Facebook moving most users from protection of EU privacy law

Facebook is set to comply with strict new privacy rules in Europe next month, and CEO Mark Zuckerberg has said publicly that those protections will be available around the world.

That doesn’t appear to be the case.

Facebook has changed its terms of service, which means 1.5 billion of its more than 2 billion users will not be protected under the General Data Protection Regulation that’s scheduled to take effect May 25. While Facebook users outside the United States and Canada are currently protected by terms of service with the company’s international headquarters in Ireland, Facebook has confirmed it will change that.

Reuters, which first reported the change, notes that this means most of Facebook users won’t be able to file a complaint in Irish courts, but will instead be subject to less stringent U.S. privacy laws.

Last week during a hearing before the House Energy and Commerce Committee, U.S. Rep. Jerry McNerney, a California Democrat who represents parts of Contra Costa County, asked Zuckerberg when U.S. Facebook users would get GDPR protections.

“Congressman, we’re working on doing that as quickly as possible,” Zuckerberg replied.

Zuckerberg also said in response to a question from Rep. Gene Green, D-Texas: “We believe that everyone around the world deserves good privacy controls. We’ve had a lot of these controls in place for years. The GDPR requires us to do a few more things, and we’re going to extend that to the world.”

The GDPR, approved by European lawmakers in 2016, will require companies to ask customers for permission to use their data, delete customer data when asked, inform customers about breaches in a timely manner and more. The new law will also require data portability. Violating the new rules will result in fines, and other U.S. tech companies are making changes to prepare to comply with GDPR.

Facebook has not yet returned a request for comment about the changes to its terms of service, but it told Reuters: “We apply the same privacy protections everywhere, regardless of whether your agreement is with Facebook Inc or Facebook Ireland.” The company told Reuters it made the change “because EU law requires specific language.”