Facebook and Instagram are to ask EU users for permission to show them personalised adverts, in a concession that challenges the platforms’ core money-making strategy.

The social media networks’ parent company, Meta, announced the change after a series of regulatory rulings struck down the company’s legal justification for harvesting audience data to create user profiles that can be targeted by advertisers.

Meta had argued it had a “legitimate interest” to process users’ data in such a way, but has now conceded that under EU data laws it must seek consent instead.

The company said in a blogpost: “We are announcing our intention to change the legal basis that we use to process certain data for behavioural advertising for people in the EU, EEA [European Economic Area] and Switzerland from ‘legitimate interests’ to ‘consent’.”

The UK data watchdog said on that Wednesday Meta’s announcement was “to the exclusion of the UK” and would be scrutinised by the regulator.

Stephen Almond, executive director of regulatory risk at the Information Commissioner’s Office, said: “As a digital regulator, we pay close attention to how companies operate internationally and how people’s rights are respected.”

“We’re aware of Meta’s plans to seek consent from users for behavioural advertising in the EU, to the exclusion of the UK … We are assessing what this means for information rights of people in the UK and considering an appropriate response.”

Meta’s advertising-based business model is already under pressure after Apple introduced a privacy change that requires app developers to seek user permission to track their online activity to provide them with personalised ads. Advertising accounted for 97% of Meta’s $117bn (£92bn) revenue last year.

Johnny Ryan, a senior fellow at the Irish Council for Civil Liberties and a campaigner for stronger protection of internet users’ data, said the move represented a substantial change to Meta’s business model. He said that he believes users will not consent to their data being used for targeted ads.

Ryan added: “If they do this in the way they are obliged to in law, no one will ever say yes to all of the things they are doing. You can say no to some of the toxic elements of Meta’s business and still enjoy the service.”

Meta’s announcement about asking for users’ consent comes after rulings by the Irish Data Protection Commission, which is Meta’s EU-wide regulator, as well as the EU court of justice and the Norwegian Data Protection Authority.