The disputes between the European Union and Meta continue to intensify. On Thursday, the European Data Protection Committee (CEPD) reaffirmed its binding and urgent ruling that bans Facebook and Instagram from tracking user activity on these platforms and from using that personal data for advertising purposes. The move underscores a broader clash over how user data should be collected, stored, and monetized across major digital services.
In December 2022, the continent’s leading privacy authority warned that the American tech giant lacked a sufficient legal basis to process users’ data for behavioral advertising, a practice that enables targeted ads based on individual characteristics and preferences. This assessment highlighted ongoing concerns about consent, transparency, and proportionality in how data is gathered and employed for advertising purposes across social networks.
The CEPD’s statement emphasizes that the social networks repeatedly violate the General Data Protection Regulation (GDPR), the EU’s central privacy law. It also notes disappointment with Meta’s continued noncompliance with authorities’ formal decisions, signaling a persistent governance gap between regulators and a major global platform on data practices.
The current decision follows a prior temporary three-month ban imposed on Meta in Norway, where the company’s leadership faced penalties for failing to adhere to the regulator’s directions. The Norwegian enforcement illustrates how regional authorities have exercised aggressive oversight to curb what they view as intrusive tracking and data processing without adequate legal basis.
Earlier in November, CEPD announced a prohibition on the illegal tracking methods used by Facebook and Instagram across the 27 EU member states and three additional countries within the European Economic Area (Norway, Iceland, and Liechtenstein). The ban is expected to affect roughly 250 million Meta users across the continent, a critical market for the company. The measure highlights the EU’s willingness to enforce privacy rules more rigorously and to scrutinize business models that rely on detailed profiling for advertising revenue [citation].
Experts note that the tension between privacy authorities and global tech platforms reflects a broader debate about digital sovereignty and the rights of individuals to control their personal information. The CEPD’s actions aim to push for clearer consent mechanisms, more transparent data processing notices, and stronger safeguards against the automatic collection of behavioral data across social networks. For users, this situation translates into heightened awareness of how their online activities are tracked and monetized, as well as potential shifts in the availability of personalized services within the EU and allied regions [citation].
From a policy perspective, the ongoing proceedings may influence how other regions approach similar issues, possibly spurring harmonized privacy standards that align with the GDPR while addressing the operational realities of global platforms. Regulators will likely continue to press for robust enforcement, transparent decision-making, and timely corrective actions when companies fail to meet established privacy requirements. The outcome could set precedents for cross-border data flows and accountability in digital advertising models, affecting developers, marketers, and everyday users alike [citation].
In summary, the CEPD’s renewed stance marks a decisive moment in EU privacy governance. It reinforces the expectation that major tech firms must obtain valid legal grounds for data processing, limit intrusive tracking practices, and comply with regulatory rulings. As the dialogue evolves, stakeholders on all sides will watch closely to see how Meta adjusts its data practices in line with GDPR safeguards and what this means for the broader ecosystem of social media regulation in North America and Europe [citation].