Meta recently conceded that in-app behavioral advertising in the EU can no longer be opt-in by default, marking the end of an era. The regulators won, at least for now.
Aren't "opt-in" and "opt-out" used with the opposite of the normal meaning here? Normally "opt-in" means that you're not part of it by default, you have to make an active choice to be included. And "opt-out" means that you're included unless you specifically choose not to be. Example of backwards use in the text: "Prior to ATT, every app by default had access to your advertising ID, i.e. it was opt-in by default. This meant you could easily be tracked across apps, and therefore shown effective behavioral ads."
"it’s unclear if there are any regulatory constraints that force them to not bundle consent for user experience personalization and behavioral advertising."
The GDPR does already take this into account. It's the "specific" part of the four requirements for consent to be valid. In other words to comply, you would have to ask for specific consent on all separate uses of personal data. Of course in practice no one does this, so you're kind of right that it's unclear.
Occasionally: surprised by an ad to something I have recently talked about
Frequently: Laugh at ads that appear to have mis-read my sex, income group, politics and more
Aren't "opt-in" and "opt-out" used with the opposite of the normal meaning here? Normally "opt-in" means that you're not part of it by default, you have to make an active choice to be included. And "opt-out" means that you're included unless you specifically choose not to be. Example of backwards use in the text: "Prior to ATT, every app by default had access to your advertising ID, i.e. it was opt-in by default. This meant you could easily be tracked across apps, and therefore shown effective behavioral ads."
"it’s unclear if there are any regulatory constraints that force them to not bundle consent for user experience personalization and behavioral advertising."
The GDPR does already take this into account. It's the "specific" part of the four requirements for consent to be valid. In other words to comply, you would have to ask for specific consent on all separate uses of personal data. Of course in practice no one does this, so you're kind of right that it's unclear.