Facebook — Enforcement
Executive Summary
The Irish DPC fined Meta €390 million (€210M for Facebook, €180M for Instagram) for relying on 'performance of a contract' as the legal basis for behavioral advertising, which the EDPB ruled was not a valid GDPR basis. Meta was ordered to bring processing into compliance within three months.
What Happened
On January 4, 2023, the Irish Data Protection Commission fined Meta Ireland a total of €390 million (€210 million for Facebook and €180 million for Instagram) for violations of the GDPR. The DPC found that Meta could not rely on the 'performance of a contract' legal basis to justify processing users' personal data for behavioral advertising, as it had claimed in its Terms of Service since May 25, 2018. Meta was ordered to bring its data processing operations into compliance within three months. The decisions followed complaints filed by an Austrian data subject (regarding Facebook) and a Belgian data subject (regarding Instagram) on the day the GDPR took effect, and reflected binding decisions by the European Data Protection Board.
Who Is Affected
Users of Facebook and Instagram in the European Union are affected by this decision. The ruling stems from complaints by Austrian and Belgian data subjects but applies broadly to Meta's operations in the EU. These users had been required to accept Meta's Terms of Service to continue using the platforms, with Meta claiming this acceptance constituted a contract that allowed it to process their data for behavioral advertising and personalized services.
Why It Matters
This enforcement action invalidates Meta's primary legal justification for collecting user data for personalized advertising across the EU, potentially requiring a fundamental change to how the company obtains permission for such data processing. The decision has been characterized as one of the most significant GDPR enforcement actions since the regulation took effect, not primarily because of the fine amount but because of the operational changes Meta must implement. According to the privacy group that filed the complaints, the ruling means users will need to be given a clear 'yes or no' option to consent to having their data used for advertising, which they can change at any time, creating a level playing field with other advertisers who must obtain opt-in consent.
AI-Assisted
Event summaries are generated by Claude AI from verified sources and reviewed by humans before publication.
Sources