'Consent' LinkedIn Used For Data Processing Was Not Freely Given, Says Ireland

When LinkedIn asked its European users for their personal data, it did not receive "informed" nor "freely given" consent for the business to ship it off to third parties for generating targeted advertising, a Euro data watchdog has said.

Ireland's Data Protection Commission (DPC), which is responsible for regulating Linkedin's operations because the Microsoft subsidiary has its European headquarters there, imposed a fine of €310 million ($335 million). LinkedIn will also have to bring its data practices into compliance. This is lower than the $425 million Microsoft set aside last year in case LinkedIn data drama hit.

Microsoft told us at the time that it denies it broke any GDPR rules and said it "intends to defend itself vigorously in this matter."

It said of the final decision reached this week "on claims from 2018 about some of our digital advertising efforts in the EU" that while it believes "we have been in compliance with the General Data Protection Regulation (GDPR), we are working to ensure our ad practices meet this decision by the DPC's deadline."

There are several bases for data to be processed under GDPR, consent being one of them. Consent is the legal basis that LinkedIn gives for its processing of user data for behavioral analysis and targeted advertising.

But in this case, consent was not "freely given, sufficiently informed or specific, or unambiguous," as is required under GDPR for the information to be used for these purposes, said the DPC.

The case was initiated in 2018 by the French digital civil rights org La Quadrature du Net. It had originally submitted a complaint [PDF] to French supervisory authority CNIL, but the DPC then took over as the responsible supervisory authority.

• Microsoft stashes nearly half a billion in case LinkedIn data drama hits
• LinkedIn links out of China with 716 roles for the chop
• LinkedIn started harvesting people's posts for training AI without asking for opt-in
• LinkedIn: If our AI gets something wrong, that's your problem

The complaint explains that users have to click a button accepting terms of use, cookies, and a privacy policy when they create an account. Only afterward can they go down a nested menu of You > Preferences & Privacy > Ads to disable "a multitude of categories of data for advertising purposes settings" (translated from French). But European data law requires that data subjects know they have "the right to withdraw consent at any time," and that they are informed of this before they say yes.

The outfit's "LinkedIn Premium" unit alone was described by COO Daniel Shapero as a $1.7 billion annual business, so the €310 million ($335 million) is relatively small for the social media unit and a drop in the ocean for Microsoft, which reported a record $211 billion in revenue and over $88 billion in operating income for FY 2023 earlier this month. ®