Elon Musk’s haphazard steering of Twitter has kept the EU’s top privacy regulator very, very busy.

An investigation is underway by the Irish Data Protection Commission (DPC) in response to a revelation by Platformer that Musk is proposing to require customers to accept tailored advertising unless they pay for a subscription service that would feature an opt-out for adverts.

This is just the latest in a growing pile of data protection concerns — let’s call these the real ‘Twitter Files’— including Musk giving access to Twitter systems to non-staff reporters (um, security and privacy anyone?), the location of Twitter’s main establishment (Ireland, and thus the streamlined situation it currently enjoys with the DPC leading oversight of its compliance with the EU’s General Data Protection Regulation, also known as the GDPR), and whether or not Twitter is a

In order to legally handle personal data, such monitoring and profiling users for ad targeting, Twitter must have a legitimate business reason to do so, under the General Data Protection Regulation.

Although consent is a legal basis that may be used in accordance with the GDPR, it cannot be coerced from users; rather, it must be voluntarily supplied. Forcing consumers to pay to avoid being watched and targeted is therefore unlikely to pass muster with EU authorities.

Although consent is a legal basis that may be used in accordance with the GDPR, it cannot be coerced from users; rather, it must be voluntarily supplied. Forcing consumers to pay to avoid being watched and targeted is therefore unlikely to pass muster with EU authorities.

Contractual need is another ground for processing personal data that the GDPR recognises. It’s also important to note that Meta, the company that owns Facebook, is using this argument to justify the “tailored” advertisements it shows Facebook users.

But the European Data Protection Board recently issued a decision on a long running complaint against Meta’s controversial choice of legal basis, which, according to press reports, appears to rule out using a claim of performance of a contract to run behaviorally targeted ads, dealing a blow to Musk’s ambitions to follow Zuck in forcing microtargeted ads into Europeans’ eyeballs whether they like it or not.

Another legal ground recognised by the GDPR is “legitimate interest” (LI). But again, it’s bad news for Musk on this front: TikTok abandoned its summertime plan to convert the legal basis for its tailored adverts from permission to LI after receiving concerns from Italy’s DPA that the move would be illegal.

As TikTok’s primary supervisor for GDPR, the DPC has also intervened to ‘engage’ with the company on the issue. However, if Twitter takes a similar approach to GDPR and tries to impose tracking advertisements on European users, it is likely to face further legal hurdles beyond those already encountered by Facebook. And as Italy’s DPA informed TikTok a few months ago, you can’t undertake monitoring without requesting authorization, per the EU’s ePrivacy Directive, which covers internet tracking. Consequently, LI won’t work for Twitter ad monitoring.

Contractual need is another ground for processing personal data that the GDPR recognises. It’s also important to note that Meta, the company that owns Facebook, is using this argument to justify the “tailored” advertisements it shows Facebook users.

But the European Data Protection Board recently issued a decision on a long running complaint against Meta’s controversial choice of legal basis, which, according to press reports, appears to rule out using a claim of performance of a contract to run behaviorally targeted ads, dealing a blow to Musk’s ambitions to follow Zuck in forcing microtargeted ads into Europeans’ eyeballs whether they like it or not.

Another legal ground recognised by the GDPR is “legitimate interest” (LI). But again, it’s bad news for Musk on this front: TikTok abandoned its summertime plan to convert the legal basis for its tailored adverts from permission to LI after receiving concerns from Italy’s DPA that the move would be illegal.

As TikTok’s primary supervisor for GDPR, the DPC has also intervened to ‘engage’ with the company on the issue. However, if Twitter takes a similar approach to GDPR and tries to impose tracking advertisements on European users, it is likely to face further legal hurdles beyond those already encountered by Facebook. And as Italy’s DPA informed TikTok a few months ago, you can’t undertake monitoring without requesting authorization, per the EU’s ePrivacy Directive, which covers internet tracking. Consequently, LI won’t work for Twitter ad monitoring.

Is Musk risking any repercussions if he goes forward with his plan to impose advertisements on consumers in Europe?

Fines for violating the General Data Protection Regulation (GDPR) can reach up to 4 percent of a company’s worldwide revenue (though Twitter has escaped major sanction to date). Yet GDPR fines levied against digital firms have been steadily rising in recent years (even if the bill may take years to arrive). As a general rule, the penalties for repeated or egregious security lapses are more severe than those for isolated events.

Costs may swiftly add up in this area as well if numerous watchdogs wade in, as ePrivacy permits EU authorities to levy dissuasive penalty for violations, which may, demonstrably, surpass one hundred million dollars per (i.e. from a single regulator).

A single point of contact for international complaints does not hold down the process of enforcing ePrivacy laws (as happens with the GDPR). If Musk continues with forced tracking despite the lack of a legal avenue for such processing, he may face sanctions in a timely manner.

Both privacy rules allow EU authorities to issue cease-and-desist orders against illegal activities. And ignoring such directives will result in — you guessed it — further punishment. Therefore, Musk faces a lifetime of expensive regulatory agony in Europe if he does not change direction.

More difficulty with the local regulators is on the horizon for him as well.