When you watch a video on Instagram, the app’s algorithms are additionally watching you. As you scroll, they’re hoovering up info to determine what makes you tick—not solely to point out you content material that retains you coming again, but additionally to point out you adverts which are extra prone to make you purchase one thing.

Meta calls the knowledge it compiles about how customers behave throughout its apps “activity.” That exercise may embody what they are saying in social media posts or feedback, the contents of the (unencrypted) messages they ship or obtain, the hashtags they use, and the way lengthy they spend watching sure sorts of posts or movies.

When compiled, this info can reveal extremely private info, doubtlessly starting from a person’s musical tastes to their menstrual cycles. “These data are rather potent in the sense that they will tell you everything about a person’s online behavior and therefore also their interests, their personality,” says Tobias Judin, spokesperson for Norway’s privateness watchdog, Datatilsynet. When that details about how a consumer behaves on-line is used to tell what sort of adverts that individual sees, it turns into what’s often known as behavioral promoting. “Literally everything that you do on these platforms can be recorded and used for behavioral advertising purposes,” he says.

For years, European courts have argued that Meta can’t use any such information for promoting except the corporate asks for customers’ express—sure or no—consent. But in July, Norway went a step additional, branding the best way Meta carries out behavioral promoting as illegal. The watchdog threatened to ban Meta’s behavioral adverts in Norway and pledged to fantastic the tech big $100,000 per day except the corporate modified its methods. The ban was on account of take impact on August 4; three days earlier than that, on August 1, Meta quietly revealed an replace to a January weblog submit saying its intention to conform.

“Today, we are announcing our intention to change the legal basis that we use to process certain data for behavioral advertising for people in the EU, EEA and Switzerland from ‘Legitimate Interests’ to ‘Consent,’” the weblog submit read, with out saying particularly when the change will happen or mentioning Norway. Meta declined WIRED’s request to remark additional.

Norway is chalking this up as a victory. “While Meta states that this is a voluntary change on their end, that appears very unconvincing,” says Judin. “Asking users for consent could negatively affect the company’s earnings, and historically speaking, Meta has not been willing to sacrifice profits for privacy unless forced.” Meta stated the broader Europe area generated nearly 1 / 4 of its promoting income within the three months main as much as June 30.

Norway’s menace was a daring transfer. “We normally don’t ban processing activities like this,” Judin says. But the regulator has develop into a brand new thorn in Meta’s aspect. Last yr, the watchdog got here below new management, with privateness lawyer Line Coll taking the helm as director. Speaking to the Norwegian enterprise journal Kapital in May, she prompt she was desirous about new methods to make use of sanctions to higher shield privateness. So far, she has delivered.