Blog


GDPR for Facebook Ads

IMPORTANT CHANGES TO FB’S TERMS: GDPR for Facebook Ads

In light of the Cambridge Analytica scandal and the new GDPR rules taking effect on May 25th, Facebook has reviewed it’s own Terms – which apply globally (not just EU).

If you’re an advertiser please take a moment to read some of the bigger points to note, which will impact the way you set up funnels and your own T&Cs.

“If you are an agency acting on behalf of an advertiser you are responsible for the data that is collected through Facebook or uploaded as custom audiences.”

WHAT IT MEANS FOR YOU: It’s your responsibility to ensure that you bind your client to the new Terms. Please include a clause inside your own Terms accordingly (I’ve got an example below but please get this reviewed by your lawyer).

“You (or partners acting on your behalf) may not place pixels associated with your Business Manager or ad account on websites that you do not own without our written permission”

WHAT IT MEANS FOR YOU: sharing pixels across Business Managers and even ad accounts in same BM is going to be a no-no

“If you have a pixel on your site, You must clearly warn and advise users that you are collecting information.”

WHAT IT MEANS FOR YOU: Every single landing page containing a pixel will need to CLEARLY link to an explanation that Facebook or any other third party may use cookies, web beacons and other storage technologies to collect or receive information (b) how users can opt out of the collection and use of information for ad targeting, and (c) where a user can access a mechanism for exercising such choice (e.g. providing links to: http://www.aboutads.info/choices and http://www.youronlinechoices.eu/).

For those of you advertising to the EU, you must ensure, in a verifiable manner, that an end user provides the necessary consent before you “pixel” them (For suggestions visit Facebook’s Cookie Consent Guide for Sites and Apps.)

“People who manage Pages with large numbers of followers will need to be verified. Those who manage large Pages that do not clear the process will no longer be able to post. This will make it much harder for people to administer a Page using a fake account”

WHAT IT MEANS FOR YOU: remember back in the day when you would create that second FB profile to manage ads and pages? Yea well going forward if you’re planning on running content for a page with large audience you or your team members will need to be verified

 

Example snippet to add into your own agency Terms of Service (please note this is in no way legal advice, please ensure you have your lawyers review your T&Cs fully to ensure full compliance.

“Facebook’s custom audiences feature enables you to create an audience using your data such as email addresses and phone numbers. When using Facebook’s custom audiences feature, your data is locally hashed on your system before you upload and pass such data to Facebook to be used to create your custom audience (the “Hashed Data”). Without limiting any agreement between you and Facebook, by clicking “I accept,” passing to Facebook the Hashed Data, or using custom audiences or advertising, you agree to the following:

* You represent and warrant, without limiting anything in these terms, that you have all necessary rights and permissions and a lawful basis to disclose and use the Hashed Data in compliance with all applicable laws, regulations, and industry guidelines. If you are using a Facebook identifier to create a custom audience, you must have obtained the identifier directly from the data subject in compliance with these terms.
* If you are providing Hashed Data, you agree to use only provide the agency with data that is owned by you as the advertiser and not to augment or supplement the data with other data except as expressly authorized by Facebook. You represent and warrant that you have the authority to use such data on their behalf and will bind the advertiser to these terms.
* You represent and warrant that the Hashed Data does not relate to data about any individual who has exercised an option that you have, directly or indirectly, committed to honoring or provided to opt out of having that data disclosed and used by you or on your behalf for targeted advertising. To the extent an individual exercises such an opt-out after you have used data relating to that individual to create a custom audience, you will remove that data subject from the custom audience.
* You instruct Facebook to use the Hashed Data for the matching process. Facebook will not share the Hashed Data with third parties or other advertisers and will delete the Hashed Data promptly after the match process is complete. Facebook will maintain the confidentiality and security of the Hashed Data and the collection of Facebook User IDs that comprise the custom audience(s) created from your Hashed Data (“your custom audience(s)”), including by maintaining technical and physical safeguards that are designed to (a) protect the security and integrity of data while it is within Facebook’s systems and (b) guard against the accidental or unauthorized access, use, alteration or disclosure of data within Facebook’s systems.
* Facebook will not give access to or information about the custom audience(s) to third parties or other advertisers, use your custom audience(s) to append to the information we have about our users or build interest-based profiles, or use your custom audience(s) except to provide services to you, unless we have your permission or are required to do so by law.
* Facebook may modify, suspend or terminate access to, or discontinue the availability of, the custom audiences feature at any time. You may discontinue your use of the custom audiences feature at any time. You may delete your custom audience(s) from the Facebook system at any time through your account tools.
* You may not sell or transfer custom audiences, or authorize any third party to sell or transfer custom audiences

* These Custom Audiences Terms and, to the extent applicable, the Data Processing Terms, govern the provision by you of Hashed Data to us and your use of the custom audiences feature, and your use of custom audiences for advertising. They do not replace any terms applicable to your purchase of advertising inventory from Facebook (including but not limited to the Facebook Advertising Guidelines athttps://www.facebook.com/ad_guidelines.php), and such terms will continue to apply to your ad campaigns targeted to your custom audience. The custom audiences feature is part of “Facebook” under Facebook’s Terms of Service (https://www.facebook.com/legal/terms, the “Terms”), and your use of the custom audiences feature (including your use of data) is deemed part of your use of, and actions on, “Facebook.” In the event of any express conflict between these Custom Audiences Terms and the Terms, these Custom Audiences Terms will govern solely with respect to your use of the custom audiences feature and solely to the extent of the conflict. Facebook reserves the right to monitor or audit your compliance with these terms and to update these terms from time to time.