>Consent is presumed not to be freely given [...] if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.

Yes, indeed. That just leaves the matter to specifying the exact nature of the contract. So the service being provisioned can be “access to the tools to connect with one’s friends and such tools have personalized ads built into them”. Does my approach misinterpret things? I don’t think anything is specified about what kinds of contracts can or cannot be offered. And in a reasonably free market, it cannot. And of course, it should not - hardly any of the biggest internet companies could make money without ads.

Now if FB or Google, or another company were to be regulated as a utility company, then yes, the nature of their contracts can also be regulated.

They could go a step further, and simply ban “all personalized ads” - I’m not sure how feasible that is, but that would give the EU the right to regulate the kinds of ads shown by FB and ergo, the kind of data collected. But personalized ads is a immensely vague term that could even catch tv and radio ads (targeting based on demographics, and time of day the show is being broadcast, etc.) in the dragnet.

From my understanding that's part of the point of those complaints: a) force Facebook to clearly use that argument if they want to rely on it (GDPR requires them to be explicit about base of processing, and right now they're not) and b) regulators and eventually courts to figure out where those lines are, and get Facebook to adjust accordingly. It's certainly possible that they find that advertising-financed offerings can justify some processing by the need to make money, but that needs to be determined. E.g. I could imagine that they'll be blocked from using protected categories of data that way without explicit opt-in, but will be allowed some matching on others.

To be a bit glib, if Ads are a core part of the offering, surely the facebook.com front page should mention them?

Ah, that’s a good idea. The EU could/should mandate specifying very clearly what precisely the service is.

Of course, like another commenter mentioned about face recognition and image processing, that is hardly relevant to most kinds of advertizing.

The question is one of legal basis and also of specifying explicitly what is being done with the data.

That leads to the next question - how will things be verified? Will an entity get to audit FB algorithms in toto to sign off that they’re secretly processing facial recognition data?…that’ll be the real challenge.