article 6(1)(f) GDPR.”
The complainant also submitted a data access request to Pinterest, but the report she received failed to include data regarding who her information was shared with, as per noyb’s claims.
“After filing two additional requests, Pinterest still did not provide details about the types of data shared with third parties,” they asserted, adding: “Essentially, Pinterest did not adequately fulfill the access request under Article 15(1)(c) GDPR.”
The complaint demands that Pinterest delete any data it has collected for advertising and inform users of this action. Moreover, it insists that the company comply with the complainant’s data access request. Additionally, noyb is seeking a penalty that would deter future GDPR violations.
Pinterest has been approached for commentary regarding the complaint. Update: Jess Brand, a spokesperson for Pinterest, has sent a statement refuting noyb’s claims: “Pinterest’s method of personalized advertising complies with GDPR regulations,” she stated.
The spokesperson added that the platform does not allow personalized ads to be shown to users under the age of 18 in the EU and U.K.
While the complaint has been filed within France, where the National Commission on Informatics and Liberty (CNIL) is known for rigorously enforcing privacy laws, it might be transferred to Ireland’s Data Protection Commission because Pinterest’s regional headquarters is located in Dublin. This is in line with the GDPR’s “one-stop shop” mechanism, which is designed to streamline the management of complaints that stretch across EU member states.
However, noyb has clarified to TechCrunch that its complaint pertains to Pinterest’s U.S.-based entity. They note that both Pinterest Europe and Pinterest, Inc. (the U.S. entity) are identified as co-data controllers in the company’s privacy policy.
“Consequently, the CNIL is the correct authority and should not pass the complaint to Ireland,” they proposed. “However, we cannot predict whether they will forward it regardless.”
* In response, Meta has shifted to a consent-based legal framework for its tracking advertisements. However, this form of “consent” essentially forces users to either pay for an ad-free subscription or accept tracking ads for free access to its services—a situation that is also facing scrutiny over privacy, consumer rights, and competition. But that’s another discussion entirely.
Compiled by Techarena.au.
Fanpage: TechArena.au
Watch more about AI – Artificial Intelligence
