Instagram — Enforcement
Executive Summary
The Irish DPC fined Meta €390 million (€210M for Facebook, €180M for Instagram) for relying on 'performance of a contract' as the legal basis for behavioral advertising, which the EDPB ruled was not a valid GDPR basis. Meta was ordered to bring processing into compliance within three months.
What Happened
On January 4, 2023, Ireland's Data Protection Commission fined Meta €390 million (€210 million for Facebook and €180 million for Instagram) for violating GDPR transparency requirements and for improperly using 'performance of a contract' as the legal basis for behavioral advertising. The decision followed complaints filed on May 25, 2018, when Meta changed its terms of service to rely on contract rather than consent as its legal basis for processing user data, requiring users to click 'I accept' to continue accessing the services. The European Data Protection Board issued binding decisions that Meta's contract-based approach was invalid and that the company failed to clearly outline its legal basis for data processing to users. Meta was ordered to bring its data processing operations in...
Who Is Affected
Users of Facebook and Instagram in the European Union are affected by this decision. The complainants argued that Meta was forcing users to consent to behavioral advertising by making service access conditional on accepting updated terms of service. According to privacy advocate Max Schrems, users will now need to be given a clear 'yes or no' option regarding whether their data can be used for ads, with the ability to change their choice at any time.
Why It Matters
This enforcement action was described by the Future of Privacy Forum as 'probably the most significant enforcement decision' since GDPR implementation, not primarily because of the fine amount but due to the required changes Meta must make to its services. The decision establishes that major platforms cannot bypass the need for explicit consent for behavioral advertising by claiming data processing is necessary to fulfill a contract with users. This creates a level playing field requiring Meta to obtain opt-in consent like other advertisers and represents a major challenge to Meta's business model in the EU, following four previous fines totaling over €900 million since 2021.
AI-Assisted
Event summaries are generated by Claude AI from verified sources and reviewed by humans before publication.
Sources