Brussels fines Apple (500 million) and Meta (200 million) for mishandling of users’ personal data

Brussels – The European Commission found that Apple violated its anti-steering obligation under the Digital Markets Act (DMA) and that Meta violated the DMA obligation to give consumers the choice of a service that uses less personal data. Brussels, therefore, imposed fines of €500 million and €200 million on Apple and Meta, respectively. The two decisions came after extensive dialogue with the concerned companies, allowing them to present their comments and arguments in detail.

Non-compliance decision on Apple’s steering terms

Under the DMA, app developers distributing their apps via Apple’s App Store should be able to inform customers, free of charge, of alternative offers outside the App Store, steer them to those offers, and allow them to make purchases. The Commission found that Apple failed to comply with this obligation. Due to several restrictions imposed by Apple, app developers cannot fully benefit from the advantages of alternative distribution channels outside the App Store. Similarly, consumers cannot fully benefit from alternative and cheaper offers as Apple prevents app developers from directly informing consumers of such offers. The company has failed to demonstrate that these restrictions are objectively necessary and proportionate.

In today’s decision, the Commission has ordered Apple to remove the technical and commercial restrictions on steering and to refrain from perpetuating non-compliant conduct in the future, which includes adopting conduct with an equivalent object or effect. The fine imposed on Apple considers the gravity and duration of the non-compliance. Today, the Commission has also closed the investigation on Apple’s user choice obligations, thanks to early and proactive engagement by Apple on a compliance solution.

Non-compliance decision on Meta’s “consent or pay” model

Under the DMA, gatekeepers must seek users’ consent to combine their personal data between services. Those users who do not consent must have access to a less personalized but equivalent alternative. In November 2023, Meta introduced a “consent or pay” advertising model. Under this model, EU users of Facebook and Instagram had a choice between consenting to personal data combination for personalized advertising or paying a monthly subscription for an ad-free service. The Commission found that this model was not compliant with the DMA, as it did not give users the required specific choice to opt for a service that uses less of their personal data but is otherwise equivalent to the ‘personalized ads’ service.

Meta’s model also did not allow users to exercise their right to freely consent to the combination of their personal data. In November 2024, after numerous exchanges with the Commission, Meta introduced another version of the free personalized ads model, offering a new option that allegedly uses less personal data to display advertisements. The Commission is currently assessing this new option and continues its dialogue with Meta, requesting the company to provide evidence of the impact that this new ads model has in practice.

Without prejudice to this ongoing assessment, today’s decision finding non-compliance concerns the time period during which end users in the EU were only offered the binary ‘Consent or Pay’ option between March 2024, when the DMA obligations became legally binding, and November 2024, when Meta’s new ads model was introduced. The fine imposed on Meta also reflects the gravity and duration of the non-compliance while noting that today’s decisions taken against Apple and Meta are the first non-compliance decisions adopted under the DMA.

Today, the Commission also found that Meta’s online intermediation service, Facebook Marketplace, should no longer be designated under the DMA. The decision follows a request submitted by Meta on 5 March 2024 to reconsider the designation of Marketplace. Following a careful assessment of Meta’s arguments and as a result of Meta’s additional enforcement and continued monitoring measures to counteract the business-to-consumer use of Marketplace, the Commission found that Marketplace had less than 10,000 business users in 2024. Meta, therefore, no longer meets the relevant threshold, giving rise to a presumption that Marketplace is an important gateway for business users to reach end users.

Apple and Meta are required to comply with the Commission’s decisions within 60 days; otherwise, they risk periodic penalty payments.