Case T‑319/24

Meta Platforms Ireland Ltd

v

European Data Protection Board

Order of the General Court (Tenth Chamber) of 29 April 2025

(Action for annulment – Protection of personal data – Opinion of the European Data Protection Board on valid consent in the context of ‘consent or pay’ models implemented by large online platforms – Article 64(2) of Regulation (EU) 2016/679 – Act not open to challenge – Inadmissibility – Liability – Damage – Causal link – Action manifestly lacking any foundation in law)

1. Action for annulment – Acts open to challenge – Concept – Acts producing binding legal effects – Opinion of the European Data Protection Board on valid user consent in the context of ‘consent or pay’ models implemented by large online platforms – Not included – Inadmissibility

   (Art. 263 TFEU)

   (see paragraphs 19-42)

2. Non-contractual liability – Conditions – Unlawfulness – Damage – Causal link – One of the conditions not satisfied – Action for damages dismissed in its entirety

   (Arts 268 and 340, second para., TFEU)

   (see paragraphs 47-58)

Résumé

By its order, the General Court dismisses as inadmissible the action for annulment ( 1 ) brought by Meta Platforms Ireland Ltd (‘Meta’) against Opinion 8/2024 of the European Data Protection Board (‘the EDPB’) on valid consent in the context of ‘consent or pay’ models implemented by large online platforms. It thus finds that that opinion, adopted under the General Data Protection Regulation, ( 2 ) is not an act against which such an action may be brought, in the absence of binding legal effects vis-à-vis third parties. The Court also dismisses as manifestly lacking any foundation in law the action for non-contractual liability of the European Union ( 3 ) brought by Meta seeking compensation for the damage which it claims to have suffered as a result of that opinion.

On 17 April 2024, at the request of three national supervisory authorities in the field of personal data protection, the EDPB adopted Opinion 8/2024. Those authorities sought to ascertain the circumstances and conditions under which practices implemented by large online platforms, ( 4 ) whereby users are offered a choice between consenting to the processing of personal data for behavioural advertising purposes and paying a fee to access the service without their personal data being processed for those purposes (‘consent or pay’ models), could be considered to satisfy the requirement for valid consent, within the meaning of the GDPR.

In Opinion 8/2024, the EDPB states, in particular, that in order to be valid, the consent requested from users for the processing of their personal data for behavioural advertising purposes must be freely given, specific, informed and unambiguous, and must relate to the processing of data in compliance with the principles of necessity, proportionality, purpose limitation, data minimisation and fairness. According to the EDPB, whether or not a further alternative, free of charge and without behavioural advertising, with, for example, a form of advertising involving the processing of less (or no) personal data, is offered to users by a large online platform could have a substantial impact on the assessment of the validity of that consent. As regards the fee charged to access the paid version of the service, the EDPB states that the amount thereof must not be such as to inhibit data subjects from making a free choice and from refusing to give consent.

In that context, Meta seeks the annulment of Opinion 8/2024 and compensation for the damage which it claims to have suffered as a result of that opinion.

Findings of the Court

In the first place, the Court recalls that an action for annulment under Article 263 TFEU must be available against all acts adopted by the institutions, bodies, offices and agencies of the European Union, whatever their nature or form, which are intended to produce binding legal effects.

As regards, in the present case, Opinion 8/2024, the Court takes the view that it cannot be inferred from the wording thereof that that opinion is intended in itself to produce binding legal effects. That act provides a framework for evaluating the ‘consent or pay’ models of large online platforms in the light of the rules laid down in the GDPR concerning valid consent. In Opinion 8/2024, the EDPB focuses on the situation in which such a platform does not offer users a free alternative to the option of consenting to the processing of personal data for behavioural advertising purposes. In most cases, that situation is likely to result in the invalidity of such consent. That assessment depends on a number of factors, including whether or not the service in question is an important part of the user’s social or professional life and the cost of the paid option. Furthermore, the passages in Opinion 8/2024 containing words such as ‘should’ and ‘should not’ appear to be calling for an in-depth consideration of the other options that each large online platform could offer to users, rather than censuring across the board the ‘consent or pay’ model offered by those platforms.

The Court also points out that the GDPR does not contain any provision requiring supervisory authorities to ‘take utmost account’ of an opinion of the EDPB on general matters, such as Opinion 8/2024. ( 5 ) By contrast, such an obligation ( 6 ) does apply to opinions relating to certain specific types of draft decision of the supervisory authorities, ( 7 ) which those authorities must communicate to the EDPB during the procedure for the adoption of those decisions. If the supervisory authority concerned does not intend to follow, in whole or in part, such opinions, it must notify the Chair of the EDPB thereof, which triggers the process for the adoption of a binding decision of the EDPB. ( 8 ) No such rules are laid down in relation to opinions of the EDPB on general matters, like Opinion 8/2024, which are therefore opinions to which no special authority is attached. Those opinions are not in the nature of an act which is in itself binding, since it is only by means of a subsequent binding decision of the EDPB that the guidelines they contain may, having regard to the EDPB’s powers, where appropriate, later become instructions of mandatory application by the supervisory authorities. In the light of the foregoing, the Court holds that Opinion 8/2024 does not produce binding legal effects vis-à-vis third parties or, more particularly, vis-à-vis Meta.

First, even if Meta were in the situation with which Opinion 8/2024 is concerned, in the absence of a full analysis of its case by the competent supervisory authorities, that opinion cannot produce binding legal effects in respect of it. Secondly, the possibility of the EDPB issuing a subsequent binding decision addressed to the competent supervisory authorities tasked with reviewing the ‘consent or pay’ model used by Meta, a decision that reproduces all or part of the evaluation framework set out in Opinion 8/2024, is not sufficient to consider that decision to be binding from the outset. Accordingly, the Court finds that that opinion is not an act that may be challenged by Meta.

That finding does not constitute a breach of Meta’s right to effective judicial protection, ( 9 ) since Opinion 8/2024 does not produce binding legal effects in respect of it. The considerations contained in that opinion could affect Meta directly only if they were included in a decision of a supervisory authority or a court of a Member State or another State party to the Agreement on the European Economic Area (EEA). If that were the case, those decisions may be or will have been assessed by a court meeting the requirements of effective judicial protection.

That finding also cannot be called into question by possible differences in how that act is assessed by the courts of States party to the EEA Agreement that are not members of the European Union and in how it is assessed by the courts of Member States of the European Union. Such a possibility is inherent in the system in place in the EEA Agreement which is based on two pillars of supervision and judicial review, the first applying to Member States of the European Union and the second to the other States party to that agreement. As far as the latter are concerned, the EEA Agreement and the Agreement between the States of the European Free Trade Association (EFTA) on the establishment of a surveillance authority and a Court of Justice ( 10 ) provide that a reference may be made to the EFTA Court by a court of those States for an opinion on the interpretation of those rules, thus including the interpretation of the GDPR. The EFTA Court could thus state its view on the extent to which the considerations set out in Opinion 8/2024 are consistent with that regulation. As regards the Member States of the European Union, the Court of Justice could be asked by a court of an EU Member State to assess the validity of that opinion.

In the second place, the Court rejects Meta’s claim for compensation for the damage it allegedly suffered as a result of Opinion 8/2024, based on the non-contractual liability of the European Union.

After recalling the three cumulative conditions that must be fulfilled for such liability to be incurred, the Court observes that the condition relating to the existence of actual and certain damage is not satisfied. As regards the damage alleged by Meta, which consists in the reduction in advertising and subscription revenues resulting from the ‘requirement’, purportedly imposed by Opinion 8/2024, to offer users a free alternative in addition to the choice between consenting to the receipt of behavioural advertising and paying to access the service concerned without receiving such advertising, the Court finds that it is based on a misunderstanding of that opinion. The opinion in question seeks, in essence, only to provide a framework for evaluating the ‘consent or pay’ models of large online platforms in the light of the rules laid down in the GDPR concerning valid consent and is not intended in itself to produce binding legal effects. Furthermore, the damage alleged by Meta is based on future and uncertain events, since the application of that evaluation framework by the Irish Data Protection Commission acting on its own initiative or the adoption by the EDPB of a binding decision on the matter are mere possibilities.

As regards, for the sake of completeness, the condition relating to the causal link, the Court states that it is not possible to establish a sufficiently direct causal nexus between Opinion 8/2024 and the damage alleged by Meta. In the absence of binding effects, that opinion cannot be the sufficiently direct cause of the potential reduction in revenue that Meta claims to expect. Such damage could be the direct result of intentional conduct on Meta’s part or of possible decisions imposed on it, prompting it to offer users a free alternative in addition to a choice between consenting to the receipt of behavioural advertising and paying to access the service concerned without receiving such advertising.

( 1 ) Article 263 TFEU.

( 2 ) Article 64(2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’).

( 3 ) Under Article 268 and the second paragraph of Article 340 TFEU.

( 4 ) Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital Services Act) (OJ 2022 L 277, p. 1). Article 3(i) of that regulation defines the concept of ‘online platform’, while Article 33(1) thereof defines the concept of ‘very large online platform’.

( 5 ) Opinion under Article 64(2) of the GDPR.

( 6 ) Provided for in Article 64(7) of the GDPR.

( 7 ) Opinions under Article 64(1) of the GDPR.

( 8 ) Article 64(8) of the GDPR.

( 9 ) Article 47 of the Charter of Fundamental Rights of the European Union.

( 10 ) Article 108(2) of the EEA Agreement and Article 34 of the Agreement between the EFTA States on the establishment of a surveillance authority and a Court of Justice (OJ 1994 L 344, p. 1).