Norway is doubling down in its long-running fight against Meta over users’ data. The country’s privacy watchdog, Datatilsynet, says it is already investigating the company’s new ad-free subscription model, less than a week after the service was launched across Europe.

Meta started rolling out its new model last week, giving Facebook and Instagram users who live in the European Union, Norway, Iceland, Lichtenstein, and Switzerland the option to opt out of seeing ads in exchange for €9.99 ($10.50) a month. Meta has said that subscribers’ personal information will not be used for ads on Facebook and Instagram. But Line Coll, director of Norway’s data protection regulator, argues the new model is not a win for privacy. Subscribers might not see ads anymore, she adds. “But Meta will still track you, they will still collect the data. From a data protection perspective, that blows my mind.”

When asked whether she expects the subscription to form a basis for a new Norwegian case against Meta, Coll said: “Yes. We’re looking into it, and we have to know more about the solution, the technical sides of it, and we have to understand it better.”

“We will still collect, store, and use data for the purposes of providing users the personalized organic experiences they value from Facebook and Instagram, such as recommended posts [and] friends recommendations,” says Meta spokesperson Matt Pollard. “However, if users subscribe for no ads, their information will not be used for ads.” Pollard adds he was not aware of the Norwegian investigation. “[We] are surprised to find about such a matter via the press.”

Under Coll, the data protection regulator in Norway, which is not an EU member, has become a new thorn in Meta’s side. After three decades spent working as a privacy lawyer, Coll joined the watchdog in August 2022. She never expected to get the job. When she was approached six months earlier and asked to apply for the position, she thought: “Sure, why not? It’s never going to be me.”

But in her first year in charge, she has turned the regulator into an outspoken critic of Meta’s business model and the way the company’s platforms track users online. She believes that people are losing their ability to think freely or form their own opinions due to the way platforms like Meta’s work. “You are only seeing commercials or newsfeeds which they think interest you, so you don’t really get the big picture,” she says, speaking from her office in Oslo. “There’s so much discrimination in so many of these algorithms. They will cement your opinions. They will just provide you with more and more of what you already think.”

Pollard, Meta spokesperson, denies this—pointing to independent research that claims there is little evidence Meta’s platforms alone cause “meaningful effects on” political views and behavior.

In the past, European privacy regulators have played safe, Coll adds. “Now it’s time to do something else.” She wants the Norwegian regulator to give companies clear guidance about what they can and can’t do under European privacy law. “That takes courage from our side because then you’re actually guiding the market,” the 51-year-old says. “The process that I’ve started is about sticking our head out, being more courageous, being bolder and taking a stand.”

This new, bolder approach was illustrated in August, when Coll’s team ruled that the way Meta carried out behavioral advertising in Norway was illegal, and started fining the company $100,000 per day until it changed its business model. The fine, which remains unpaid, currently stands at over $7 million. (Pollard says Meta is in touch with the relevant agency about payment.)

Coll says she had long discussions with her team about whether they should take on the case. There were concerns about reputational risk if the regulator lost, spending all its resources in the process, just to strengthen Meta’s position, she says.

But instead, Coll won—in a way. The fines were upheld by a Norwegian court, where her team confronted an array of Meta’s lawyers in August. “They were there with three Norwegian lawyers, three US lawyers, and I also think they had lawyers online from Ireland,” she says. “It was a show of legal muscle.” By comparison, Coll was able to send only three people from her team of 62.

Meta might not have paid the fine, and Coll still doesn’t believe they’ve complied with the Norwegian order—although Pollard says Meta has complied by introducing optional ad-free subscriptions in Norway. But in October, Coll received more good news. The data regulator for the European Union, the European Data Protection Board, decided to extend Norway’s ban on Meta’s behavioral advertising to all 30 countries within the EU and European Economic Area. The EDPB decision was a “win for privacy and data protection,” Coll says, adding that it sends a clear message to Meta and to other tech companies that Europe does not accept business models that rely on European individuals’ data.

Coll says that she doesn’t believe Meta launched its ad-free subscription model in response to her agency’s ruling on behavioral ads, but that it did so because of the EU’s Digital Markets Act, which comes into force in 2024. That’s what European authorities were told, she says. Article Five in the Digital Markets Act, an EU law designed to make the technology industry more competitive, states that Meta needs consent to combine users’ personal data over different platforms. “This is probably the real incentive for them to do this,” Coll says. “This would have happened regardless of us taking on our Meta case or not.”

Coll says her team won’t take on any other social media platforms and will instead continue to focus its limited resources on Meta. She believes their success this year is making people pay attention to privacy, beyond expert circles. “We’re blowing their cover,” she says. “Because they’ve done this silently for years. They’ve collected our data and profiled us for years.”