Google and Meta's new terms carry EU fine risk of up to 10% of sales

Two rewrites of the rules that govern how Google and Meta use data landed within a week of each other in October 2026, and both run into European law that allows fines calculated as a share of worldwide turnover. Google's privacy policy dated October 16 lets inferences drawn from Gmail, Drive and Google Photos shape ads for users who connect those apps to Search. Meta's revised Commercial Terms, moved on October 23 from an October 30 start to November 20, authorise the company to crawl any website "associated with" a business that uses its products. Publishers have already complained to antitrust authorities in Brussels and London.

The question that follows is how large a European penalty could be, and whether the two companies could absorb one at a time when their spending on artificial intelligence infrastructure has pushed free cash flow below zero. The answer from the filings is more measured than the premise. Both companies posted a quarter of negative free cash flow in 2026. Neither is short of cash. And on the evidence available as of October 24, no regulator has opened a case into either set of terms, while Google's Personal Intelligence feature, the one its new ad language depends on, has not been launched in the European Economic Area.

In Short

Google and Meta both changed their rules in October: Google can now use what it learns from connected Gmail and Photos accounts to pick ads, and Meta wants permission to crawl the websites of businesses that use Facebook and Instagram. European laws let regulators fine big tech companies up to 4%, 6%, 10% or even 20% of their worldwide sales when such rules break the law, which for these two companies means tens of billions of dollars at the very top end. The companies are spending so much on AI data centers that their free cash flow has dipped below zero for a quarter, but they still earn far more cash from their businesses than any past EU fine has cost them, and no regulator has charged either one over these new terms.

What changed in October

Google: an exception to a five-year-old pledge

Since July 1, 2021, Google's privacy policy carried a single categorical sentence: "We don't show you personalized ads based on your content from Drive, Gmail, or Photos." The version effective October 16, 2026 keeps that sentence and adds a condition. Google now does not do so "unless you choose to make data from these services available to other Google services that support personalized ads." A new sentence names Search as the service involved: "Search may process some of the data that you allow Search to access to personalize content, including ads." PPC Land documented the change against all 54 earlier policy versions on October 23.

Google's Search help page on connecting content apps adds that "Ads will not be based directly on your Gmail inbox or your Google Photos library," but that Search uses "summaries, excerpts, generated media, and inferences" from emails and files, and "That same info may be used to show you ads." The same page concedes that a summary "may just be the email or file" in some cases.

The feature behind the change is Personal Intelligence, which Google launched in beta on January 14, 2026 for US subscribers. When the Gemini app version rolled out worldwide on April 14, 2026, 9to5Google reported that "Today's worldwide launch excludes the EEA, Switzerland, and the UK." The privacy policy is a single global document, so the October 16 wording applies on paper in Europe. Whether any European user can currently switch on the feature that triggers the ad exception is a different matter, and the evidence points the other way.

Meta: crawling rights in a business contract

Meta's revised Commercial Terms, first examined by PPC Land on October 16, let the company crawl business websites and originally used their content to train AI. The free-standing "train" sentence has since disappeared from the UK English preview, which on the evening of October 23 limited the purpose to providing, developing, improving, researching and maintaining "advertising and business products" and "the integrity and security of Meta Company Products." The clause still covers any URL associated with a business's products or services, and still allows Meta to "create test credentials" to get past registration walls.

Meta delayed the terms and its Self-Serve Ad Terms to November 20 after publishers and advertisers complained to EU and UK antitrust authorities, according to Reuters. A Meta spokesperson said the extra time was "to explain to our partners and stakeholders what's changing and what's not." The European Commission welcomed the delay. The European Publishers Council wants the terms suspended while regulators investigate.

Acceptance works by conduct. "By continuing any access or use of any Meta Company Products for business or commercial purposes after any notice of an update to these Commercial Terms, you agree to be bound by them," Section 7 of the preview states. The only alternative the contract offers is to stop using Meta's products for business. The News/Media Alliance, in a letter that gave Meta until October 26 to respond, called the terms "a clear abuse of the company's market power."

Which EU rules the terms could test

No regulator has said that either set of terms breaks EU law. What follows is a map of the instruments that apply to these kinds of practices, the maximum fines each allows, and the facts that would matter.

GDPR: consent, purpose and sensitive inferences

The GDPR caps fines for breaches of its core principles at 4% of total worldwide annual turnover for the preceding financial year, or EUR 20 million, whichever is higher. For Google, the questions would be familiar ones. Is a user who connects Gmail to Search for better answers also giving specific, informed consent to ad use of the same inferences? Does an email-derived inference that falls outside the policy's sensitive categories, such as a booking at a clinic, still reveal health data? Personal data processed for one purpose generally cannot be reused for an incompatible one, and the GDPR's rules on special category data are stricter than Google's own ad policy.

Ireland's Data Protection Commission, Google's lead authority in the EU, showed on September 21, 2026 how it treats ad use that users may not anticipate. It fined Google EUR 403 million over location data processed between May 25, 2018 and February 4, 2020, finding infringements of lawfulness, fairness, transparency, retention and accountability. The DPC said users may not have known their location was used for ads or to infer interests. That decision concerned settings, not inbox content, and Google said it addressed historical policies.

For Meta, GDPR exposure from the crawling clause is less direct. Business websites carry personal data, from staff pages to customer reviews, and collecting it at scale is processing that needs a legal basis, typically legitimate interest for scraping. The European Data Protection Board's guidelines on web scraping for generative AI are open for comment until October 30. Meta already holds the GDPR record: the DPC's EUR 1.2 billion fine of May 2023 over data transfers to the US remains the largest GDPR fine announced, and is among four fines totalling about EUR 2.1 billion still under appeal, according to an Alliance Risk analysis covered by PPC Land on May 30, 2026.

Digital Markets Act: data combination and fair access

The Digital Markets Act carries the heaviest ceiling: 10% of total worldwide turnover for a first infringement and 20% for a repeat of the same or a similar infringement. Periodic penalty payments can add up to 5% of average daily worldwide turnover for each day of continued non-compliance.

Article 5(2) bars a gatekeeper from combining personal data from a designated core platform service with personal data from other services it provides, unless the user has been presented with a specific choice and has given consent. Google Search and Google's ad services are designated. Gmail is not, which places it among the "other services" whose data cannot be combined with Search for advertising without that consent. If Personal Intelligence reaches Europe with ads switched on, the design of the consent screen would be the central question. The Commission's EUR 200 million fine on Meta on April 23, 2025 turned on exactly this provision and Meta's pay or okay model. In March 2026, the European consumer organisation BEUC said Meta's fourth version of the consent flow, introduced in January, still falls short and asked the Commission for periodic penalties.

The case law on what counts as combination is not settled. In May 2025, the Higher Regional Court of Cologne held that Meta's plan to train AI on partially de-identified data from two services was not a prohibited combination under the DMA, a reading PPC Land noted runs against the Bundeskartellamt's position. Personalised advertising, the same ruling suggested, remains restricted.

For Meta's Commercial Terms, the DMA provision with the closest fit is Article 6(12), which requires gatekeepers to apply fair, reasonable and non-discriminatory general conditions of access to business users of designated online social networking services. Facebook is designated as one. A clause under which a business pays for access to Facebook's audience by granting crawling rights over its whole domain, with no partial opt-out, is the kind of condition publishers argue is unfair. Meta disputes their reading of the terms. The Commission has not said whether it is examining them under the DMA.

Google already knows how the Commission applies these powers. On July 23, 2026 it fined Google EUR 890 million in two DMA decisions, EUR 460 million for self-preferencing in Search and EUR 430 million for anti-steering in Google Play, and gave it 60 days to comply. Dialogue on how the decision applies to AI Overviews and AI Mode continues with no stated timeline.

Antitrust: unfair trading conditions

Article 102 of the Treaty on the Functioning of the European Union prohibits abuse of a dominant position, including the imposition of unfair trading conditions. Fines under Regulation 1/2003 are capped at 10% of worldwide turnover. The publishers' complaints against Meta went to the Commission in its antitrust role, according to Reuters.

The Commission is already testing a similar theory against Google. On December 9, 2025, it opened a formal Article 102 investigation into Google's use of publisher content for AI Overviews and AI Mode without a way to opt out short of losing Search visibility, and into YouTube's terms requiring creators to allow AI training. The structure of that complaint, access to a dominant platform conditioned on surrendering content for AI, is close to what publishers allege about Meta's crawling clause.

Antitrust fines against Google have been large and durable. The Court of Justice on July 2, 2026 upheld the Android fine at EUR 4.125 billion, the General Court's reduced figure from the original EUR 4.342 billion. The Commission fined Google EUR 2.95 billion over ad tech on September 5, 2025. EU courts upheld a EUR 2.4 billion fine over search practices, while the EUR 1.49 billion AdSense fine was overturned in September 2024.

Digital Services Act and AI Act

The Digital Services Act caps fines for very large online platforms at 6% of worldwide annual turnover. It is not the obvious tool for either set of terms, but it is the one under which Meta is furthest along. The Commission issued preliminary findings on transparency on October 24, 2025, on age assurance for under-13s on April 29, 2026, and on potentially addictive design on July 10, 2026, which PPC Land covered under the 6% ceiling.

The AI Act matters for Meta's crawling clause in a narrower way. Providers of general-purpose AI models must publish summaries of their training data and maintain a copyright policy that respects machine-readable opt-outs. Commission enforcement powers over general-purpose models began on August 2, 2026, with fines of up to EUR 15 million or 3% of worldwide turnover, a point PPC Land made when Meta signed the separate AI content transparency code in July. On October 23 the Commission said it had sent requests for information to companies that have not published training-data summaries; Reuters did not say whether Meta was one of them. Meta's spokesperson said the company would make clear that content owners can still use robots.txt to signal preferences. The preview contract does not say so.

What the ceilings mean in dollars

Fines are calculated on the preceding financial year. Alphabet reported revenue of $402.8 billion for 2025 and Meta $200.97 billion, according to their fourth-quarter releases. By PPC Land's calculation, the statutory maximums for a decision taken in 2026 would be:

These are legal limits, not estimates. Actual fines have been far lower. The EUR 890 million DMA penalty on Google amounts to about $1 billion, well under 1% of Alphabet's 2025 revenue. Meta's EUR 200 million DMA fine was about one-tenth of 1% of its 2025 revenue. The largest EU fine on either company, the Android penalty, was set in 2018 against a much smaller Alphabet. The single largest monetary penalty against Meta in 2026 came from the United States, not Europe: a New Mexico judge ordered Meta to pay $25 billion on October 21, more than the 10% EU antitrust ceiling would allow on Meta's 2025 revenue.

Fines also arrive slowly. The Android decision took nearly eight years to become final. Companies that appeal Commission decisions can provide a bank guarantee instead of paying immediately, and Irish courts have suspended DPC orders while appeals run, as the High Court did conditionally for TikTok.

Do the companies have the cash?

The premise that Google and Meta "do not have cash flow" does not hold, but a narrower version does. Both companies still generate tens of billions of dollars of operating cash each quarter. What has turned negative is free cash flow - operating cash minus capital spending - because AI infrastructure spending now exceeds what the businesses bring in.

Meta

For the third quarter of 2026, Meta reported cash from operating activities of $32.79 billion and capital expenditures, including finance lease payments, of $34.91 billion. Free cash flow was negative $2.12 billion, against positive $10.63 billion a year earlier, as PPC Land reported on October 21. Free cash flow fell from $12.39 billion in the first quarter to $784 million in the second before turning negative, which leaves the nine-month total at about $11.05 billion by PPC Land's calculation. For all of 2025, Meta generated $115.80 billion from operations and $43.59 billion in free cash flow.

Spending is set to rise further. Meta's 2026 capital expenditure guidance is $135 billion to $145 billion, against $72.22 billion in 2025. With $85.82 billion spent through September, the range implies fourth-quarter capital spending of roughly $49.2 billion to $59.2 billion, by PPC Land's calculation, which would exceed any quarter's operating cash flow so far this year.

Meta held $82.45 billion in cash, cash equivalents and marketable securities at September 30, against $81.59 billion at the end of 2025. Long-term debt rose to $80.92 billion from $58.74 billion, after $25 billion of notes issued in May. Meta made no share buybacks in the first nine months of 2026, after repurchasing $26.25 billion in the same period of 2025. Its quarterly filing says it has "accrued significant amounts for loss contingencies related to these inquiries and investigations in Europe," without disclosing the figure, and that additional accruals "could be material individually or in the aggregate." It also says changes to its less personalised ads imposed during its DMA appeal "could result in a materially worse user experience for European users and a significant impact to our European business and revenue."

A DMA fine at the 10% ceiling, about $20.10 billion, would equal roughly a quarter of Meta's September cash pile and about 61% of one quarter's operating cash flow, by PPC Land's calculation. That would hurt. It would not exhaust the company's resources, and it would sit alongside the $25 billion New Mexico penalty that Meta has already accrued and intends to appeal.

Alphabet

Alphabet's most recent results cover the second quarter of 2026, reported on July 22. Operating cash flow was $39.1 billion and capital expenditures $44.9 billion, leaving free cash flow at negative $5.9 billion, the first negative quarter in Alphabet's history as a public company, according to several financial publications. Trailing twelve-month free cash flow was still $53.3 billion, down 20%, as PPC Land reported on July 23. For 2025, Alphabet generated $164.7 billion from operations and $73.3 billion in free cash flow.

The 2026 capex guidance rose to $195 billion to $205 billion from $180 billion to $190 billion. With $80.6 billion spent in the first half, the range implies about $114 billion to $124 billion in the second half, by PPC Land's calculation, or roughly $57 billion to $62 billion a quarter.

Alphabet has raised outside money to pay for it. In June it announced an equity raise of about $85 billion, including a $10 billion private placement with Berkshire Hathaway, and its second-quarter results showed $49.6 billion in net proceeds from issuances completed in June. Senior notes brought in another $20.3 billion. Cash and marketable securities stood at $242.5 billion at June 30, and long-term debt at $98.2 billion.

A DMA fine at the 10% ceiling, about $40.28 billion, would be about 17% of that cash balance by PPC Land's calculation. Alphabet reports third-quarter results on October 28, which will show whether free cash flow stayed negative.

What the evidence does not establish

Several points in the question behind this analysis remain open, and the documents do not settle them.

No EU authority has opened proceedings over Google's October 16 policy or Meta's revised Commercial Terms. The Commission's only public statement on Meta's terms was to welcome the delay. The complaints to the Commission and the UK Competition and Markets Authority have not been published, and their legal basis is not public.

Google's ad exception depends on Personal Intelligence, which was excluded from the EEA when the Gemini app version rolled out worldwide in April. Google's help page says connecting Google Photos "isn't available in all regions." Whether AI Mode ads for Personal Intelligence users are being tested anywhere in Europe has not been reported. If the feature is not offered there, the GDPR and DMA questions above remain hypothetical for Google.

Meta's preview page has not settled the text. The training sentence was removed between October 18 and October 23, and Meta says it will explain its use of robots.txt before November 20. A further revision could narrow or widen the exposure.

Negative free cash flow in one quarter is not a cash shortage. Both companies chose capital spending that exceeds operating cash flow and financed the gap with debt, equity and cash reserves. Whether that spending pays off is a separate question from whether either company could pay a European fine. On the numbers reported, both could.

Why this matters for the marketing community

For advertisers, the regulatory question is not abstract. EU enforcement has changed ad products before any fine was final: Meta's less personalised ads exist because of the DMA, and Meta's 10-Q describes them as "less relevant and effective than our premium ad offerings." If Google brings Personal Intelligence to Europe, the consent design required under Article 5(2) would decide how many users' inbox-derived signals ever reach ad selection, and that number could be far smaller than in the US.

For publishers and brands that run Facebook pages, the November 20 date is a practical deadline. Under Section 7, continuing to use Meta's business tools after that date counts as acceptance. A regulator could change the terms, but none has said it will act before then.

The financial picture adds a second layer. Both companies are financing record AI spending partly through borrowing and share sales, and Meta has suspended buybacks. That does not make them unable to pay fines, but it means a large penalty now competes with infrastructure commitments that Meta puts at $454.52 billion in non-cancelable obligations. Regulators have never come close to the ceilings. The ceilings, however, scale with revenue, and both companies' revenue keeps rising.

Timeline

• July 1, 2021 - Google adds "We don't show you personalized ads based on your content from Drive, Gmail, or Photos" to its privacy policy.
• May 2023 - Ireland's DPC fines Meta EUR 1.2 billion over EU-US data transfers, the largest GDPR fine announced.
• April 23, 2025 - The Commission fines Meta EUR 200 million under the DMA over pay or consent.
• May 23, 2025 - Cologne court rules Meta's AI training plan is not a prohibited DMA data combination.
• September 5, 2025 - The Commission fines Google EUR 2.95 billion over ad tech.
• October 24, 2025 - Preliminary DSA transparency findings against Meta.
• December 9, 2025 - The Commission opens an Article 102 probe into Google's use of publisher content for AI.
• January 14, 2026 - Google launches Personal Intelligence in beta in the US.
• March 17, 2026 - BEUC says Meta's January 2026 consent flow still falls short.
• April 14, 2026 - Personal Intelligence in the Gemini app rolls out worldwide, excluding the EEA, Switzerland and the UK.
• June 3, 2026 - Alphabet announces an equity raise of about $85 billion.
• July 2, 2026 - The Court of Justice upholds Google's EUR 4.125 billion Android fine.
• July 10, 2026 - Preliminary DSA findings on addictive design at Instagram and Facebook.
• July 22, 2026 - Alphabet reports negative free cash flow of $5.9 billion and raises 2026 capex guidance to $195-205 billion.
• July 23, 2026 - The Commission fines Google EUR 890 million under the DMA.
• July 28, 2026 - Meta signs the EU code on AI content transparency.
• August 2, 2026 - Commission enforcement powers over general-purpose AI models begin.
• September 21, 2026 - Ireland's DPC fines Google EUR 403 million over location data.
• October 16, 2026 - Google's privacy policy adds the Personal Intelligence exception; Meta's revised Commercial Terms let it crawl business websites.
• October 21, 2026 - Meta reports negative free cash flow of $2.12 billion for the third quarter; a New Mexico judge orders Meta to pay $25 billion.
• October 22, 2026 - The News/Media Alliance gives Meta until October 26 to respond.
• October 23, 2026 - Meta delays its Commercial Terms and Self-Serve Ad Terms to November 20; PPC Land documents Google's policy change.
• October 26, 2026 - News/Media Alliance deadline for Meta's response.
• October 28, 2026 - Alphabet reports third-quarter results.
• October 30, 2026 - EDPB consultation on web scraping guidelines closes.
• November 20, 2026 - New effective date of Meta's revised terms.

Related PPC Land coverage

• Google lets connected Gmail and Photos data shape ads, 5 years after pledge - The line-by-line comparison of Google's October 16 privacy policy with earlier versions.
• Meta's new terms let it crawl business websites to train AI from Oct 30 - The first analysis of Meta's crawling clause.
• Meta delays website-crawling terms to Nov 20 after publisher complaints - The delay, the regulators' reactions and the current wording.
• Meta delays its AI terms to November 20. The trust problem does not move - Analysis of what the delay leaves unresolved.
• Meta takes $9.89bn teen settlement charge as ad revenue gains 26% - Meta's third-quarter results, including negative free cash flow.
• Meta books reserve for $25bn New Mexico penalty, quarterly filing shows - The 10-Q detail on European accruals, debt and commitments.
• Google Search ads gain 17% to $63.3 billion while network drops 1% - Alphabet's second-quarter results and its first negative free cash flow quarter.
• Alphabet raises $85 billion to bet everything on AI infrastructure - The June equity raise behind Alphabet's cash balance.
• EU fines Google 890 million euros and gives it 60 days to fix search - The largest DMA fine to date.
• Irish regulator fines Google EUR 403 million over location data processing - The September 2026 GDPR decision on location data and ads.
• Google loses 4.1 billion Android fine as EU court dismisses appeal - The final ruling on the largest EU antitrust fine against Google.
• Meta's consent-for-ads model still falls short, says EU consumer body - BEUC's assessment of Meta's DMA consent flow.
• Meta faces 6% turnover fine as EU finds Instagram breach addictive design - The DSA preliminary findings against Meta.
• European Commission opens probe into Google's AI content practices - The Article 102 case on publisher content and AI, close in structure to the complaints against Meta.

Summary

Who: Alphabet's Google and Meta Platforms; the European Commission, Ireland's Data Protection Commission and the UK Competition and Markets Authority; publishers, including the European Publishers Council and the News/Media Alliance, and the advertisers bound by both companies' terms.

What: Google's October 16 privacy policy lets inferences from connected Gmail, Drive and Google Photos data shape Search ads, and Meta's revised Commercial Terms authorise crawling of business websites. Both changes touch EU rules with turnover-based fine ceilings: 4% under the GDPR, 6% under the DSA, 10% under antitrust law and the DMA, and 20% for repeat DMA breaches. On 2025 revenue, a 10% ceiling equals about $40.28 billion for Alphabet and $20.10 billion for Meta. No authority has opened a case on either set of terms.

When: Google's policy took effect on October 16, 2026. Meta's terms, first due October 30, now take effect November 20, 2026. Meta reported negative free cash flow for the third quarter on October 21; Alphabet reported its negative quarter on July 22 and reports third-quarter results on October 28.

Where: The European Union and European Economic Area, where the fines would apply, with parallel complaints in the United Kingdom. Google's Personal Intelligence feature was excluded from the EEA, Switzerland and the UK when the Gemini app version rolled out worldwide in April.

Why: Both companies are rewriting their data terms while spending more on AI infrastructure than they generate from operations, which has pushed free cash flow negative for a quarter at each. The filings show that the companies still generate large operating cash flows and hold more than $80 billion each in cash and securities, so the premise that they lack cash flow does not hold, while the regulatory exposure depends on facts that have not yet been established, including whether Google offers the feature in Europe and whether Meta changes its text before November 20.