Meta is facing a major legal challenge and damages claim in Spain that argues the adtech giant’s years of failing to have a valid legal basis for processing people’s data for ads under European Union data protection rules also constitutes a competition breach for which they should be compensated financially.

AMI, an association of newspaper owners whose more than 80 members include the publishers of newspapers including El País, ABC and La Vanguardia, is behind the suit. The litigants are seeking more than €550 million (~$600M) for what they describe as Meta’s “systematic and massive non-compliance” with the EU’s General Data Protection Regulation (GDPR).

“Meta has repeatedly failed to comply with [EU] data protection legislation, ignoring the regulatory requirement that citizens must consent to the use of their data for advertising profiling, as can be seen from the different resolutions of the European authorities competent in this matter,” they write in a press release in Spanish [here translated into English using AI].

“The systematic and massive use of personal data of users of Meta platforms, tracked without their consent throughout their digital browsing, would have allowed the American company to offer the sale of advertising space on the market based on an illegitimately obtained competitive advantage,” they go on, stipulating their lawsuit argues 100% of Meta’s regional revenue was unlawfully obtained.

Meta, the owner of Facebook and Instagram, was hit with a fine of €390M back in January after EU data protection authorities confirmed performance of a contract was not a valid legal basis for it to track and profile users to target them with ads.

That final GDPR decision — which took years to wind its way though the regulation’s dispute resolution and decision making processes but is now being appealed by Meta in the Irish courts — confirmed the tech giant to be in breach of the law, creating conducive conditions for private privacy litigations (such as this one) to be filed. So expect to see more such suits pop up.

AMI’s challenge targets Meta’s ads processing over the period since the GDPR came into force, in May 2018, and up to the end of July last year. However the complainants are not ruling out the possibility of extending the timeframe of their suit to take account of what they dub “Meta’s persistence in its non-compliance”.

Since the January penalty, Meta has twice switched the legal basis it claims for ads processing in the region. Initially it switched to claiming a basis called legitimate interests. However a separate (long-running) competition and privacy challenge against Meta’s superprofiling, brought by Germany’s competition authority — which had previously been referred to the bloc’s top court — led to a decision by the CJEU in July 2022 that invalidated that basis too.

The AMI’s challenge references an October 27 “urgent binding decision” by the European Data Protection Board — which was issued after a request by Norway’s data protection authority in light of Meta’s continued processing of personal data without a valid legal basis in the months following the CJEU decision — to explain the possible timeframe extension.

In November Meta switched to claiming consent as the legal basis for its tracking-ads business in the EU. However the choice it’s devised for regional users demands they pick between paying it a monthly subscription for an ad-free version of its products or ‘agree’ to being tracked and profiled. This despite the GDPR stipulating consent must be “freely given” in order to be legally obtained.

Meta’s latest attempt to try to carve its trackings ads business out of EU privacy rules is already under challenge — with privacy and consumers rights groups arguing the choice it’s offering users is illegal and unfair.

Although one notably irony here is that the use of a so-called ‘cookie paywall’ to gather consent to track is a feature of a number of European newspapers’ websites — which demand users either pay a subscription to access the journalism or agree to being tracked in exchange for non-paid access.

Privacy group noyb, which was behind the original May 2018 GDPR complaint against Meta’s legal basis for tracking and is now challenging Meta’s latest “pay or okay” approach to consent, has also been challenging newspapers over cookie paywalls since 2021.

Meta was contacted for comment on the AMI lawsuit.