In nightmares of privacy, Pinterest is unlikely to be the first application a person thinks of. However, the visual discovery engine's deployment of tracking ads has become the latest onus for the European privacy rights non-profit, noyb, that have accused it of breaching the bloc's General Data Protection Regulation (GDPR) in failing to obtain consent from the users before it proceeds to track and profile those users for advertising purposes.

Even complaints under the GDPR can cost tech giants dearly in terms of penalties, with up to 4% of global annual turnover for confirmed breaches.

While Pinterest has generally flown low under the radar on online privacy issues—especially compared to other mainstream ad-funded social services such as Facebook—it's worth remembering that the company's tracking and profiling was well and truly pulled centre stage in the tragic case of the suicide in 2017 of the U.K. schoolgirl, Molly Russell. It was she who had pro-suicide content pushed into her social feeds by a number of apps, including Pinterest.

It has been shown that tracking and profiling are pervasive on ad-funded platforms; as a U.K. coroner concluded in the 2022 'Prevention of Future Deaths' report, it even contributed to the "negative effects of online content" of this young lady.

The complaint lodged by noyb against Pinterest with France's data protection authority has also accused the platform of failing to fulfill a GDPR data access request. It had failed to provide information on categories of data about the complainant that were passed to third parties.

Apart from requiring companies to have a proper legal reason for processing people's data, the GDPR gives people in the EU a suite of access rights, including the right to request a copy of their information.
'Secret tracking'

Pinterest is relying on a legal basis for processing people's data for ad targeting known as legitimate interest (LI). But noyb argues that it's not complying with the GDPR.

It cites a July 2023 ruling by the EU's supreme court, which blocked Facebook parent Meta from requiring LI* to allow it to impose its surveillance ads business on Europeans, and thus Pinterest is obliged to seek Europeans' consent before running its own 'personalized ads' business.

Presently, Pinterest tracks all of its regional 130 million users by default in order to "personalize" ads.

Any European user of Pinterest, who does not want to be tracked and profiled in such a way, has to take the active step of objection to its processing because, according to the GDPR, the users should be given the ability to object to processing when LI is the legal basis, whereas noyb believes users should be affirmatively asked whether they're okay with this usage of information.

Pinterest is secretly tracing European users without asking them for their consent," claimed Kleanthi Sardeli, data protection lawyer at noyb, in a statement regarding the complaint. "In this way, the social network profits from the private data of individuals without them knowing.".

"It appears that Pinterest is a company that deliberately disregards a ruling from the European Court of Justice in order to increase its profits. The CJEU specifically stated that targeted advertising can neither be founded on any legitimate interest either, Sardeli said.

Data access issue
noyb submitted its complaint against Pinterest on behalf of an anonymous user who it claimed had not realized that the platform was tracking her without consent.

What she discovered, however, is far more alarming. Only by clicking the "privacy and data" settings did she discover that "ads personalization" was enabled by default. She also learned the platform makes use of "visited websites" and other third parties' information to service display ads; it also tracks her on-site activities to have that potential. In short, Pinterest is in the surveillance ads business.

"This practice is clearly unlawful since the introduction of the GDPR in 2018," noyb said in a press release. "In its judgement in case C252/21 Bundeskartellamt in 2023, the Court of Justice of the European Union (CJEU) again held that personalized advertising may not be based on legitimate interest under Article 6(1)(f) GDPR."

The complainant also submitted a data access request to Pinterest. However, noyb complains that the copy of her data she received included no information on who the recipients of her data were.

Even after two further follow-up requests, Pinterest did not indicate what categories of data were passed to the third parties, it wrote, adding: "In other words: Pinterest failed to adequately respond to the access request under Article 15(1)(c) GDPR.

The complaint demands that Pinterest delete any data it has processed for ads and, in particular, inform users of the same. The company ought to honour the access request made by the complainant as well. As a consequence, noyb seeks that it be fined at a level that would serve as a deterrent against further such GDPR breaches.

Pinterest has been approached for comment on the complaint.

While this action has been lodged in France-where supervisory authority, CNIL, is known to take privacy protection issues, including those related to consent-there is a high likelihood it will be referred to the Data Protection Commission in Ireland since Pinterest's regional headquarters is in Dublin. (And because the GDPR's "one-stop shop" regime de-centralizes cross-border oversight of complaints).

However it told TechCrunch it has lodged the complaint against Pinterest's U.S.-based entity with one argument: The company's privacy policy describes Pinterest Europe and Pinterest, Inc (i.e. the US entity) as joint data controllers for the processing.
"The CNIL therefore is the competent authority and shouldn't forward the complaint to Ireland," it suggested. "But we of course don't know if they will do so anyway.".

* And Meta subsequently changed to a basis for tracking ads of consent. Albeit, that's a form of 'consent' whereby users are forced to select either an ad-free subscription over selling it or put up with the tracking ads free of charge for access to its service — that is itself now also subject to privacy, consumer protection, and competition complaints. But that's another story.