Meta, the parent company of Facebook and Instagram, is facing a significant legal challenge and a damages claim in Spain. The Association of Newspaper Owners (AMI), which includes prominent publishers like El País, ABC, and La Vanguardia, is leading the lawsuit. They are seeking compensation of over €550 million (approximately $600 million) for what they describe as Meta’s “systematic and massive non-compliance” with the European Union’s General Data Protection Regulation (GDPR).
Key Takeaway
Meta is facing a €550 million damages claim in Spain as media owners allege a breach of privacy and competition laws due to its non-compliance with the GDPR. This lawsuit adds to Meta’s ongoing legal challenges and could have significant implications for its data processing practices.
Background and Allegations
The lawsuit argues that Meta failed to have a valid legal basis for processing people’s data for targeted advertising, which constitutes a breach of EU data protection rules. The litigants claim that Meta’s consistent failure to comply with data protection legislation allowed the company to gain an unfair competitive advantage. They assert that 100% of Meta’s regional revenue was unlawfully obtained via the misuse of personal data without user consent.
In January, Meta received a fine of €390 million from EU data protection authorities for tracking and profiling users without a valid legal basis. This confirmed that Meta was in breach of the GDPR and opened the door for private privacy litigations, such as the one initiated by AMI.
The Lawsuit and Possible Extension
AMI’s lawsuit specifically targets Meta’s ad processing activities from May 2018, when the GDPR came into force, until the end of July 2021. However, the complainants do not rule out the possibility of extending the timeframe to account for Meta’s ongoing non-compliance.
Since the January penalty, Meta has changed its claimed legal basis for ads processing twice. Initially, it relied on legitimate interests, but the Court of Justice of the European Union (CJEU) invalidated that basis in July 2022 amid a separate competition and privacy challenge brought by Germany’s competition authority.
The AMI’s challenge also references an October 27 decision by the European Data Protection Board, which highlighted Meta’s continued processing of personal data without a valid legal basis. This decision may support the extension of the timeframe of the lawsuit.
Meta’s Latest Attempt and Additional Challenges
In November, Meta switched to claiming consent as the legal basis for its tracking-ads business in the EU. However, the company’s approach demands that users either pay a monthly subscription for an ad-free version or agree to be tracked and profiled. This choice raises concerns since the GDPR requires consent to be “freely given” to be legally valid.
Privacy and consumer rights groups are challenging Meta’s latest approach to consent, arguing that it is unfair and illegal. Notably, the use of a “cookie paywall” on some European newspaper websites follows a similar model, where users must pay for access or consent to being tracked.
The AMI lawsuit brings additional legal pressure on Meta, which already faces fresh EU privacy fines exceeding $410 million at the beginning of the year. The CJEU ruling on Meta’s referral could have significant implications for the future of surveillance capitalism.
