Facebook, Google face strict EU privacy rules that could hit ad revenues

Online messaging services such as WhatsApp, Skype, and Gmail face a crackdown on a "void of protection" that allows them to routinely track the data of EU citizens without regulatory scrutiny—and it could be bad news for ad sales.

On Tuesday, officials in Brussels proposed new measures to curb Silicon Valley players who—up until now—have been largely immune from the ePrivacy Directive, which  requires telecoms operators to adhere to the rules on the confidentiality of communications and the protection of personal data.

As part of its planned overhaul, the European Commission, the executive wing of the European Union, said that it planned to beef up the measures by switching from a directive to a "directly applicable regulation" to ensure that the bloc's 500 million citizens "enjoy the same level of protection for their electronic communications." It claimed that businesses would also benefit from "one single set of rules."

Over-The-Top services such as Facebook's WhatsApp and Google's Gmail can all but ignore the EU's existing rules. The commission said that this needed to change:

Important technological and economic developments took place in the market since the last revision of the ePrivacy Directive in 2009. Consumers and businesses increasingly rely on new Internet-based services enabling inter-personal communications such as Voice over IP, instant messaging, and Web-based e-mail services, instead of traditional communications services...

Accordingly, the Directive has not kept pace with technological developments, resulting in a void of protection of communications conveyed through new services.

The EC is also planning to kill the heavily ridiculed cookies consent pop-up system. It said, in an embarrassing—if long overdue—climbdown that users would be given more control to allow or prevent websites from tracking them depending on "privacy risks."

Last summer, a big coalition of tech firms lobbied for the cookie law to be scrapped.

Under the new proposal, the commission said: "no consent is needed for non-privacy intrusive cookies improving Internet experience (e.g. to remember shopping cart history). Cookies set by a visited website counting the number of visitors to that website will no longer require consent."

But it could also hit the bottom line of Facebook, Google, and chums because tracking consent may be harder to obtain if lots of users reject third party cookies. The commission said that, following public consultation on the issue, 81.2 percent of citizens agreed that obligations should be imposed on "manufacturers of terminal equipment to market products with privacy-by-default settings activated."

It also warned that "additional costs" could hit some Web browser makers because they would be required to develop software with privacy settings built in.

The new proposals also call on consent to process electronic communications metadata, such as device location data to allow for the "purposes of granting and maintaining access and connection to the service," the commission said. It means that telcos "will have more opportunities to use data and provide additional services." Translation: new ways to make more cash.

Companies that flout confidentiality of communications rules face fines of up to four percent of their global annual turnover, under the commission's planned e-privacy measures—the same penalty that will be dished out to firms that violate the EU's General Data Protection Regulation, which comes into action in April 2018.

"The European data protection legislation adopted last year sets high standards for the benefit of both EU citizens and companies," said EC justice chief Věra Jourová. "Today we are also setting out our strategy to facilitate international data exchanges in the global digital economy and promote high data protection standards worldwide."

But the latest proposals cannot become law until the bloc's 28 member states and the European Parliament agree to wave them through—leaving plenty of wiggle room for industry lobbying.

Separately, the commission is seeking views from the public on how to best tackle data mining as part of its Digital Single Market strategy.