Today, the European non-profit organization noyb (None of Your Business) filed a formal complaint against Pinterest, the popular visual social media platform, for allegedly violating data protection laws.
Pinterest, widely known for helping users discover and organize ideas related to various topics like home decor and fashion, operates primarily through a business model centered on personalized advertising. This model relies on tracking user data to deliver targeted ads, but noyb contends that Pinterest is doing so unlawfully.
Pinterest has 522 million monthly active users (MAUs) in the second quarter of 2024. Women make up more than two-thirds of Pinterest’s user base. Pinterest has reported revenue of $853.68 million during the second-quarter of 2024. Pinterest has generated revenue of $143 million from Europe in Q2 2024. Pinterest has 136 million customers in Europe.
User Tracking Without Consent
The complaint indicated that Pinterest has failed to comply with the General Data Protection Regulation (GDPR) by not obtaining explicit consent from users before processing their personal data. Instead of following the legal requirement to secure opt-in consent as outlined in Article 6(1)(a) of the GDPR, Pinterest erroneously claims to operate under a “legitimate interest” framework (Article 6(1)(f)). This argument has been largely abandoned by other platforms in light of a ruling from the Court of Justice of the European Union (CJEU) that clearly states personalized advertising cannot be justified under legitimate interest.
Kleanthi Sardeli, a data protection lawyer at noyb, stated, “Pinterest is secretly tracking European users without asking for their consent. This allows the social media platform to unlawfully profit from people’s personal data without them ever finding out.”
Lack of Transparency in Advertising Practices
The complaint was initiated by a user who discovered that Pinterest had enabled ad personalization by default, meaning users are tracked for advertising purposes unless they actively opt out. This user, after investigating the privacy settings, realized that her data was being utilized without her knowledge or consent.
Further compounding the issue, when the complainant sought access to her data, Pinterest provided a copy but did not disclose how her data was being shared with third parties. Despite multiple requests, Pinterest did not fulfill its obligations under Article 15(1)(c) of the GDPR to inform the user about the categories of data shared.
Formal Complaint with French Data Authority
Noyb has submitted the complaint to the French data protection authority (CNIL), asserting that Pinterest has violated both Article 6(1) and Article 15(1)(c) of the GDPR. The organization demands that Pinterest cease using the complainant’s data for personalized advertising and inform the recipients of that data about its erasure. Moreover, noyb urges the CNIL to impose an administrative fine to deter similar violations by Pinterest in the future.
The complaint highlights ongoing concerns regarding user privacy and data protection in the digital landscape, emphasizing the need for platforms to adhere strictly to established legal frameworks governing data usage.
Baburajan Kizhakedath
