The Irish DPC fines Meta €390M over GDPR breaches related to its ad and data handling practices, giving the company three months to comply; Meta plans to appeal
quickly — find a new legal basis for its sprawling targeted advertising empire. 🧵 https://pro.politico.eu/... @maxschrems : So, @noybeu (that the @DPCIreland calls “an [unspecified] Austrian complainant") won against @Meta. They must stop using personal data for advertisement under #GDPR. The @EU_EDPB overruled the @DPCIreland who desperately tries to push that they would have done something on https://twitter.com/... Adrian Weckler / @adrianweckler : Also: big, big disagreement between regulators here. From the story: https://twitter.com/... @noybeu : 🚨BREAKING: Following noyb litigation, @Meta (Facebook and Instagram) has been prohibited from using personal data for advertisement. The #GDPR decision signals a major blow to Meta's business model in Europe, as Meta faces a € 390 Mio fine. ➡https://noyb.eu/... @dpcireland : Data Protection Commission announces conclusion of two inquiries into Meta Ireland: https://dataprotection.ie/... https://twitter.com/... Andy Stone / @andymstone : Let's set the record straight. “...these decisions do not prevent personalized advertising on our platform. The decisions relate only to which legal basis Meta uses when offering certain advertising.” https://about.fb.com/... Ben Buchanan / @01core_ben : EU trying its hardest to chase tech talent and innovation out of the block. They're succeeding. https://twitter.com/... @tamaleaver : This is *huge*. If Meta are no longer able to hide ‘consent’ to use personal data for advertising in their Terms of Use in the EU, huge swathes of users could opt out, disrupting Meta's main business model. Meta's Ad Practices Ruled Illegal Under E.U. Law https://www.nytimes.com/... Carl Szabo / @carlszabo : Because of interest-based ads, small businesses enjoy not only historically low-cost ads, but also more effective ads. If this lifeline for small businesses disappears, EU citizens will be the victims. Alex Gibney / @alexgibneyfilm : this is a hugely important ruling: https://www.nytimes.com/... Abraham Newman / @anewman_forward : Thread: 1/ Meta handed mega fine in Europe for its privacy practices. Latest signal of GDPR's bite as well as how its enforcement process was underestimated. https://www.nytimes.com/... See also Mediagazer
PoliticoVincent Manancourt
Context & Ripple Effects
The €390M decision was subsequently characterized as an EDPB-directed intervention, placing Ireland’s lead privacy regulator under pressure to enforce a stricter reading of Meta’s advertising data practices. It is an early point in a broader run of EU challenges to Meta’s data operations, including a later €1.2B penalty over EU-US data transfers.
The regulatory issue extends beyond a single fine: the CJEU later upheld Germany’s authority to require an overhaul of Meta’s ad business, while Ireland’s DPC also delayed Meta’s planned use of public EU content for AI training.
First-order effects
Meta must find a compliant basis for the affected advertising data processing within three months while contesting the DPC’s decision and €390M penalty.
The Irish DPC and European Data Protection Board become the immediate arbiters of whether Meta’s existing behavioral-advertising model can continue under GDPR.
Meta’s advertising operations face overlapping privacy and competition constraints after the German cartel authority’s intervention was upheld, making a narrow Ireland-only remedy less viable.
Third-order effects
If this enforcement pattern holds, EU oversight will increasingly test Meta’s ability to reuse personal data across products and purposes, from ad targeting to AI training, rather than treating each service as a separate compliance question.
The structural shift is toward regulator-defined limits on platform data use, with appeals and alternative user-choice models becoming part of the operating model rather than one-off responses.
The trend: EU regulators are moving from penalizing discrete data practices toward reshaping the legal foundations of large platforms’ data-driven advertising and product development.
@NicholasVinocur @vmanancourt 3. The decisions do not mandate the use of Consent and any suggestion personalized ads can no longer be offered by Meta across Europe unless each user's agreement has first been sought is wrong.
A few things we want to be really clear about: 1. We're appealing both the substance of the rulings and the fines. 2. Nothing about these decisions prevent personalized advertising on our platform.
Breaking: In decisions just out, Meta is not only on the hook for privacy fines totaling nearly €400 million, but it must also — quickly — find a new legal basis for its sprawling targeted advertising empire. 🧵 https://pro.politico.eu/...
Thread: 1/ Meta handed mega fine in Europe for its privacy practices. Latest signal of GDPR's bite as well as how its enforcement process was underestimated. https://www.nytimes.com/...
So, @noybeu (that the @DPCIreland calls “an [unspecified] Austrian complainant") won against @Meta. They must stop using personal data for advertisement under #GDPR. The @EU_EDPB overruled the @DPCIreland who desperately tries to push that they would have done something on https:…
🚨BREAKING: Following noyb litigation, @Meta (Facebook and Instagram) has been prohibited from using personal data for advertisement. The #GDPR decision signals a major blow to Meta's business model in Europe, as Meta faces a € 390 Mio fine. ➡https://noyb.eu/...
Let's set the record straight. “...these decisions do not prevent personalized advertising on our platform. The decisions relate only to which legal basis Meta uses when offering certain advertising.” https://about.fb.com/...
Yowza: Meta's ad practices ruled illegal under E.U. law. “It could result in Meta allowing users to choose whether they want their data used for such targeted promotions.” Apple has shown us how that approach ends up! https://www.nytimes.com/...
..this really means is that the DPC and Meta control the media narrative of what the decision says or does not say as we can't read or publish it. We all know that the EDPB f*cked the DPC another time in this case and @NOYBeu won it, but by withholding the details of the case..
Taking the EDPB to court would be an unprecedented move by the Irish DPC. The enforcement mechanism of the GDPR is based on cooperation, which of course may involve disagreements, but this suggest a deeper fracture. https://twitter.com/...
In fact, I would call this decision against Facebook the second *nuclear strike on Facebook's core business model of surveillance capitalism. Yes, Apple's rollout of iOS 14.5 was the first strike. *I chose this term as adtech lobby used it a decade ago to thwart privacy changes.
In the DPC's words “it is not open to the EDPB to instruct and direct an authority to engage in open-ended and speculative investigation” 💣 “the direction is problematic in jurisdictional terms”; “the DPC is considering an action for annulment at the CJEU” 18/
The final Irish DPC decision in these two cases had to include the findings of the EDPB. Therefore, a breach of Art 6 was also found. Plus, the EDPB directed the DPC to start an investigation into the use of sensitive data across Facebook and Instagram. And here comes a bomb 17/
the implications of this landmark are massive & not just for @meta. it affirms - for the first time - that terms of service requiring users to allow their data to be used for ad targeting violates GDPR. https://twitter.com/...
Hmm. The decision does not mandate consent but it clearly prevents ‘contract’ as a legal basis for behavioural advertising. So practically that leaves ‘consent’ as the only viable option unless Meta believes ‘legitimate interests’ will fly (cough). 👀 https://twitter.com/...
Stone is spinning y'all. Yes, they'll appeal but 1) they went out on a limb where even Google wouldn't go so don't bet on a win, 2) EU's DMA and German cartel office also forcing this FB change, 3) consumers expect this. 2/3
This is *huge*. If Meta are no longer able to hide ‘consent’ to use personal data for advertising in their Terms of Use in the EU, huge swathes of users could opt out, disrupting Meta's main business model. Meta's Ad Practices Ruled Illegal Under E.U. Law https://www.nytimes.com/…
Fun fact: The same @DPCIreland that is publicly saying this decision it issued is wrong now also has to “defend” the decision when @Meta appeals it. I have the slight feeling we will have a major role in this case as @NOYBeu with a lot of costs -> https://noyb.eu/... https://twit…
Because of interest-based ads, small businesses enjoy not only historically low-cost ads, but also more effective ads. If this lifeline for small businesses disappears, EU citizens will be the victims.
A fight is underway! Very interesting paragraph at the bottom of the DPC press release The EDPB told the DPC to bring a new investigation into the processing of special category data across Meta The DPC considers this overreach and will appeal against the order at the CJEU https:…
They'll appeal the decision and then, when they inevitably lose again, will either come up with legitimate interest or some sort of fake consent to buy a few more years... I wonder what if max. GDPR fines were 20-30% of turnover (in the whole infringement period), rather than 4%.…
And sure Facebook may still be able to get permission to target on its own apps but 1) they may not be able to use any data derived from elsewhere, 2) they may need to delete everything retroactively, 3) regulator reports show FB gets most of its data from 3rd parties. Ouch. 3/3
Good thing she [Helen Dixon] got a legal degree (#not) and was involved in the GDPR negotiations to tell everyone else that she is right and the others all misunderstand the #GDPR. Not the first time this accusation flies from Dublin to Brussels... 😉
The war on personalized ads continues - at this rate, I'm not sure how any DTC small business can start up without any efficient ways to acquire first time customers https://twitter.com/...
The judgment puts 5 to 7 percent of Meta's overall advertising revenue at risk, said Dan Ives, an analyst at Wedbush Securities. “This could be a major gut punch,” he said. https://www.nytimes.com/...
“The EDPB does not have a general supervision role akin to national courts in respect of national independent authorities and it is not open to the EDPB to instruct and direct an authority to engage in open-ended and speculative investigation.” Pretty strong language here.
@NicholasVinocur @vmanancourt 4. There is a lack of regulatory certainty in this area and the debate around legal bases related to personalized ads has been ongoing for some time. 5. To wit: the DPC made quite clear its belief that “GDPR did not preclude Meta Ireland's reliance o…
Big decision effectively making a version of Apple's Ad Tracking Transparency system ("do you want to be tracked yes/no") a default requirement for Facebook/Meta on all platforms in Europe. Can't circumvent GDPR by putting a clause in the interminable T+Cs. https://twitter.com/..…
So @DPCireland is now accusing the @EU_EDPB of “rewriting the #GDPR” and for it being “pushed by privacy activists”. False and evil narrative, when the relevant EDPB Guidelines 1/2009 were decided “everyone against the DPC” without any knowledge or involvement of any “activist”. …
This is a very, very impactful decision: I interpret this as meaning that Meta must receive explicit consent from users to personalize ads using *first-party* data. This will fundamentally alter the company's operating model in the EU. https://www.nytimes.com/...