DECISION SUMMARY
What happened
On 4 January 2023 the Irish Data Protection Commission (DPC) announced the conclusion of two inquiries into Meta Platforms Ireland Limited, one concerning Facebook and one concerning Instagram. The DPC imposed administrative fines of €210 million in the Facebook inquiry and €180 million in the Instagram inquiry, €390 million in total, and ordered Meta to bring its processing operations into compliance with the GDPR within three months.
The inquiries began with complaints made on 25 May 2018, the day the GDPR became applicable. The complainants argued that Meta had changed its terms of service so that, by accepting them, users were treated as entering a contract that included personalised advertising, and that Meta was therefore processing personal data for behavioural advertising on the 'performance of a contract' legal basis in Article 6(1)(b) rather than obtaining consent. The central legal question was whether behavioural advertising is genuinely necessary to perform the service contract a user enters when they use Facebook or Instagram.
The legal question: contract or consent
Article 6(1) GDPR sets out six possible lawful bases for processing personal data. Two are relevant here. Article 6(1)(b) permits processing that is 'necessary for the performance of a contract' with the data subject. Article 6(1)(a) permits processing based on the data subject's 'consent'. The two are very different in practice: contract needs no separate opt-in and cannot be withdrawn while the contract subsists, whereas consent must be freely given, specific, informed and unambiguous, and can be withdrawn at any time. Basing behavioural advertising on contract rather than consent removes the user's ability to say no while continuing to use the service.
The 'necessity' test in Article 6(1)(b) is objective. Processing is only necessary for a contract if the contract cannot be performed without it, not merely because the controller has written it into its terms. The complainants' position was that a person can use a social network without being profiled for advertising, so behavioural advertising is not necessary to deliver the service and contract cannot be the lawful basis for it.
How the EDPB changed the outcome
This decision is unusual because the DPC's own draft decision took Meta's side on the central point. The DPC initially accepted that Meta could rely on contract as the lawful basis for personalised advertising, and proposed to fine Meta only for failing to be transparent about the basis it was using. Ten of the other European supervisory authorities lodged objections, arguing that behavioural advertising is not a core element of the service and that users should be able to use social media without their data being processed for personalised ads.
Because consensus could not be reached, the matter went to the European Data Protection Board, which resolved the dispute through binding decisions under Article 65 GDPR on 5 December 2022. The EDPB directed the DPC to find that Meta was not entitled to rely on the contract legal basis for behavioural advertising, and to reflect that in a materially higher fine. The DPC's final decisions, adopted on 31 December 2022 and announced on 4 January 2023, gave effect to the EDPB's binding direction. This is why the register records the decision as a DPC fine even though the lawful-basis finding and the fine level were set by the EDPB rather than by the lead authority.
The transparency findings
Alongside the legal-basis finding, the decisions held that Meta had breached its transparency obligations. Information about the legal basis Meta relied on for processing was not clearly conveyed to users, infringing Article 5(1)(a) (lawfulness, fairness and transparency), Article 12 (transparent information) and Article 13(1)(c) (the duty to tell data subjects the legal basis for the processing). The transparency breaches were the part of the case the DPC had been willing to sanction from the outset; the lawful-basis breach was added at the EDPB's direction.
Aftermath: the move to consent
Meta said it disagreed strongly with the decision and would appeal the substance, and it brought a challenge in the Irish courts. In parallel it changed how it processes data for ads. Meta first announced that it would move the legal basis for behavioural advertising in the EU, EEA and Switzerland from contract to 'legitimate interests'. That did not settle the question: on 27 October 2023 the EDPB adopted an urgent binding decision imposing a ban on processing personal data for behavioural advertising on the basis of contract or legitimate interests across the whole EEA.
Meta then moved to a consent-based approach, launching in November 2023 a subscription model under which EEA users of Facebook and Instagram either consent to personalised advertising or pay a monthly fee for an ad-free version, the 'consent or pay' model. The design of that model has drawn continuing scrutiny from regulators over whether the consent it collects is genuinely freely given, but the January 2023 decision is the ruling that closed off contract as a lawful basis and set the sector on this path.
Why the case matters
The decision established, at EEA level, that a platform cannot make behavioural advertising a term of its service contract and then treat the resulting data processing as 'necessary' under Article 6(1)(b). The reasoning reaches well beyond Meta: any controller that relies on contract necessity for advertising, profiling or other processing that is not strictly required to deliver the service the user asked for is exposed to the same analysis. It also demonstrated the reach of the EDPB's Article 65 dispute-resolution mechanism, which here reversed the lead authority's conclusion and raised the penalty. For comparison on this register, the decision sits alongside Meta's €1.2 billion transfer fine (a different Chapter V question), the €265 million data-scraping fine (Article 25), and the earlier Amazon €746 million CNPD decision, which reached the same structural conclusion about advertising and consent more than a year before it became settled EDPB doctrine.