CFPB threatens Meta with lawsuit over finance-related ad data

The Consumer Financial Protection Bureau has threatened a lawsuit against Meta, the company that owns Facebook and Instagram, over the company’s alleged use of financial information to target advertisements at users.

Meta, which makes money primarily by selling advertisements against users’ attention, tracks consumers’ activity across the internet (regardless of whether they use Meta’s products) to build consumer profiles, which in turn it uses to ensure it can target ads more effectively. The CFPB believes this data includes financial information, according to an earnings report Meta filed Thursday.

The CFPB provided Meta with a Notice and Opportunity to Respond and Advise, or NORA, on Sept. 18, according to a note in the company’s quarterly earnings report. The CFPB issues this kind of notice before taking enforcement actions, such as filing a lawsuit against a company, to give the subjects of enforcement an opportunity to state their case.

CFPB staff advised the company that they “may recommend” the bureau take legal action “alleging violations of the Consumer Financial Protection Act,” which would be based on Meta receiving financial information from third parties then using that data for advertising, according to Meta’s disclosure.

“We disagree with the claims staff is considering and believe an enforcement action is unwarranted, and have responded through the NORA process,” the company said in its financial statement.

The company said it was unclear whether the NORA process will or will not lead to an enforcement action, but if the director of the CFPB authorizes an action, the agency “could file a lawsuit in the near-term” and seek financial penalties.

How Meta collects data on consumers

Meta helps advertisers build user profiles by providing tools advertisers can use to track consumers’ activity across the internet. This tracking can happen with the use of social engagement buttons (such as “Like” and “Share” buttons) placed on a web page the consumer visits as well as less visible tracking services also placed on web pages. These services enable Meta to more precisely target advertisements using the data advertisers collect.

Meta also tracks users’ activities on Facebook, Instagram and other platforms the company controls. The company said in December 2021 that it had introduced restrictions to limit the use of sensitive categories previously tracked by the company for ad targeting. These categories include political affiliation, religious beliefs, race and sexual orientation. Advertisers have responded by targeting users via proxy categories — such as interest in National Public Radio or Duck Dynasty.

Prior to that, in 2018, Facebook began phasing out the use of third-party data for ad targeting. Now, if an advertiser wants to target ads through Meta, they must either bring their own user profiles (first-party data) or use the ones provided by Facebook (second-party data), which the company claims are derived solely from activity on its platform (such as which ads a user has clicked).

These changes of policy have put the onus on advertisers to obtain permission from data brokers to use their consumer profiles for advertising purposes. Upon obtaining this permission, the data is considered first party, and Facebook allows the advertiser to use it for ad targeting.