Meta has received fines totalling EUR 390 million from the Irish Data Protection Commission for violations by Facebook and Instagram of the EU's General Data Protection Regulation. In a landmark decision on complaints filed back in 2018 when the GDPR took effect, the regulator said the company could not force users to accept processing of their personal data for ads to gain access to its social networking platforms. Meta has three months to rectify the situation, meaning it must seek another form of consent from users to process their data for personalised advertising. 

The case was started in May 2018 when the GDPR took effect in the EU, in four complaints coordinated by the data protection group NOYB (None of your business). As Meta's European business is based in Ireland, the Irish DPC took the lead on the case. However, the regulator struggled to reach a quick ruling, amid challenges from Meta and NOYB on the legal basis for its investigation as well as from other national privacy regulators in the EU. 

EDPB overrules DPC

The DPC acknowledged the differences of opinion, saying the fines were higher than its original proposal after input from other EU regulators. Ultimately the European Data Protection Board had to intervene, after the DPC was unable to reach agreement with the other national regulators in the mandatory consultation process on its draft decision. While there was a consensus that Meta violated its transparency obligations under the GDPR to inform users sufficiently about its processing of their personal data, ten of the 47 regulatory bodies consulted objected to the DPC's other draft conclusion, that Meta could rely on a contract with users for using their data to deliver personalised advertising. 

The dissenting regulators found that Meta could not force users of its platforms to accept the personalised advertising in order to use its other social media services, while the Irish regulator claimed the two services are inherently linked, and as such could fall under the contract permission allowed in the GDPR. In a decision issued in December 2022, the EDPB agreed with the dissenting regulators. As a "matter of principle", Meta may not rely on the contract it implemented prior to the GDPR taking effect as a lawful basis for its processing of personal data for the purpose of behavioural advertising, according to the binding decision.

The decision was welcomed by NOYB, which said the fines are around ten times higher than the amounts initially sought by the DPC. According to the group, the decision means that Meta must allow users to have a version of its apps that does not use personal data for ads within three months. Otherwise, it must seek direct yes/no consent from users to process their personal data for behavioural advertising and give them the freedom to withdraw that permission at any time, the same as other websites operate. 

More cases pending

NOYB noted that two other cases on a similar subject are already pending in EU court, which should put an end to any further appeals on the subject. The group was also informed that a decision on its other, similar complaint against WhatsApp in Germany will be announced later this month, with a fine also expected. 

Meta confirmed that it plans to appeal this decision, saying it "strongly believe[s] our approach respects GDPR". As personalised ads are an essential part of Facebook and Instagram, the user contract should be a sufficient legal basis for the processing of personal data, the company said in a statement. It was also quick to reassure advertisers that it would continue to offer personalised advertising - only the legal basis would change.

At the same time, the regulatory conflict created by the case remains, as the EDPB also ordered the DPC to conduct a fresh investigation that would span all of Facebook and Instagram’s data processing operations and would examine which categories of personal data may be processed. The DPC has questioned the EDPB's authority to issue such an order and said it will pursue the case in a complaint before the EU Court of Justice.