Mark Zuckerberg, chief executive officer of Meta Platforms Inc., left, arrives at federal court in San Jose, California, US, on Tuesday, Dec. 20, 2022.
David Paul Morris | Bloomberg | Getty Images
Facebook parent company Meta on Wednesday was slapped with a pair of fines totaling more than $400 million as the Irish privacy regulator concluded the company’s advertising and data handling practices were in breach of EU privacy laws.
The Irish Data Protection Commission said that Meta should be ordered to pay two fines — one, a 210 million euro ($222.5 million) fine over violations of the European Union’s General Data Protection Regulation, or GDPR, and the second, a 180 million euro fine related to breaches of the same law by Instagram.
Combined, the penalties amount to 390 million euros ($414 million).
The fines mark the conclusion of two lengthy investigations into Meta by the Irish regulator, which had been criticized over delays in the process. The DPC began investigating the company on May 25, 2018, the day the EU’s GDPR came into effect.
GDPR places strict requirements on firms with regard to the processing of people’s information. Firms that run afoul of the rules risk facing penalties as high as 4% of global annual revenues.
In the ruling Wednesday, the DPC said that Meta must bring its data processing operations into compliance within three months. The watchdog is the lead regulatory authority for Meta and several other U.S. tech giants, which hold their headquarters in Ireland.
Meta, which changed its name from Facebook in 2021, said in a statement Wednesday that it planned to appeal the ruling. The decision does not amount to a ban on personalized advertising and businesses can continue using Meta’s platforms to target users with ads, it added.
“The suggestion that personalised ads can no longer be offered by Meta across Europe unless each user’s agreement has first been sought is incorrect,” a Meta spokesperson told CNBC via email.
“There has been a lack of regulatory clarity on this issue, and the debate among regulators and policymakers around which legal basis is most appropriate in a given situation has been ongoing for some time,” the spokesperson added.
“That’s why we strongly disagree with the DPC’s final decision, and believe we fully comply with GDPR by relying on Contractual Necessity for behavioural ads given the nature of our services. As a result, we will appeal the substance of the decision.”
A ‘huge blow’ to Meta’s EU profits
Previously, Meta relied on a user’s consent to process their information for the purposes of behavioral ads. However, after the entry into force of the GDPR, the company changed the terms of service for Facebook and Instagram, and switched the legal basis upon which it processes that information to something called “contractual necessity.”
That same year, Max Schrems, an Austrian privacy activist, submitted a complaint alleging this change forced users to accept the processing of their information for ad targeting in exchange for use of the platforms.
Schrems, in a statement Wednesday, said the DPC’s decision Wednesday meant that Meta would have to develop a version of its apps that doesn’t use personal data for advertising within three months.
He added Meta would still be allowed to ask users for consent to ads with a “yes/no” option, however.
“This is a huge blow to Meta’s profits in the EU,” Schrems said. “People now need to be asked if they want their data to be used for ads or not. They must have a ‘yes or no’ option and can change their mind at any time. The decision also ensures a level playing field with other advertisers that also need to get opt-in consent.”
In December, the European Data Protection Board, which coordinates regulatory action on data privacy across the bloc, said that Meta wasn’t entitled to rely on contracts as a legal basis for processing user data for targeted ads, effectively deeming the company’s advertising practices illegal.
Subsequent to that move, the DPC said it found Meta was “not entitled to rely on the ‘contract’ legal basis in connection with the delivery of behavioural advertising as part of its Facebook and Instagram services, and that its processing of users’ data to date, in purported reliance on the ‘contract’ legal basis, amounts to a contravention of Article 6 of the GDPR.”
The fines imposed by the DPC were raised substantially from those proposed in a draft decision in October, in which the regulator suggested a levy of between 28 million and 36 million euros.
Paxton sued Google in 2022 for allegedly unlawfully tracking and collecting the private data of users.
The attorney general said the settlement, which covers allegations in two separate lawsuits against the search engine and app giant, dwarfed all past settlements by other states with Google for similar data privacy violations.
Google’s settlement comes nearly 10 months after Paxton obtained a $1.4 billion settlement for Texas from Meta, the parent company of Facebook and Instagram, to resolve claims of unauthorized use of biometric data by users of those popular social media platforms.
“In Texas, Big Tech is not above the law,” Paxton said in a statement on Friday.
“For years, Google secretly tracked people’s movements, private searches, and even their voiceprints and facial geometry through their products and services. I fought back and won,” said Paxton.
“This $1.375 billion settlement is a major win for Texans’ privacy and tells companies that they will pay for abusing our trust.”
Google spokesman Jose Castaneda said the company did not admit any wrongdoing or liability in the settlement, which involves allegations related to the Chrome browser’s incognito setting, disclosures related to location history on the Google Maps app, and biometric claims related to Google Photo.
Castaneda said Google does not have to make any changes to products in connection with the settlement and that all of the policy changes that the company made in connection with the allegations were previously announced or implemented.
“This settles a raft of old claims, many of which have already been resolved elsewhere, concerning product policies we have long since changed,” Castaneda said.
“We are pleased to put them behind us, and we will continue to build robust privacy controls into our services.”
Virtual care company Omada Health filed for an IPO on Friday, the latest digital health company that’s signaled its intent to hit the public markets despite a turbulent economy.
Founded in 2012, Omada offers virtual care programs to support patients with chronic conditions like prediabetes, diabetes and hypertension. The company describes its approach as a “between-visit care model” that is complementary to the broader health-care ecosystem, according to its prospectus.
Revenue increased 57% in the first quarter to $55 million, up from $35.1 million during the same period last year, the filing said. The San Francisco-based company generated $169.8 million in revenue during 2024, up 38% from $122.8 million the previous year.
Omada’s net loss narrowed to $9.4 million during its first quarter from $19 million during the same period last year. It reported a net loss of $47.1 million in 2024, compared to a $67.5 million net loss during 2023.
The IPO market has been largely dormant across the tech sector for the past three years, and within digital health, it’s been almost completely dead. After President Donald Trump announced a sweeping tariff policy that plunged U.S. markets into turmoil last month, taking a company public is an even riskier endeavor. Online lender Klarna delayed its long-anticipated IPO, as did ticket marketplace StubHub.
But Omada Health isn’t the first digital health company to file for its public market debut this year. Virtual physical therapy startup Hinge Health filed its prospectus in March, and provided an update with its first-quarter earnings on Monday, a signal to investors that it’s looking to forge ahead.
Omada contracts with employers, and the company said it works with more than 2,000 customers and supports 679,000 members as of March 31. More than 156 million Americans suffer from at least one chronic condition, so there is a significant market opportunity, according to the company’s filing.
In 2022, Omada announced a $192 million funding round that pushed its valuation above $1 billion. U.S. Venture Partners, Andreessen Horowitz and Fidelity’s FMR LLC are the largest outside shareholders in the company, each owning between 9% and 10% of the stock.
“To our prospective shareholders, thank you for learning more about Omada. I invite you join our journey,” Omada co-founder and CEO Sean Duffy said in the filing. “In front of us is a unique chance to build a promising and successful business while truly changing lives.”
Liz Reid, vice president, search, Google speaks during an event in New Delhi on December 19, 2022.
Sajjad Hussain | AFP | Getty Images
Testimony in Google‘s antitrust search remedies trial that wrapped hearings Friday shows how the company is calculating possible changes proposed by the Department of Justice.
Google head of search Liz Reid testified in court Tuesday that the company would need to divert between 1,000 and 2,000 employees, roughly 20% of Google’s search organization, to carry out some of the proposed remedies, a source with knowledge of the proceedings confirmed.
The testimony comes during the final days of the remedies trial, which will determine what penalties should be taken against Google after a judge last year ruled the company has held an illegal monopoly in its core market of internet search.
The DOJ, which filed the original antitrust suit and proposed remedies, asked the judge to force Google to share its data used for generating search results, such as click data. It also asked for the company to remove the use of “compelled syndication,” which refers to the practice of making certain deals with companies to ensure its search engine remains the default choice in browsers and smartphones.
Read more CNBC tech news
Google pays Apple billions of dollars per year to be the default search engine on iPhones. It’s lucrative for Apple and a valuable way for Google to get more search volume and users.
Apple’s SVP of Services Eddy Cue testified Wednesday that Apple chooses to feature Google because it’s “the best search engine.”
The DOJ also proposed the company divest its Chrome browser but that was not included in Reid’s initial calculation, the source confirmed.
Reid on Tuesday said Google’s proprietary “Knowledge Graph” database, which it uses to surface search results, contains more than 500 billion facts, according to the source, and that Google has invested more than $20 billion in engineering costs and content acquisition over more than a decade.
“People ask Google questions they wouldn’t ask anyone else,” she said, according to the source.
Reid echoed Google’s argument that sharing its data would create privacy risks, the source confirmed.
Closing arguments for the search remedies trial will take place May 29th and 30th, followed by the judge’s decision expected in August.
The company faces a separate remedies trial for its advertising tech business, which is scheduled to begin Sept. 22.