A panel of judges says Facebook broke federal privacy law by failing to adequately inform users of the risks to their data upon signing up to the popular social media platform.

The Federal Court of Appeal found that Facebook, now known as Meta, did not obtain the meaningful consent required by the Personal Information Protection and Electronic Documents Act between 2013 and 2015.

It also said Facebook breached its safeguarding obligations under PIPEDA, which governs the private sector含羞草研究社檚 use of personal information, during the relevant period by failing to adequately monitor and enforce the privacy practices of third-party apps.

In the decision, which overturns a 2023 Federal Court ruling, the Court of Appeal said Facebook 含羞草研究社渋nvited millions of apps onto its platform and did not adequately supervise them.含羞草研究社�

It found that the Federal Court含羞草研究社檚 failure to engage with the relevant evidence on this point was an error of law.

In a statement, privacy commissioner Philippe Dufresne called the latest decision an acknowledgment that international firms whose business models rely on users含羞草研究社� data must respect Canadian privacy law.

含羞草研究社淔acebook operates the world含羞草研究社檚 largest social media network and collects a vast amount of personal information and data about its users,含羞草研究社� Dufresne said. 含羞草研究社淭he issues at the heart of this matter are critically important to Canadians and their ability to participate with trust in our digital society.含羞草研究社�

He noted the Court of Appeal has asked his office and Facebook to report back within 90 days on whether an agreement on the terms of a remedial order has been reached. 含羞草研究社淚 expect Facebook to now bring forward proposals on how it will ensure that it complies with the court含羞草研究社檚 decision.含羞草研究社�

In a brief statement, Meta expressed disappointment with the ruling. The company did not indicate whether it plans to appeal to the Supreme Court of Canada.

A 2019 investigation report from Daniel Therrien, federal privacy commissioner at the time, and his British Columbia counterpart cited major shortcomings in Facebook含羞草研究社檚 procedures and called for stronger laws to protect Canadians.

The probe followed reports that Facebook let an outside organization use a digital app to access users含羞草研究社� personal information, with that data then passed to others.

The app, at one point known as 含羞草研究社淭his is Your Digital Life,含羞草研究社� encouraged users to complete a personality quiz but collected much more information about the people who installed the app as well as data about their Facebook friends.

Recipients of the information included British consulting firm Cambridge Analytica, which was involved in U.S. political campaigns and targeted messaging.

About 300,000 Facebook users worldwide added the app, leading to the potential disclosure of the personal information of approximately 87 million others, including more than 600,000 Canadians, the commissioners含羞草研究社� report said.

The commissioners concluded that Facebook violated PIPEDA by failing to obtain valid and meaningful consent of installing users and their friends, and that it had 含羞草研究社渋nadequate safeguards含羞草研究社� to protect user information.

Facebook disputed the findings of the investigation. The company has said it tried to work with the privacy commissioner含羞草研究社檚 office and take measures that would go above and beyond what other companies do.

In early 2020, Therrien asked the Federal Court to declare Facebook had violated the law.

A judge ruled last year the commissioner failed to meet the burden of establishing that Facebook breached the law concerning meaningful consent. He also agreed with Facebook含羞草研究社檚 argument that once a user authorizes it to disclose information to an app, the social media company含羞草研究社檚 safeguarding duties under PIPEDA come to an end.

In its decision, the Court of Appeal noted Facebook含羞草研究社檚 contention that users read privacy policies presented to them on signing up to social networking websites, something the judges called 含羞草研究社渁 dubious assumption含羞草研究社� given such documents can run thousands of words.

含羞草研究社淭erms that are on their face superficially clear do not necessarily translate into meaningful consent,含羞草研究社� Justice Donald Rennie wrote for the three-member panel. 含羞草研究社淎pparent clarity can be lost or obscured in the length and miasma of the document and the complexity of its terms.含羞草研究社�

In this case, Rennie said, a central question was whether a reasonable person 含羞草研究社渨ould have understood that in downloading a personality quiz (or any app), they were consenting to the risk that the app would scrape their data and the data of their friends, to be used in a manner contrary to Facebook含羞草研究社檚 own internal rules (i.e. sold to a corporation to develop metrics to target advertising in advance of the 2016 U.S. election).含羞草研究社�