A regulatory ruling out of Rome may carry consequences far beyond its headline number, hinging on a legal mechanism that bypasses Meta Platforms’ (NASDAQ: META) preferred European jurisdiction.
Italy’s data protection authority, the Garante, levied an €805 million fine on Meta on November 14, the largest penalty the body has ever handed down.
The violation centered on a Facebook for Android feature that drew post suggestions from users’ photo galleries, accessing photos, videos, and associated metadata without specific consent or adequate disclosure.
Roughly 20 million Android users in Italy were affected, and Meta now has 60 days to disable the feature by default and obtain separate user consent before reactivating it.
Meta responded by labeling the penalty “disproportionate” and confirming it intends to appeal, while its stock had closed the prior Friday at $641.69, before the ruling became public.
At approximately 0.47% of Meta’s global turnover, the fine stings less financially than strategically, representing around 2% of the company’s $43.59 billion in 2025 free cash flow.
To place the number in further context, Meta absorbed a $9.9 billion legal charge just last quarter tied to an August 2026 settlement with multiple state attorneys general, a sum more than eleven times larger than what Italy has now imposed.
That prior charge landed during a quarter when free cash flow had already turned negative at minus $2.1 billion, weighed down by $34.9 billion in capital expenditure for AI infrastructure, meaning legal costs are piling onto an already stretched cash position.
The more consequential element of the Garante’s action is the jurisdictional path it chose, pursuing the case under Italy’s version of the EU’s ePrivacy rules rather than GDPR, a distinction that removes the requirement to route enforcement through Ireland, where Meta houses its European headquarters.
The Garante explicitly rejected Meta’s argument that the Irish data protection authority should have primacy, establishing a template under which any EU member state’s regulator can independently pursue ePrivacy-based complaints without coordinating through Dublin.
That precedent matters enormously given Europe’s financial weight in Meta’s business, with the region generating $46.57 billion in revenue during 2025, a 21% annual increase that accounted for roughly 23% of the company’s total global revenue.
Should other national regulators adopt the same ePrivacy route against data practices more directly tied to advertising, rather than a single photo-gallery feature, the exposure would scale well beyond anything the Italian fine suggests.
The current ruling targets a narrow, specific function, and no estimate has been placed on the cumulative cost of mandated opt-ins across multiple EU markets, but the legal architecture for such actions now has a working proof of concept.
Until a second national regulator moves against Meta using the same mechanism, investors may reasonably treat this as a manageable, if uncomfortable, development rather than a structural threat to the company’s European revenue base.
