As Facebook CEO Mark Zuckerberg faced Senate and House committees in Washington, DC, this week, the platform introduced new terms around the use of customer data, tracking and measurement. Zuckerberg reiterated to lawmakers that Facebook will, in effect, apply the EU’s General Data Protection Regulation (GDPR) standards to its business globally. Not surprisingly, the Terms changes are timed to go into effect on May 25, 2018, the same date the GDPR’s sweeping set of rules governing the handling of consumer data will go into effect.
A new “Facebook Business Tools Terms” consolidates the “Conversion Tracking, Custom Audiences From Your Website, and Custom Audiences From Your Mobile App Terms” and “Offline Conversion Terms,” and the Custom Audience Terms have been updated. Here’s a rundown of the key changes to the terms that apply to any website owner, publisher, developer, advertiser, business partner (and their customers) and any other entity that integrates with, uses and exchanges information with Facebook. Note that Facebook Business Tools encompass a lot: APIs and SDKs, the Facebook Pixel, social plugins such as the Like and Share buttons, Facebook Login and Account Kit, as well as other platform integrations, plugins, code, specifications, documentation, technology and services.
New terms for GDPR compliance
In section 5.1 of the Facebook Business Tools Terms, a note to EU and Swiss data controllers specifically on GDPR states:
To the extent the Customer Data contain personal data which you process subject to the General Data Protection Regulation (Regulation (EU) 2016/679) (the “GDPR”), the parties acknowledge and agree that for purposes of providing matching, measurement, and analytics services described in Paragraphs 2.1 and 2.2 above, that you are the data controller in respect of such personal data, and you have instructed Facebook Ireland Limited to process such personal data on your behalf as your data processor pursuant to these terms and Facebook’s Data Processing Terms, which are incorporated herein by reference. “Personal data,” “data controller,” and “data processor” in this paragraph have the meanings set out in the Data Processing Terms.
What this means: This section clarifies that the Facebook Marketers are considered data controllers from a GDPR standpoint and Facebook the data processor. A third-party data processor is an entity that processes personally identifiable information (PII) on behalf of a controller. A controller is defined by the GDPR as an entity that determines how that data will be processed and for what reason. Both controllers and processors must comply with the EU regulation.
The Terms for using Facebook Pixels and SDKs have also been updated for GDPR. Section 3.3 states:
In jurisdictions that require informed consent for the storing and accessing of cookies or other information on an end user’s device (such as but not limited to the European Union), you must ensure, in a verifiable manner, that an end user provides the necessary consent before you use Facebook Business Tools to enable us to store and access cookies or other information on the end user’s device. (For suggestions on implementing consent mechanisms, visit Facebook’s Cookie Consent Guide for Sites and Apps.)
What this means: Site and app owners must obtain and manage user consent for Facebook to access, gather and store their data. This is a critical piece of GDPR that pertains to any company controlling or processing data on EU citizens, regardless of where they reside.
Requirement to notify Facebook of any actual or ‘threatened’ complaints about personal data
Another important change in the terms that marketers need to be aware of is in section 1.5. The provision states:
You will notify us promptly in writing of any actual or threatened complaint or challenge related to the use of personal data under these Business Tools Terms and will cooperate with us in responding to such complaint or challenge.
What this means: Advertisers must take any user’s complaint (even threatened) about the use of personal data seriously. You must be prepared to report to Facebook, in writing, any suggestion of a complaint or challenge over the handling or use of personal data when you’re made aware of it.
Keep reporting internal
Want to share a case study about your Facebook ad campaign? Think again. Section 2.2.2 of the Facebook Business Tools Terms explicitly states that advertisers are not allowed to share Campaign Reports or Analytics unless they have Facebook’s written consent:
We grant to you a non-exclusive and non-transferable license to use the Campaign Reports and Analytics for your internal business purposes only and solely on an aggregated and anonymous basis for measurement purposes. You will not disclose the Campaign Reports or Analytics, or any portion thereof, to any third party, unless otherwise agreed to in writing by us. We will not disclose the Campaign Reports or Analytics, or any portion thereof, to any third party without your permission, unless (i) they have been combined with Campaigns Reports and Analytics from numerous other third parties and (ii) your identifying information is removed from the combined Campaign Reports and Analytics.
What this means: All Campaign Reports and Analytics need to stay internal and include only anonymized, aggregated data. Keep screen shots and charts out of presentations, case studies and social media unless you have permission from Facebook. However, Facebook retains the right to use your unidentified reporting data when aggregated with that of other advertisers
No pixel sharing
This is a change. Section 3.1 of the Facebook Business Tools Terms states:
You (or partners acting on your behalf) may not place pixels associated with your business manager or ad account on websites that you do not own without our written permission
What this means: You may not gather data for ad targeting or measurement by placing your or your clients’ pixels on other sites you may have access to or any other site unless Facebook OKs it. This has been a not-so-secret Facebook marketing tactic for some time. If you currently have pixels on other sites, it’s time to revisit those placements and either get Facebook’s permission or remove them to stay in compliance with the Terms.
Facebook Business Tools Terms
Some of the terminology has also changed with this update. As of May 25, 2018:
“Sales Data” now is called “Customer Data.”
“User Information” now means “Contact Information.”
“Sales Transaction Data” now is “Event Data.”
“Matched Data” now means Event Data that is combined with Matched User IDs.
“Unmatched Data” now means Event Data that is not combined with Matched User IDs.
“Reports” is now “Campaign Reports.”
“OC” is now referred to as “Offline Conversions.”
Those are the main takeaways that we pulled from the updated terms. There are other changes, but they don’t appear to impact the day-to-day of marketers as much as the above. If you have any other items that stood out, please let us know on social media.
Important note: I am not a lawyer. This article is meant to uncover various changes from the perspective of a marketer. Please take the time to read through the updated product terms for yourself.
Comments