Facebook consent page. Photo courtesy of noyb.eu

SAN FRANCISCO — Just after the European Union's General Data Protection Regulation took effect Friday, Austrian privacy lawyer and activist Max Schrems filed a spate of complaints against Facebook and Google alleging they're willfully violating the law and should be fined billions of euros.

The four similar complaints were filed with data privacy regulators in separate EU countries on behalf of users in those jurisdictions. The complaints target the privacy policies of Facebook, WhatsApp, Instagram and Google's Android, and allege that users are being forced to give consent to their data being collected in violation of the GDPR.

“Facebook has even blocked accounts of users who have not given consent. In the end users only had the choice to delete the account or hit the 'agree' button,” Schrems said in a statement. He said that was not a “free choice” but more akin to “a North Korean election process.”

The complaints specifically target a practice known as “bundling,” under which users are asked to give consent for their data to be used in a range of ways in order to continue to use the service. This method, the complaints allege, renders user consent invalid, “as such consent would not be in any way 'specific,' but rather based on an 'all or nothing' approach.”

With the GDPR carrying a maximum penalty of 4 percent of a company's global revenue, Schrems calculated Google could be on the hook for 3.7 billion euros, and Facebook for 3.9 billion euros — 1.3 billion euros each for Facebook, WhatsApp, and Instagram.

In the statement, he called the complaints a “crucial test” of whether the GDPR's new penalties will really have any “teeth.”

Max Schrems. Photo: Lukas Beck

Schrems has long been a thorn in the side of Facebook and U.S. tech companies. While still a law student, he filed a complaint against the social media giant that ultimately led to the U.S.-EU “Safe Harbor” framework for data transfers being struck down by the EU's top court. Another related case he filed is still pending.

The GDPR complaints were put together by a new nonprofit organization Schrems create, called “None of Your Business,” or NOYB.

In response to the complaints, Facebook chief privacy officer Erin Egan said the company had “prepared for the past 18 months to ensure we meet the requirements of the GDPR.” She added that the company had made Facebook's policies clearer, its privacy settings easier to find, and made it easier for users to access, download and delete their data.

Google offered a similar statement. “We build privacy and security into our products from the very earliest stages and are committed to complying with the EU General Data Protection Regulation,” it said. “Over the last 18 months, we have taken steps to update our products, policies and processes to provide users with meaningful data transparency and control across all the services that we provide in the EU.”

The complaints are now in the hands of the data protection authorities in France, Belgium, Germany and Austria. In a statement, NOYB said that the Irish data regulator would also likely get involved, given that Facebook's EU headquarters are in Ireland.