> very vague and general language about how consent can be gathered
The language Art. 7 (https://gdpr-info.eu/art-7-gdpr/) may not be clear enough, but check out the recitals.
Unless you're actively trying to skirt the edge (in which case you shouldn't act surprised if you find yourself on the wrong side of it), it's pretty clear.
However, I think this article is slightly missing the point, as is your conclusion. (https://noyb.eu/en/noyb-win-personalized-ads-facebook-instag... explains this a bit better.)
Facebook wasn't trying to get consent through the fine print (that would be very obviously illegal). https://edpb.europa.eu/news/news/2022/edpb-adopts-art-65-dis... says that the decision "settles ... the question of whether or not the processing of personal data for the performance of a contract is a suitable legal basis for behavioural advertising".
Under GDPR, you need to have a valid legal basis for any data processing. This can be a) consent (which Facebook was not getting, nor claiming to get), b) doing only what's necessary for the performance of a contract, (some other things), and f) legitimate interests.
Consent is the easiest: When you get it (properly), as you said, you can basically use data in any way. But getting consent properly means actually getting consent, not tricking, annoying or forcing the user into saying yes when they don't want to. Ad platforms tend to either try to claim consent without actually getting it in a valid way (because, surprise, most people don't want this), or they reach for the other justifications.
While the advertising industry is trying to push to justify legitimate interest, anyone who has read the official EU interpretations (e.g. https://edpb.europa.eu/sites/default/files/consultation/edpb... - page 16 point 50, referencing Page 47 in https://web.archive.org/web/20220305192156/https://ec.europa...) would plainly see that you cannot use that to justify the kind of tracking that these ad networks do.
I suspect Facebook has realized this because otherwise they would have claimed Legitimate Interest. Instead, they claimed that processing the personal data is "necessary for the performance of a contract". That is obvious bullshit, and the EDPB has now explicitly confirmed this.
So I would recap it differently:
- A law was put in place 5 years ago to protect people from exactly the kind of behavior Facebook wanted to engage in (intrusive tracking, wholesale collection of personal data).
- Facebook has made a massive profit by violating the law, claiming to be merely skirting it, relying on creative interpretations that they must have known were "creative".
- They have now been told that their creative interpretations are wrong and that they need to actually follow the law. (They will likely also have to pay a fine that is a fraction of the profit they made from violating the law.)
- They can still do the thing they want, they'll just need to actually get voluntary user consent. Which they probably will not get in many ways, in particular because they're known for abusing the users and illegally misusing their data (see above).
I agree that it's inefficient that they were allowed to do this for 5 years before being told to stop, but I don't think that's unfair to Facebook, to Facebook's detriment, or because Facebook couldn't have known. It's because Facebook correctly concluded that they will get away with, and profit from, violating the law until caught and stopped.