Australian court dismissed Meta's claim that it neither conducts business nor collects personal information in the country in suit over Cambridge Analytica data
Full bench of the federal court confirms earlier ruling that tech giant collects personal information in Australia
Context & Ripple Effects
The information commissioner sued Facebook in March 2020 over the exposure of more than 300,000 Australians' data in the Cambridge Analytica scandal, and Meta's opening move was a jurisdictional one: argue it neither conducts business nor collects personal information in Australia. This full-bench federal court ruling kills that defense, confirming the earlier finding that Meta does collect personal information locally.
That matters because it converted what could have been a dead-end territorial dispute into a live merits case — the same case that ended two years later in Meta's AU$50M settlement with the privacy watchdog. It also foreshadowed Meta's later admission that it scraped every adult Australian Facebook user's public data for AI training, where the same question of what Australia's law covers resurfaced.
First-order effects
- Meta loses its jurisdictional escape hatch: the OAIC's Cambridge Analytica case proceeds against it in Australia on the substance of the alleged privacy breaches affecting 300,000+ users.
Second-order effects
- With the court affirming that serving Australian users means collecting their data under Australian law, Meta faces the settlement path it ultimately took in 2024 — and regulators elsewhere gain a template for pinning down global platforms that claim no local presence.
Third-order effects
- If the pattern holds, 'we don't operate here' stops working as a legal shield for ad-tech platforms: digital reach itself becomes the test of regulatory jurisdiction, pushing cross-border data practices toward compliance rather than denial.
The trend: Courts and regulators are dismantling the jurisdictional defenses of global platforms, treating user-facing data collection anywhere as grounds for local privacy enforcement.