On October 22, 2024, none of your business (NOYB) announced that it had filed a complaint against Pinterest, Inc., on behalf of a complainant, with the French data protection authority (CNIL) alleging tracking users for personalized advertisements without consent in violation of the General Data Protection Regulation (GDPR). 

Background to the complaint

NOYB alleged that instead of seeking opt-in consent under Article 6(1)(a) of the GDPR, Pinterest claims to have a legitimate interest in processing people's personal data under Article 6(1)(f) of the GDPR. Tracking is turned on by default and would require an objection (opt-out) by each user to stop. Further, NOYB noted that according to these settings, Pinterest uses information from visited websites and from other third parties to show users personalized advertisements. In addition, Pinterest tracks on-site activity to improve the advertisements about Pinterest shown on other sites or apps. NOYB alleged that the same is unlawful under the GDPR.

Therefore, NOYB alleged that Pinterest violated Article 6(1) of the GDPR by processing the complainant's personal data for personalized advertising on the basis of legitimate interest. Additionally, Pinterest violated Article 15(1)(c) of the GDPR by failing to provide access to the categories of data that were shared with third parties. Through the complaint, NOYB requested CNIL to:

• order Pinterest to erase the data processed for personalized advertisements and that the recipients be informed of the erasure;
• order Pinterest to comply with the complainant's access request; and 
• impose an administrative fine to prevent similar violations in the future.

You can read the press release here and the complaint here.