Connect with us

Technology

Meta’s surveillance biz model targeted in UK ‘right to object’ GDPR lawsuit

Published

on

Meta’s surveillance-based business model is facing an interesting legal challenge in the UK from an individual who’s suing over its continued processing of her data for ad targeting — despite her objection.

The legal challenge — which is being brought by human rights campaigner, Tanya O’Carroll — is seeking a declaration that Meta is in breach of the regional General Data Protection Regulation (GDPR) by continuing to process her data and use it to profile her for ad targeting purposes.

She says the goal for the litigation is to use a claim over her individual rights to set a precedent to enforce the right of millions of Meta users by denying the adtech giant’s ability to track and profile people who object to its surveillance.

O’Carroll was the chief coordinator of the People vs Big Tech campaign and a former director & co-founder of Amnesty Tech. She’s now a senior fellow at the law firm Foxglove.

Her lawsuit is not about seeking damages for privacy abuse — as is the case with another major UK legal challenge. It’s purely seeking to uphold (and thereby defend) individual rights. 

On paper, the European Union’s GDPR (which the UK transposed into national law in 2018, when local lawmakers also updated the national Data Protection Act) provides a suite of rights for individuals attached to their information — including a right to object to processing for direct marketing purposes. And an unqualified right that personal data shall no longer be processed for such a purpose if the user objects.

Thing is, Meta does not offer users of its various social networking services an option to use its services without what it likes to refer to as “personalized advertising”.

Hence this legal challenge argues that it’s breaking the law by not doing so.

“We shouldn’t have to give up every detail of our personal lives just to connect with friends and family online. The law gives us the right to take back control over our personal data and stop Facebook surveilling and tracking us,” said O’Carroll in a statement.

The AWO data rights agency is representing O’Carroll. Its legal director, Ravi Naik, told TechCrunch: “Our client is objecting to any processing of her data for direct marketing purposes. That is an absolute right.”

Naik also confirmed the claimant is not seeking damages or money. “This is purely about the right to object, so non-monetary relief,” he said.

In a supporting statement, he added: “Meta is straining to concoct legal arguments to deny our client even has this right. But Tanya’s claim is straight-forward; it will hopefully breathe life back into the rights we are all guaranteed under the GDPR.”

As well as a declaration that Meta breaches the UK GDPR’s right to object, the claimant is seeking to force it to stop processing her data for the purpose of direct marketing — and stop related profiling of her, such as Meta drawing inferences about her to micro target ads or assigning ‘ad interests’, ‘ad topics’ or ‘your topics’ for marketing purposes.

The claim document includes (long) lists of “ad interests” Meta assigned to O’Carroll between 16 June 2021 and 14 October 2022 — including a number of topics containing sensitive interests, despite changes it announced a year ago, when Meta said it would be removing as targeting options “topics that people may perceive as sensitive”.

Per the claimant, Meta said these changes were finalized by March 2022 — yet she found that a range of “sensitive Ad Interests” remained assigned to her as of October 14, 2022 — including topics related to politics and philosophical viewpoints; relationships and family matters; ancestry and identity; and psychological matters.

The claim document can be found here.

The case is being funded by Luminate, the Pierre and Pam Omidyar backed foundation — which is focused on supporting the rights of underrepresented people.

In a blog post about its involvement, Luminate wrote:

“The case we are funding challenges Facebook’s demand that users accept personalised advertising as a condition for using the service. At its heart lies the fact that people have the right to choose to use social media to connect with family and friends, access information, or use services without being profiled. While the case is being brought by an individual in the UK, a win could set a precedent for millions of users of search engines and social media in the UK, EU, and beyond who have been forced to accept invasive surveillance and profiling as part of the online experience.”

Meta was contacted for comment on the lawsuit.

A spokesman for the tech company told us:

“We know that privacy is important to our users and we take this seriously. That’s why we build tools like Privacy Check-up and Ads Preferences, where we explain what data people have shared and show how they can exercise control over the type of ads they see.”

‘Forced consent’ to ‘contract for ads’

This is not the first time a legality of processing type complaint has been levelled at Meta’s tracking and targeting business model.

Indeed, one of the first GDPR complaints filed after the pan-EU framework began to apply, back in May 2018, targeted what the complainant dubbed Facebook’s “forced consent” — arguing that since users were not offered a free choice to deny its tracking then consent was not being legally obtained under the GDPR.

Thing is, Meta has sought to bypass GDPR complaints targeting its surveillance-based business model by switching from an earlier claim to be obtaining user consent to process data to claiming users are actually in a contract with it to receive personalized ads.

Per the claim document, its argument for denying O’Carroll’s objection and demand to stop its processing of its data has also relied up on claiming that no one can object to its processing of their data for marketing since the core service is processing of their data for marketing.

Yet if you browse to facebook.com, the marketing text that appears on the website does not tout a service that ‘helps you receive personalized ads’. Instead it claims: “Facebook helps you connect and share with the people in your life” — with zero mention of ads (‘relevant’ or otherwise).

A draft GDPR decision by the Irish Data Protection Commission (DPC), Meta’s lead data protection supervisor in the EU, on the aforementioned ‘forced consent’ complaint — which was published just over a year ago — found Meta had infringed transparency requirements in the GDPR by not clearly communicating to users they were agreeing to its claimed ad contract when they signed up.

At the same time, however, the Irish watchdog’s draft decision appeared to be inclined to sidestep the core complaint over Meta bypassing the GDPR — with the DPC apparently opting to avoid weighing in on tech giant’s tactic of relabeling an agreement on data use with users as a ‘contract, rather than consent.

This very long-running GDPR complaint over the legality of Meta’s data processing has still not resulted in a final decision — some 4.5 years after the complaint was made. So it remains to be seen where it will end up.

It won’t only be the DPC that decides the issue since other EU DPAs are able to object to draft decisions they disagree with. Although whether Meta’s surveillance business model will face a meaningful regulatory reckoning under this GDPR complaint route — or simply lead to yet another reboot and ongoing regulatory whack-a-mole — is not yet clear.

AWO’s Naik is dismissive of focusing on legal basis as a strategy to enforce data protection rights against Meta’s surveillance business model — dubbing it “irrelevant” and a “distraction” as he predicts that even if regulators do finally instruct Meta that an ads contract is not viable the company will “just change course”.

Whereas, he argues that by objecting to any processing of data for direct marketing the consequence is “more dramatic than the lawful basis argument, as it is an absolute bar”.

As a refresher, Article 21 (“right to object”) of the GDPR includes these two highly relevant clauses:

2.   Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.

3.   Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

Nonetheless, it remains to be seen what UK courts will make of O’Carroll’s challenge and Meta’s claim that the right to object to use of data for marketing does not apply to its services.

Frustration with painstakingly slow enforcement of the GDPR against Big Tech is driving a growing wave of litigation around the region — including a number of legal challenges that seek to leverage rising antitrust concerns against tech giants.

O’Carroll’s GDPR-focused complaint makes passing nod to antitrust issues, with the PR announcement of the lawsuit citing a final report by the UK’s competition regulator, the CMA, published in July 2020 — looking at online platforms and digital advertising — which found Facebook “uses default settings to nudge people into using their services and giving up their data”, including having a requirement to “accept personalised advertising as a condition for using the service”.

It also notes the CMA observed: “Only a small minority (13%) say they are happy to share their data in return for relevant ads.”

However this antitrust element is not material to the crux of the lawsuit — which Naik confirmed is fully fixed on the GDPR’s absolute ‘right to object’. So the suit’s success will not hinge on UK courts joining the dots between privacy law and antitrust concerns vis-a-vis Meta’s surveillance modus operandi.

In terms of timeframe, the litigation could take several years — depending on any appeals. Naik told us they aren’t able to put a timeframe on the complete outcome but suggested they could get a high court judgement in six to nine months time.

One development that might cause concern for UK litigation centered on the GDPR is the government’s ongoing plan to reform (and potentially weaken) the domestic data protection regime.

The current secretary of state in charge of digital issues, Michelle Donelan, told the Conservative Party conference in October that the government would replace GDPR with a “truly” bespoke, British framework she claimed would simplify the rules to boost to business while also protecting people’s privacy and data. (However she did not spell out the exact changes ministers would make nor when they might bring a tweaked reform bill back to parliament — so much remains tbc about this UK GDPR ‘reform’ plan.)

Asked about the risk of a weakened framework undermining the litigation, Naik pointed out that the prior draft data reform bill did not touch the right to object — suggesting there’s therefore no danger of it being amended.

But if the UK government does seek to meddle with people’s right to deny use of their data for marketing it would be pretty clear which businesses had been front and center lobbying for such a ‘reform’.

Returning to the competition track, despite the CMA’s final report into online adtech raising substantial concerns more than two years ago, it (unfortunately) opted to wait for an expected (but also delayed) reform of UK competition rules to empower it to effectively clip the wings of Big Tech.

Delays to that domestic competition law reform may therefore also be driving an uptick in antitrust litigation and class-action style suits against Big Tech in the UK.

Since the CMA report was published, the regulator has ordered Meta to undo its acquisition of Giphy over competition concerns. Earlier this year, it also announced it was opening a probe of allegations of collusion between Google and Facebook (aka Meta) related to ad bidding — over an internal agreement dating back to 2018, reportedly called ‘Jedi Blue’. So interventions are on the uptick.

But given the scale of concerns set out in the CMA’s online ads report it’s fair to expect further attention and action by the competition watchdog to Big Adtech — despite the continued failure of the UK’s data protection watchdog to take firm enforcement action over its own long-stated concerns about the lawfulness of behavioral advertising.

Technology

Mozilla acquires the team behind Pulse, an automated status updater for Slack

Published

on

Firefox developer Mozilla is making a rare foray into the world of mergers and acquisitions, with news that it has snapped up recently-shuttered California-based productivity startup Pulse.

Terms of the deal haven’t been disclosed, but the deal is tantamount to an “acqui-hire,” with Mozilla looking to deploy the Pulse team across an array of machine learning (ML) projects.

“We’re acquiring Pulse for the incredible team they have built,” Mozilla chief product officer Steve Teixeira told TechCrunch. “As we look to continue to improve user experiences across all of our products, ML will be a core part of that.”

Feel the pulse

Founded out of Menlo Park in 2019, Pulse in its initial guise was a “virtual office” platform called Loop Team, but after honing the idea for a couple of years it pivoted and rebranded last November. Pulse, essentially, was an automated status-updating tool that used signals based on pre-configured integrations and preferences set by the user.

For example, users could synchronize Pulse with their calendar and Slack, setting rules to stipulate what their status and corresponding emoji should be based on keywords in their calendar event title. If their schedule for a particular time says “hair appointment” from 12-1pm, then the person’s Slack status update might display a scissors emoji alongside the word “haircut.” Or, it might say “birthday” alongside a cake emoji if that’s what is in their calendar.

Pulse: Calendar rules

But Pulse sported myriad integrations with business tools that brought similar functionality. For example, users could link Pulse with Zoom, so that whenever they start a video meeting, a telephone emoji automatically displays in their Slack status to tell people they are unavailable.

Shutting shop

Pulse had flown largely under the radar since it started rolling out to a small group of users last December, but the company had apparently garnered some fairly big-name customers, including Netflix and 1Password, with monthly premium plans starting at around $3 per user.

The company was among TechCrunch’s Battlefield 200 startups at TC Disrupt in October, and TechCrunch interviewed Pulse cofounder and CEO Raj Singh at the event for a potential future startup profile piece. Singh said at the time that it was planning to raise a seed round of funding early in the new year, something that obviously won’t be happening now. When quizzed on whether Pulse was more like a feature that the big tech platforms could just build themselves, rather than a sustainable business in its own right, Singh was adamant that Pulse could thrive as a standalone product. While he acknowledged that companies such as Microsoft or Google might well want to develop a similar automated status update tool for their own products, they were less incentivised to make it work well as an integrated feature that plays ball with various third-party tools.

Pulse was all about communicating things to colleagues around the world passively, regardless of what tools they were using or what timezone they’re in. This is particularly important with remote work becoming the norm, and Pulse was looking to find its niche at a time when workplace culture is rapidly changing.

“A lot of people actually want to update their status, but it’s tedious,” Singh told TechCrunch in October. “But there’s hundreds of signals, and the thing we realised was status is not just ‘availability’, it’s actually a way to communicate empathy.”

While Pulse did have plans to expand beyond Slack into other workplace communication tools including Microsoft Teams and Google Workspace, the company abruptly announced in late October that it was shutting down. In an email distributed to customers at the time, the company attributed this to “market conditions,” noting that it was finding it difficult to raise fresh capital — but it did confirm that it had found a buyer, the identity of which was unknown until today. Singh also said in the email that there was a chance that the buyer could resurrect Pulse in some form, but there is little indication that Mozilla has such a plan on its radar.

What’s next

To the casual observer, Slack was probably the obvious contender to acquire Pulse. For starters, there is the fact that Pulse had been focused exclusively on Slack status updates. But on top of that, Singh had previously founded a smart calendar app called Tempo AI which he sold to Salesforce for an undisclosed sum in 2015.

Singh then joined Salesforce to help with the initial transition of Tempo AI’s technology into Salesforce’s Inbox app. And as we now know, Salesforce went on to acquire Slack in 2020, so with Singh’s connections to Salesforce and his product’s close alignment with Slack, there seemed like only one possible suitor here. 

Tempo AI Image Credits: Tempo AI

Alas, Slack hasn’t acquired Pulse — the Mozilla Corporation has. It is something of a surprise, if for no other reason than Mozilla isn’t renowned for its M&A endeavors, though it is starting to ramp up its investment efforts after launching its first venture capital fund last month. But its only known acquisition to date was back in 2017, when it snapped up Pocket, a popular read-it-later web-clipping service that Mozilla had already integrated into its Firefox browser two years previous.

As a side point, Pulse itself had been on something of an acquisition spree this year, buying rival status updating service Holopod back in January, followed by audio-based communications platform Commons in March. Then in May, news emerged that Pulse had acquired team communication startup Lounge.

“Our strategy [with M&A] is pretty straightforward — we look for opportunities to bring on talent and technology that helps us improve experiences for our customers,” Teixeira said. “With Pulse, this is about supplementing the skillsets we have here already as a way to speed up our development efforts. We have a high bar for any acquisition, but if we find teams and technologies with incredible talent that share our mission and vision for the future of the internet, we are absolutely open to pursuing a transaction.”

As it happens, Pocket may be an early beneficiary of the Pulse acquisition. While Mozilla ultimately plans to deploy the Pulse team across various projects, Teixeira says that an early focus will be on using ML to improve personalization in Pocket, which presumably means in the form of content recommendations.

It’s worth noting that Mozilla has dabbled with ML a fair bit in the past, including experimental projects inside Firefox that recommend content to users, as well as tracking prices across myriad online stores. The company is also leveraging ML across various voice and speech projects.

“We see opportunity to use ML in virtually all of our products, including Firefox, as a foundation for improving the experience for all of our customers,” Teixeira said.

Mozilla hasn’t revealed how much it’s doling out for the startup, but Pulse had only raised around $4.7 million in pre-seed funding according to Crunchbase data, and given its difficulties in raising fresh capital, it’s safe to assume that Mozilla hasn’t broken the bank here.

What Mozilla is getting for its money is six people, including Pulse’s three founders Raj Singh, Jag Srawan, and Rolf Rando, each bringing significant engineering, ML, and product execution experience to Mozilla’s ML efforts. Singh actually created his previous startup Tempo AI as a project inside SRI International, the Stanford research institute responsible for Siri. He rejoined SRI as executive in residence (EIR) after leaving Salesforce, remaining there until founding Pulse (then Loop Team) nearly four years ago.

“In building Pulse, we enabled a variety of machine learning experiences to make distributed teams feel more connected,” Singh noted. “Finding ways to use AI and machine learning to simplify tasks for users is our passion.”

Continue Reading

Technology

Here’s your chance to show off your expertise at TechCrunch’s founder summit

Published

on

Do you have what it takes to present at TechCrunch Early Stage on April 20 in Boston, Massachusetts? We’re looking for trendsetting, game-changing, later-stage startup founders and ecosystem experts — of every stripe — to apply for the opportunity to share their hard-won expertise at our annual founder summit.

An entrepreneurial bootcamp experience, TC Early Stage connects people in the beginning or early stages of their startup journey with top industry experts for hands-on training. Presenting at this event is an opportunity to align yourself with TechCrunch and position yourself as a thought leader for hundreds of early-stage entrepreneurs. Apply here now.

You have until January 6 to submit an application outlining the content you’d like to present. TechCrunch will vet each application and select the top contenders to participate in an Audience Choice voting round where TechCrunch readers will choose the sessions they want to see most at TC Early Stage.

Our call for outstanding content is officially open, and here are the important dates to keep in mind:

  • Application deadline: January 6
  • Notify Audience Choice participants: January 23
  • Voting period: January 30 through February 17
  • Notify winners: By February  22

If you can deliver content that elicits this kind of attendee feedback, we want to hear from you.

“Early Stage offered a great variety of sessions and speakers — top investors, founders and credible subject-matter experts — who gave unique insights based on personal experience. You get great mentorship through attending the Early Stage sessions. It’s like a mini masterclass in entrepreneurship.” — Ashley Barrington, founder, MarketPearl

Show us your content — apply today!

TC Early Stage, which takes place on April 20, 2023, in Boston, Massachusetts, provides access to essential information, resources and community connections to help nascent entrepreneurs reach their potential. Grab your ticket now — just $149 for the next 30 founders — and join us in Boston!

Is your company interested in sponsoring or exhibiting at TC Early Stage 2023? Contact our sponsorship sales team by filling out this form.

Continue Reading

Technology

Amplio helps companies find components when supply chain breaks down

Published

on

When Covid shut down much of the world down in 2020, it ended up wreaking havoc on the supply chain. Suddenly companies built for just-in-time production couldn’t find parts they needed to build their products.

Even as Covid subsided, the supply chain woes continued. Veterans of supply management like the founder of startup Amplio watched, and figured there had to be a better way to guard against these kinds of disruptions in the future using software to find parts wherever they were.

Amplio launched last year with that goal in mind, and today the startup announced a $6 million seed to build a system to help track parts shortages. Trey Closson, CEO and co-founder at Amplio says his company’s goal is to build more resilience into the electronic components supply chain.

“We help our customers understand the components that are at highest risk of leading to material shortages, and then we connect our customers to alternative sources of supply to mitigate those shortages,” Closson told TechCrunch.

He knows what he’s talking about. He spent his entire career in supply chain management, and he’s seen firsthand how disruptions can have a negative impact on a business’s ability to function. He blames “Just-in-time production” techniques for the problems we are seeing today.

“The supply chains have been designed for 30 or 40 years to optimize for cost and for the best case scenario, but the reality is that we don’t live in a world of best case scenarios. We live in a world of constant disruptions,” he said.

“The way that our platform works is that we’re connected to our customers’ systems of record or their ERP solutions, and we take in in their bill of materials and their operational data, and then combine that with external datasets to be able to show the customer their ability to source their particular components over the next six to 18 months,” he said.

Amplio parts inventory screen showing which parts could be in danger of having supply issues.

Image Credits: Amplio

What’s more, in cases where the customer isn’t able to source the components, customers can go to the Amplio marketplace to find suppliers or other manufacturers who might have surplus inventory they are trying to sell.

Closson’s most recent job was working at Koch Industries, leading international supply chain for Georgia Pacific, where he was on the front line of the Covid-induced toilet paper shortages. But he decided to focus his startup on electronic components.

“So while supply chain resilience is really critical across the market, we want to focus on the electronics industry, because it has such a tremendous impact on the global economy,” he said. He conceived of and incubated the company as part of a program run by Koch and High Alpha Innovation, the program launched by former Exact Target execs to help startups with enterprise-focused ideas.

The company currently has 6 employees, but plans to expand with the funding (which closed in May). He says as he grows the company, diversity and inclusion is a core building block. “Diversity is one of the core principles for our hiring and in decision making processes. So just from a selfish standpoint, diverse organizations make better decisions and have more creative ideas, and are ultimately more successful,” he said.

Today’s round was led by Construct Capital with participation from Slow Ventures, High Alpha Capital, Flexport Ventures, Alpaca Venture Capital and various industry angels.

Continue Reading

Trending