CFPB threatens Meta with lawsuit over finance-related ad data

The Consumer Financial Protection Bureau has threatened a lawsuit against Meta, the company that owns Facebook and Instagram, over the company’s alleged use of financial information to target ads to users.

Meta, which makes money primarily by selling ads against users’ attention, tracks consumers’ Internet activity (regardless of whether they use Meta products) to build consumer profiles, which it in turn uses to ensure it can target ads more effectively. The CFPB considers that data to include financial information, according to an earnings report filed by Meta on Thursday.

The CFPB provided Meta with a notice and opportunity to respond and advise, or NORA, on Sept. 18, according to a note in the company’s quarterly earnings report. CFPB issues this type of notification before taking enforcement action, such as filing a lawsuit against a company, to give enforcement subjects an opportunity to state their case.

CFPB staff informed the company that it “may recommend” the bureau take legal action “for violations of the Consumer Financial Protection Act,” which is based on Meta receiving financial information from third parties, then using that data for advertising, according to the disclosure Meta. .

“We disagree with the complaints that staff is considering and believe that an enforcement action is unwarranted and have responded through the NORA process,” the company said in the financial statement.

The company said it’s unclear whether or not the NORA lawsuit will lead to an enforcement action, but if the CFPB director authorizes action, the agency “could file a lawsuit in the short term” and seek financial penalties.

How Meta collects consumer data

Meta helps advertisers create user profiles, providing tools that advertisers can use to track consumers’ Internet activity. This tracking may occur with the use of social engagement buttons (such as “Like” and “Share” buttons) placed on a web page that the consumer is visiting, as well as less visible tracking services also placed on web pages. These services allow Meta to target ads more precisely using data collected by advertisers.

Meta also tracks users’ activities on Facebook, Instagram and other platforms the company controls. The company said in December 2021 that it introduced restrictions to limit the use of sensitive categories previously tracked by the company for ad targeting. These categories include political affiliation, religious beliefs, race and sexual orientation. Advertisers responded by targeting users via proxy categories — such as interest in National Public Radio or Duck Dynasty.

Before that, in 2018, Facebook began phasing out the use data from third parties for ad targeting. Now, if an advertiser wants to target ads through Meta, they must either bring their own user profiles (primary data) or use those provided by Facebook (second-party data), which the company claims that they are derived solely from activity on its platform (such as ads that a user has clicked on).

These policy changes put the onus on advertisers to obtain permission from data brokers to use their consumer profiles for advertising purposes. Upon obtaining this permission, the data is considered first party and Facebook allows the advertiser to use it for ad targeting.