Facebook Messenger now asks users to check their privacy settings before May 25

Chip Somodevilla/Getty

Facebook CEO Mark Zuckerberg.

• Facebook Messenger has started showing a pop-up notification asking users to check their privacy settings.
• The note asks people to check their settings by May 25, when a strict new European privacy regulation comes into effect.
• The General Data Protection Regulation is designed to bring Facebook, Google, and the way they gather huge amounts of user data to heel.
• Facebook still hasn't clearly explained how it will meet all of the GDPR's requirements.

Facebook has started showing pop-up notifications in Messenger asking people to look at their privacy settings, around one month before a strict new European privacy law bites.

Business Insider spotted the pop-up late on Wednesday, just as Facebook CEO Mark Zuckerberg was being grilled by US House representatives about the company's mishandling of user data.

The notification appeared when we opened Messenger on mobile, and it took over the full screen. It simply reads: "Important Updates to Review. [Please] review your data settings by 25 May to continue using Messenger."

Shona Ghosh/Business Insider

Facebook Messenger has started prompting users to check their settings.

Clicking on the "Review Now" prompt is designed to take you to your settings for Facebook Messenger on mobile - but this didn't work when we tried it. That suggests Facebook might still be in testing mode ahead of a full rollout.

The note says users need to check their settings by May 25, which is when Europe's new General Data Protection Regulation (GDPR) rolls out.

GDPR is designed to bring tech giants like Google and Facebook, which scoop up huge amounts of user data for advertising, to heel. The new law will cover any users whose data is processed by Facebook's Irish office, including outside the EU. It's designed to give users much more control over how much data they hand over to the tech giants, and what that data is used for.

Companies that don't obey the new regulation can be fined up to 4% of annual turnover, with each EU state's data watchdogs expected to have more powers to fine firms which are lax on privacy.

One important concept in the GDPR is explicit consent. In Facebook's case, that means the firm has to ask you whether you are happy to share data about your political views, racial or ethnic origin, biometric data, health, or sexual orientation. According to Fox Rothschilds lawyer Mark McCreary, it can't just be a small checkbox either, but something "disruptive" to the entire Facebook experience.

It looks like the Messenger pop-up might be Facebook's idea of explicit consent, but the company is going to have to do much more by May 25. It also looks like the note places the burden on the user, where the individual has to go through their privacy settings and opt out of sharing data.

Facebook says it's still preparing for GDPR

A Facebook source said the company is preparing for GDPR with the biggest cross-functional team in Facebook's history, comprising senior executives across product, design, user experience, policy, legal and Facebook, Instagram, and WhatsApp.

The source pointed to the firm's easier to use privacy shortcuts menu and the ability for users to download their data. The company will also clarify its privacy policies in the near future, explaining why it uses data to customise posts, ads, and page and friend suggestions, how it decides which ads to show, and when it shares information with others.

But it still isn't clear how and whether Facebook will let users see and control data that they don't even know they're giving up. For example, Facebook uses cookies to track you even after you've logged out - will it start handing over everything it's learned? And one individual, Paul Olivier-Dehaye, recently described to MPs his efforts in getting Facebook to hand over all the data the firm had collected through two ad tools - Custom Audiences and Pixel. The company argued it required "disproportionate effort" to locate that information.

Come May 25, it isn't clear that will be a defence.