Meta’s submission to the Privacy Act Review Report — April 2023

Executive summary

Meta welcomes the opportunity to respond to the Review of the Privacy Act, undertaken by the Australian Attorney-General’s Department. Meta supports the modernisation of Australia’s privacy law framework, and we have worked to engage constructively with this review over the course of the last three years.

Meta has been calling for stronger privacy protections for consumers — globally and in Australia — for some time.1 We believe consumers should have transparency and control over the use of their data, and we offer a number of voluntary and industry-leading tools to enhance consumers’ transparency and control.

Collectively, if implemented, the proposals in the review would be an enormous stepchange in privacy and data protection in Australia.

Meta continues to support the modernisation of Australian privacy law. Of the 116 recommendations in the Privacy Act Review, there are 106 that Meta supports (either in full or in principle) or has no comment. We continue our support for some recommendations covered in earlier discussion papers, such as: a statutory tort for serious invasions of privacy; a right to erasure consistent with the European General Data Protection Regulation (GDPR); and a clarified definition of personal information.

We also commend the Department on positive changes made since the last Discussion Paper, including the introduction of ‘controllers’ and ‘processors’ as legal concepts in Australian law, and the balanced approach taken to consent requirements. We also strongly support the new proposal to insert an Australian link to clarify the extraterritorial application of the Privacy Act.

There are, however, some new recommendations put forward in the final report for the first time that could impede the ability to offer personalised online services in Australia.

Firstly, the report proposes defining all online personalisation as ‘targeting’ and bringing it within scope of the Privacy Act. The proposed definition of targeting is overly broad and potentially impedes everyday business behaviours that are beneficial to consumers, businesses and the broader economy.

Personalisation allows customers to receive services that are more useful, relevant and convenient to them. It also improves efficiency and productivity across the economy. It has become a fundamental expectation from Australian consumers.

However, the proposed definition of ‘targeting’ is overly broad. It covers any personalisation of services, content or information. For example, even when an online service is showing a consumer content that they have asked to see (such as following an Instagram account), the activity would be covered because of the way that online service displays or disseminates the information.

Consequently, a host of beneficial or benign business behaviours that are common across the economy would be subject to a special category of regulation beyond other uses of data, even though the risk of harm to the consumer is low. When coupled with the other recommendations in the report, this proposal would mean essentially every aspect of an online service would require onerous documentation, and could be objected to by consumers. It is so burdensome as to risk deterring innovation and personalisation.

To the extent that harms could arise from the use of personalisation, these can be addressed either by: (1) the broader cross-economy requirements in the Privacy Act that apply to all other uses of data; (2) the voluntary transparency measures and controls that platforms like Meta make available; or (3) the existing regulatory frameworks that relate to online safety, discrimination, consumer protection or election integrity.

Secondly, the report proposes establishing an unqualified right to opt out of personalised advertising, coupled with an obligation for companies to continue providing the service to consumers who have opted out.

An opt out right could raise the cost and lower the effectiveness of advertising, without a commensurate improvement in outcomes for consumers.

Personalised advertising contributes significantly to the Australian economy. Research suggests there has been a $10.2 billion increase in consumer value from better matching consumption and consumer preferences, plus savings of $36.5 billion annually for consumers due to decreased transaction costs.2 The efficiency of personalised advertising brings benefits to organisations with tight marketing budgets, such as small businesses, not-for-profits, and government departments.

Consumers appreciate the benefits of personalised advertising. Consumers overwhelmingly prefer ads that are useful and tailored to them, with 90 per cent of people reporting that messages from companies that are not personally relevant to them are “annoying”.3 According to recent research, 76 per cent of Australians agree that personalised ads show information and products of interest to them, and 70 per cent of Australians prefer to have free access to social media and mobile apps in exchange for seeing ads.4

The opt out right as proposed in this report essentially dictates the business model that companies use to provide online services, by compelling businesses who offer adsupported services to build alternative business models. They are left with less-desirable choices, like relying on generic, less effective, and more costly advertising, or moving to other business models such as subscriptions. It would undermine ad-supported business models, without any meaningful improvement in consumer choice. Consumers are already able to avail themselves of tools on Facebook and Instagram to excise specific data or specific advertisers from the ads they see. If consumers object to a service that is funded by the business model of ads, they can choose not to use that service.

An opt out right could also interfere with online personalisation for the purposes of safety or other public policy objectives. Exclusion targeting (such as excluding users who are under 18 from age-sensitive ads) still requires the collection of data and personalisation of ads for those users who are excluded.

Both the regulation of ‘targeting’ and an opt-out right are new and had not been proposed previously in the review process. They also go beyond the requirements in the GDPR and other comparable international regimes to establish Australia-specific rights.

Finally, while we can see conceptual benefits in algorithmic transparency and establishing obligations specific to young people, we don’t believe privacy legislation is the appropriate mechanism for specific new algorithmic transparency requirements, given the use of data for algorithms is not unique to other business uses of data. Our submission provides some more information about the practical implications of these proposals.

Given the potentially significant impact of these proposals, we recommend undertaking further consultation on these recommendations to bring greater precision to the public policy objective and time to consider ways to address that objective that would be more proportionate. Our submission provides some suggestions on how these proposals could be re-designed to more precisely address the risks. The overall package of reform proposals in the report is very comprehensive, and we recommend the Government implement the proposals in stages. Proposals that have only been put forward in this latest report should be left for the final stage of any reform. Once implemented, industry should be given an adequate transition period to adapt to the significant reforms.

1 M Zuckerberg, ‘The Internet needs new rules. Let’s start in these four areas’, The Washington Post, 30 March 2019, https://www.washingtonpost.com/opinions/mark-zuckerberg-the-internet-needs-new-rules-lets-start-in-these-fourareas/2019/03/29/9e6f0504-521a-11e9-a3f7-78b7525a8d5f_story.html; and Meta, Submission to the Privacy Act Review Discussion Paper, December 2021, available at https://consultations.ag.gov.au/rights-and-protections/privacyact-review-discussion-paper/consultation/published_select_respondent

2 IAB, ‘Ad’ing value: the impact of digital advertising on the Australian economy and society’, PWC, November 2022, as accessed at: https://m.iabaustralia.com.au/asset/395:ading-value---the-economic-impact-of-australias-digital- advertisingindustrypdf#:~:text=The%20value%20of%20advertising%20for,for%20businesses%20of%20different%20sizes

3 Infogroup, The Power of Personalization, May 2019, https://www.emarketer.com/chart/228797/attitudes-towardpersonalization-among-us-internet-users-jan-2019-of-respondents

4 Ipsos, Global Consumer Survey of Small Enterprises — Australia, July 2022