[andyferris]

I mean it doesn't matter if its transferred or not, it's the purpose the data is used for.

One concept I've seen floated is separating the advertising markets from the user-facing services. As in DOJ/antitrust legal seperation of Google, Facebook, etc into smaller entities.

In that world Facebook-the-social-network-I-use company would need to send data Facebook-the-advertising-market company for each page load to request some ads to display. What data would be in that request? My reading of EU law is that such data couldn't be personally identifying or of a private nature (so, like, 99.9% of what I do on facebook...). Features like time of day and language of user would be fine and appropriate - the sort of data used by TV networks to choose which ad to display on their broadcast.

It doesn't matter if you seperate the Facebook company this way, my understanding of EU privacy law is that they still can't use your private data to augment the advertising part of the business when you were there to use the social network part of the business. (Note: the social network still provides user aggregation and has value to FB without any ad personalization).