Madrid court orders Meta to pay €479 million for GDPR advertising violations

A Madrid court ordered Meta to pay €479 million to 87 Spanish digital news publishers on November 19, 2025, for obtaining unfair competitive advantages through advertising practices that violated the General Data Protection Regulation. Commercial Court No. 15 found that Meta illegally used personal data from Facebook and Instagram users between May 25, 2018 and August 1, 2023 to sell behavioral advertising, giving the company an improper edge over Spanish digital press competitors.

The ruling awarded €2.57 million to Grupo Europa Press and €13,563 to Radio Blanca. Publishers grouped under AMI (Asociación de Medios de Información) brought the lawsuit arguing that Meta's behavioral advertising unfairly leveraged protected personal data, creating significant competitive advantages in Spain's advertising market that digital publishers could not match.

Judge based the decision on Article 15.1 of Spain's Unfair Competition Law, which prohibits gaining market advantages through legal violations. The court determined Meta's infringement of GDPR constituted such a violation, warranting compensation to affected competitors.

Legal basis for data processing

Meta changed its legal basis for processing user data when GDPR took effect on May 25, 2018. The company shifted from requiring user consent to claiming "necessity for contract execution" as justification for processing personal information. According to RGPD regulations, the legal basis determines whether companies can lawfully process personal data from Facebook and Instagram users for behavioral advertising sold to advertisers.

Ireland's Data Protection Commission sanctioned Meta in December 2022 for using an inadequate legal basis. The court noted that maintaining the consent-based approach would have prevented the infraction and blocked lawsuits like those filed by Spanish publishers.

Financial calculations and market analysis

Meta Ireland refused to provide Spanish business accounts during proceedings. The judge applied burden of proof rules and corroborated data presented by Spanish digital publishers, concluding Meta earned more than €5.281 billion from online advertising in Spain during the five-year infraction period. The court presumed actual earnings exceeded this amount, reasoning that Meta would have submitted Spanish business accounts if revenues had been lower.

The judge distributed these illegally obtained revenues among advertising market competitors based on market share calculations. Spanish digital press received allocations proportional to their market presence during those five years, producing the €479 million award.

Spain's National Commission on Markets and Competition provided the framework for these calculations through its "Study on competitive conditions in Spain's online advertising sector." The judge determined that real data from this study could establish damages to Spanish digital publishers with "reasonable verisimilitude"—the threshold required for economic claims to succeed. Publishers demonstrated lost earnings resulting from Meta's conduct.

Competitive advantage through data violations

The ruling could establish important precedent in Spain's advertising sector. Spanish digital publishers' advertising offerings competed directly with Meta's behavioral advertising, which operated through illegal processing of millions of personal data points from Facebook and Instagram users. Meta collected this information not only from its own platforms but from other internet pages users visited.

Unlawful processing of massive quantities of personal data gave Meta competitive advantages Spanish digital publishers could not replicate. Meta's practices negatively affected display advertising revenues for Spanish digital press—advertisements that appear when readers access news articles without payment. Spanish publishers suffered advertising revenue losses during this period.

The case carries significant cross-border implications. Facebook and Instagram services operate identically throughout the European Union under GDPR jurisdiction. France is already processing a similar lawsuit against Meta with comparable characteristics. The ruling extensively cites European legislation and jurisprudence applicable to the case, acknowledging this transnational dimension.

Appeals and broader implications

Meta can file an appeal with the Provincial Court, where judges could challenge both evidence evaluation and indemnification calculation methods. The company has not yet indicated whether it will pursue this option.

The first-instance conclusion opens debate about balancing social media benefits and technological advances against privacy protections and users' fundamental rights. The ruling aligns with a European Parliament resolution from October 25, 2018, which stated that competition legislation must play a fundamental role controlling excesses committed through illegal personal data processing and the enormous informational and economic power held by technology giants.

Digital publishers across Europe have struggled with declining advertising revenues as platforms captured increasing market share. Research shows publishers typically receive only 36 cents of every media dollar spent through demand-side platforms in programmatic advertising.

Meta's advertising revenue reached €50.1 billion in the third quarter of 2025, representing 26% year-over-year growth driven by AI-powered optimization systems. The company's behavioral advertising model depends on processing extensive user data across its platforms to deliver targeted advertisements.

Privacy enforcement has intensified across Europe. The Irish Data Protection Commission previously fined Meta €390 million for advertising consent violations, while French authorities imposed €60 million for cookie-related infractions. The European Data Protection Board ordered Meta to cease behavioral advertising throughout the European Economic Area in December 2023.

Spain's ruling demonstrates how competition authorities can leverage GDPR violations to address market imbalances created by dominant platforms. The decision establishes that companies gaining competitive advantages through illegal data processing practices must compensate disadvantaged competitors, not just face regulatory fines.

For marketing professionals, the judgment illustrates mounting regulatory risks surrounding data collection practices. Platforms processing personal information must ensure proper legal bases exist before using that data for advertising purposes. Failure to maintain GDPR compliance can trigger both administrative penalties and civil liability for unfair competition.

The €479 million award substantially exceeds typical GDPR fines, suggesting that unfair competition claims may present greater financial exposure than privacy violations alone. Companies operating across multiple European markets face potential claims in each jurisdiction where they maintain competitive advantages through illegal data processing.

Publishers may view Spain's precedent as a roadmap for similar actions in other countries. Google faces multiple antitrust challenges regarding its advertising technology dominance, with courts finding the company illegally monopolized certain markets. These parallel proceedings indicate regulators are examining competitive dynamics across the digital advertising ecosystem.

The ruling remains non-final pending potential appeals. Legal observers will watch Provincial Court proceedings to determine whether Spanish courts sustain both the liability finding and the indemnification methodology. Outcomes could influence similar litigation across Europe and shape how platforms structure their data processing and advertising operations.

Timeline

• May 25, 2018: GDPR takes effect; Meta changes legal basis from consent to contract necessity
• December 2022: Ireland's Data Protection Commission sanctions Meta for inadequate legal basis
• December 9, 2023: European Data Protection Board orders Meta to cease behavioral advertising in EEA
• August 1, 2023: Meta changes to consent-based legal framework
• October 4, 2024: Court of Justice rules Meta must limit personal data use for targeted advertising
• July 4, 2025: German court awards Facebook user €5,000 for data protection violations
• November 19, 2025: Madrid Commercial Court No. 15 orders Meta to pay €479 million to Spanish publishers

Summary

Who: Commercial Court No. 15 of Madrid ruled against Meta Ireland Limited in a lawsuit brought by 87 Spanish digital news publishers and news agencies represented by AMI (Asociación de Medios de Información). The case also involved Grupo Europa Press and Radio Blanca as individual plaintiffs.

What: The court ordered Meta to pay €479 million in damages for unfair competition resulting from GDPR violations. Meta obtained competitive advantages by processing Facebook and Instagram user data under an improper legal basis between May 25, 2018 and August 1, 2023, using this information to sell behavioral advertising that Spanish publishers could not compete against.

When: The ruling was issued on November 19, 2025, addressing violations that occurred during the five-year period from May 25, 2018 (when GDPR took effect) through August 1, 2023 (when Meta changed to a consent-based legal framework).

Where: The case was decided in Madrid, Spain, but carries transnational implications across the European Union. Meta earned more than €5.281 billion from online advertising in Spain during the infraction period. Similar lawsuits are pending in France.

Why: Spanish digital publishers argued that Meta's illegal data processing gave the platform unfair competitive advantages in the advertising market. Display advertising shown to readers accessing free news content faced competition from Meta's behavioral advertising based on unlawfully processed personal data collected both from Meta platforms and external websites users visited. This created market distortions that Spanish publishers could not match, resulting in lost advertising revenues.