Meta Fined €1.2 Billion Over Unlawful EU–US Facebook Data Transfers

Meta received a €1.2 billion GDPR fine over unlawful transfers of European Facebook users’ personal data to the United States, following roughly a decade of litigation initiated by privacy activist Max Schrems. The enforcement decision required transfers to stop and, according to noyb, affected data to be returned to EU data centers. The dispute concerns conflicts between EU privacy protections and US surveillance powers, particularly FISA Section 702. The CJEU invalidated Safe Harbor and subsequently Privacy Shield, while retaining Standard Contractual Clauses (SCCs) subject to assessments of whether recipients can actually provide adequate protection. Schrems expected Meta to appeal and argued that a replacement transfer agreement would not erase past violations; noyb also highlighted potential damages claims and collective litigation.

The proceedings involved repeated challenges to Ireland’s Data Protection Commission (DPC), including Facebook’s judicial review of its investigation and Schrems’s separate challenge to delays and the suspension of his original complaint. A settlement secured commitments to advance that complaint and permit his participation in a parallel inquiry. Facebook defended SCC-based transfers, citing encryption, security controls and policies for government requests, while noyb disputed whether its transfer impact assessment addressed US surveillance risks. For organizations using overseas providers, the case underscores the importance of documenting transfer mechanisms, assessing recipients and subcontractors, and verifying whether safeguards meaningfully limit government access. EU hosting alone does not necessarily remove that exposure, and narrow GDPR Article 49 exceptions should not be treated as blanket authorization for routine outsourced processing.