Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The policy states that Meta uses inferred sensitive attributes including religious views, political views, and health information in its advertising systems, describing the use as exclusionary rather than directly targeting on those bases, though the policy acknowledges these attributes inform ad delivery.
This analysis describes what Meta's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision discloses that sensitive personal data categories are processed within Meta's advertising infrastructure. The distinction between 'exclusionary' and 'targeting' use of special category data may require evaluation under GDPR Article 9, which restricts processing of such data regardless of the direction of its application in ad delivery.
Interpretive note: The policy's distinction between 'exclusionary' and 'direct targeting' use of sensitive attributes is operationally ambiguous and the GDPR Article 9 compliance implications of this distinction depend on regulatory interpretation and enforcement posture.
The updated Privacy Policy no longer explicitly directs US residents to the United States Regional Privacy Notice, which previously provided details about consumer privacy rights available under state laws like the California Consumer Privacy Act and similar regulations. This removal does not eliminate those rights themselves, but it makes the Privacy Policy less clear about where consumers can find information on how to exercise those rights. Consumers can still locate the Regional Privacy Notice through Meta's website or by searching for it directly, but the removal reduces the accessibility and prominence of that guidance within the primary policy document.
View change record →This clause establishes that Meta's systems process inferred information about a user's religious views, political views, and health as part of ad delivery, even if the stated purpose is to avoid showing certain sensitive ads rather than to serve them.
How other platforms handle this
If you choose to reveal any personal information about yourself to other users, you do so at your own risk. We strongly encourage you to use caution in disclosing any personal information online.
When you are asked to provide information, you may decline to do so; but if you choose not to provide information that is necessary to provide some of our Services, you may not be able to use those Services.
to object to profiling activities based on our own legitimate interests
Monitoring
Meta has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"We use information about you including your religious views, political views, or health to provide you with ads. We don't use special category information to target ads directly based on these topics, but we do use this information to make sure we don't show you ads that might be sensitive given this information.Excerpt from Meta's Privacy Policy
(1) REGULATORY LANDSCAPE: GDPR Article 9 prohibits processing of special categories of personal data (including data revealing political opinions, religious beliefs, and health data) without explicit consent or another enumerated exception. The Irish DPC and other EU supervisory authorities have issued guidance and enforcement actions concerning the processing of special category data in advertising contexts. The policy's framing of this processing as 'exclusionary' does not eliminate the Article 9 analysis, as processing of special category data occurs regardless of the operational direction. (2) GOVERNANCE EXPOSURE: High. The use of health, religious, and political inferences within advertising systems is among the most regulated data processing activities under GDPR and is subject to heightened scrutiny. The policy's assertion that this does not constitute 'direct targeting' on these bases may not fully resolve the Article 9 compliance question. (3) JURISDICTION FLAGS: EU and EEA users have the greatest exposure given GDPR Article 9 restrictions. The UK GDPR imposes equivalent requirements. US users have fewer statutory protections for sensitive inference data outside of California, though the FTC has increasingly scrutinized sensitive data practices. (4) CONTRACT AND VENDOR IMPLICATIONS: Advertisers using Meta's platform should be aware that their campaign delivery may be informed by sensitive attribute inferences about their audience, which may create obligations under their own privacy disclosures to end users. (5) COMPLIANCE CONSIDERATIONS: DPOs operating in EU jurisdictions should assess whether the legal basis for sensitive attribute processing within Meta's ad systems is adequate under GDPR Article 9, and whether any separate consent mechanism or legitimate interest assessment has been published by Meta in relation to this specific processing activity. California compliance teams should evaluate whether sensitive personal information opt-out rights under CPRA apply to this inference and use practice.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision discloses that sensitive personal data categories are processed within Meta's advertising infrastructure. The distinction between 'exclusionary' and 'targeting' use of special category data may require evaluation under GDPR Article 9, which restricts processing of such data regardless of the direction of its application in ad delivery.
This clause establishes that Meta's systems process inferred information about a user's religious views, political views, and health as part of ad delivery, even if the stated purpose is to avoid showing certain sensitive ads rather than to serve them.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Meta.