Facebook says it will change ToS in May for 1.5B users outside EU; US, Canada to be governed by US instead of Ireland ToS, limiting GDPR impact to 400M users
SAN FRANCISCO (Reuters) - If a new European law restricting what companies can do with people's online data went into effect tomorrow …
Context & Ripple Effects
Facebook spent March rebuilding its privacy controls ahead of GDPR's May 25 enforcement date, rolling out measures explicitly framed as a response to the EU law — though TechCrunch's review found the consent interface engineered to push users toward agreeing met the letter of the regulation more than its spirit. The May terms change completes that compliance arc by redrawing who the law applies to at all.
Rather than extend GDPR-grade protections globally, Facebook is moving US and Canadian users out of the Irish entity's terms and under US ones, cutting the population covered by GDPR from 1.9 billion to roughly 400 million Europeans. The playbook proved durable: two years later Facebook applied the same structure to shift UK users into California-governed agreements after Brexit.
First-order effects
- US and Canadian users lose the GDPR-backed rights embedded in the Ireland terms — data access, deletion, and portability guarantees — and fall back on whatever the US terms provide, while Facebook's Irish unit's regulatory exposure shrinks to its ~400M EU users.
Second-order effects
- Concentrating all EU users under the Irish entity makes Ireland's Data Protection Commission Facebook's single point of privacy enforcement in Europe — a concentration that escalated into the DPC's preliminary order barring trans-Atlantic data transfers, Facebook suing the watchdog, and a filing warning it may be forced to exit the EU market entirely.
Third-order effects
- If the pattern holds, user agreements become a jurisdictional firewall: platforms can neutralize any single region's privacy regime by re-papering contracts rather than changing practices, pushing regulators toward harmonized rules or extraterritorial enforcement to close the arbitrage.
The trend: Global platforms are increasingly structuring their terms of service as regulatory arbitrage, contracting users into whichever legal regime offers the least oversight.