In January 2023, the EU hit Meta (formerly Facebook) with a hefty €390 million fine (€210 million for Facebook, €180 million for Instagram) for violating GDPR privacy rules.

The Irish Data Protection Commission (DPC) found Meta lacked transparency about how user data was used for targeted advertising.

Meta relied on an allegedly invalid legal basis ("performance of a contract") to process user data for personalized ads.

Meta must find a new, GDPR-compliant legal basis for targeted ads within 3 months. This sets a precedent for other companies in the EU.

Unsurprisingly, Meta disagrees with the DPC's findings and is appealing the decision.

Despite the appeal, Meta assures they're already working on solutions to comply with the ruling.

The EU Data Protection Board (EDPB) supported the DPC's decision, potentially issuing further guidance on targeted advertising.

This case has wider implications for other tech companies relying on personalized advertising in the EU.

The fine reignites the debate between protecting user privacy and enabling targeted advertising's commercial benefits.

Meta's appeal is ongoing, with the DPC and EDPB monitoring the situation. Stay tuned for future developments!