Meta's consent-for-ads model still falls short, says EU consumer body

The European Consumer Organisation today published a detailed legal analysis concluding that Meta's most recent changes to its advertising consent mechanism for Facebook and Instagram users remain non-compliant with three distinct bodies of EU law. The report, carrying reference number BEUC-X-2026-021 and running to 13 pages, was released on 17 March 2026 and examines the iteration of the user flow that Meta introduced in January 2026 - the fourth version of the system since the company first deployed its so-called pay-or-consent model in November 2023.

The analysis marks a significant escalation of pressure on Meta from organised consumer interests in Europe. According to BEUC, the January 2026 changes still fail to meet the requirements of EU Regulation 2022/1925 - the Digital Markets Act - EU Regulation 2016/679, the General Data Protection Regulation, and EU Directive 2005/29, the Unfair Commercial Practices Directive. Despite some improvements in the latest version, according to BEUC, "most problems remain unresolved."

Background: four iterations in just over two years

The history of Meta's consent mechanism is one of repeated regulatory challenge and incremental adjustment. In November 2023, Meta introduced a binary architecture on Facebook and Instagram. Users in the European Union, the European Economic Area, and Switzerland were presented with two options: pay a monthly subscription to use the services without advertising, or consent to the full processing of personal data for personalised advertising. The subscription was initially priced at €9.99 per month via web and €12.99 per month on iOS and Android.

That design drew immediate criticism. According to BEUC, in November 2023 the organisation and 19 of its member groups filed a complaint with the Consumer Protection Cooperation Network, the CPC-Network, citing possible infringements of EU consumer law. In February 2024, BEUC coordinated complaints by national member organisations to data protection authorities across several EU member states, reporting GDPR breaches. The complaints covered organisations from Bulgaria, the Czech Republic, Denmark, France, Greece, Italy, Latvia, Lithuania, the Netherlands, Norway, Poland, Slovakia, Slovenia, Spain, Sweden, and Luxembourg.

The European Commission moved in April 2025, imposing a €200 million fine on Meta and finding the November 2023 binary model non-compliant with the DMA. That enforcement action - the first of its kind under the DMA - covered the period from March 2024, when DMA obligations became legally binding for designated gatekeepers, through November 2024. Meta subsequently appealed the Commission's decision in July 2025.

Meta had already moved ahead of the fine by amending the user flow in November 2024. That version introduced a second layer of choice: users who selected the "ads option" could then choose between a "personalised ads" path and a "less personalised ads" path, the latter using substantially less data. At the same time, Meta reduced the subscription price for the no-ads option by 40%, from €9.99 to €5.99 per month on web and from €12.99 to €7.99 on iOS and Android. Yet the November 2024 version raised fresh concerns. According to BEUC, the "less personalised ads" option was presented later in the user flow with unclear and non-neutral language, and the interface design gave users the impression that subsequent steps were less consequential. BEUC raised those concerns with competent authorities in January 2025.

Under threat of periodic penalty payments from the Commission, Meta made further minor changes in June 2025 and then a more substantive revision in January 2026. It is this January 2026 version - tested by BEUC on an Android Pixel 9a device on 28 January 2026 - that the organisation's latest report assesses in detail. Meta itself filed its third annual DMA compliance report on 6 March 2026, offering a contrasting account of the same consent architecture.

The DMA assessment: structural problems persist

The DMA imposes a specific and demanding framework on so-called gatekeeper companies, a category that includes Meta. Under Article 5(2) of the regulation, Meta must obtain user consent as defined by the GDPR before using personal data gathered from third parties for advertising purposes. Users must be offered a less personalised but genuinely equivalent alternative. Crucially, that alternative must not be of degraded quality, and Meta cannot design its interfaces in ways that deceive, manipulate, distort, or impair the ability of users to freely give consent. Article 13 DMA expressly prohibits behavioural techniques and non-neutral interface design. Article 8 requires Meta to be able to demonstrate compliance.

According to BEUC's analysis, Meta's January 2026 user flow fails on several of these specific requirements. The first structural defect concerns the placement of the "less personalised ads" option within the flow. The option is not presented upfront, on the same level as the "no ads" option or the "personalised ads" option. Users can select the "no ads option" at the first step without being shown the "less personalised ads" option or being given sufficient information about it. This matters because the Commission itself, in its April 2025 decision, declared the binary first-screen choice between a "no ads option" and an "ads option" non-compliant with the DMA. Yet, according to BEUC, the January 2026 version retains that binary first screen.

The second structural defect concerns the nature of the choice architecture. According to the report, by positioning the fundamental choice - between personalised and less personalised advertising - later in the flow, Meta creates the impression that the critical decision is the first one. In fact, the DMA-relevant choice is the one between personalised and less personalised advertising. This sequencing, BEUC argues, is likely to distort users' decision-making.

Third, and notably, BEUC finds that Meta imposes ad breaks on users who opt for the less personalised ads experience - interruptions that do not affect those who choose full personalised advertising. According to the report, "it cannot be argued that the degradation of service is a direct consequence of its inability to process users' personal data, as the unavailability of certain data does not require the addition of ad breaks." This matters because Recital 37 DMA specifically states that the less personalised alternative must not be of degraded quality.

A fourth technical concern involves status quo bias as a behavioural design technique. Meta sets the default option in the new flow based on whatever choice the user made in the previous iteration. Since most users who went through earlier flows likely never reached the screen presenting the choice between personalised and less personalised advertising - in part because those flows included a misleading intermediate "all set" screen that the latest version has removed - the effective default for a large share of users is personalised advertising. The report states that "this behavioural technique provides an interface design which is non-neutral, thus undermining effective compliance with DMA obligations."

A fifth point concerns the ease of revisiting choices. According to BEUC, the January 2026 design uses separate tabs for the two distinct choices - the choice between the "ads option" and "no ads option" on one tab, and the choice between personalised and less personalised advertising on another. This structure makes the latter choice less salient and harder to find. Finally, BEUC notes that Meta has provided no evidence of user testing for neutrality, which means the company cannot currently demonstrate compliance under Article 8 DMA.

The DMA analysis does not stand alone. The GDPR imposes its own requirements on consent, and those requirements apply even when consent is given in the context of a DMA-relevant user flow. According to BEUC, the January 2026 flow fails under three GDPR heads: data minimisation, informed consent, and freely given consent.

On data minimisation, BEUC refers to the Court of Justice of the European Union's decision in Case C-252/21, Meta Platforms and Others v Bundeskartellamt, which clarified that controllers must not engage in personalised advertising without restriction as to the quantity, time, and type of personal data collected. A parallel CJEU case, C-446/21, Schrems v Meta, reinforced this position. The European Data Protection Board's opinion of April 2024 on consent-or-pay models noted that the magnitude and intrusiveness of data processing must be taken into account when assessing compliance with data minimisation principles. According to BEUC, the information Meta provides about what is actually processed under the less personalised option is "vague," and it remains unclear whether the underlying processing operations comply with GDPR requirements.

The informed consent problem, according to BEUC, is more substantive. The CJEU in Case C-61/19, Orange Romania v ANSPDCP, clarified that consent information must be clear, unbiased, and enable the user to gain a genuine understanding of the processing operations they are agreeing to. Throughout Meta's January 2026 user flow, the "personalised ads" option is described only in positive terms. The flow presents descriptions of the benefits of personalised advertising - product discovery, relevant brands - but contains no mention of Meta's cross-platform tracking infrastructure or the commercial processing operations that occur in the background. The EDPB's April 2024 opinion uses explicit language on this point: controllers have a duty to inform users of processing activities that run in the background and of which they may not be aware. According to BEUC, Meta's use of the phrase "free of charge" in its interface is also misleading, since the advertising model is built substantially on commercial exploitation of user data rather than being genuinely free.

On freely given consent, BEUC returns to the degraded-service issue. The DMA and GDPR, read together through the lens of joint European Commission and EDPB guidance, require that the less personalised alternative be equivalent in performance, experience, and conditions of access to the service offered to consenting users. According to the report, Meta fails this equivalence test on three specific interface design points visible in the January 2026 screenshots reproduced in the analysis. The phrase "Your ads will be less related to your interests" frames the privacy-protective option as a worse experience. The phrase "Your browsing may be paused by ad breaks" signals sub-optimal performance. And the phrase "Your ability to advertise and monetize with ads will be limited" implies restricted access to platform functionality. Taken together, BEUC concludes, this framing nudges users toward accepting full tracking by presenting the privacy-preserving option in consistently negative terms.

Unfair Commercial Practices Directive: the "free of charge" problem

A third legal dimension concerns EU Directive 2005/29, the Unfair Commercial Practices Directive. Meta's interface, in its January 2026 form, continues to use the phrase "use free of charge with ads." BEUC argues this remains a misleading commercial practice under Article 6 of the UCPD. The Commission's own guidance document from December 2021 states that presenting products as "gratis," "free," or "without charge" when the consumer pays something other than the unavoidable cost of responding to the commercial practice is "in all circumstances considered unfair." Since the advertising model is commercially funded by the processing and exploitation of user data, BEUC maintains that describing the service as free is inherently misleading.

This question is now also before the courts at the highest level. In September 2025 the German Federal Court of Justice, the Bundesgerichtshof, referred a question to the CJEU asking whether advertising online services as "free" while commercially exploiting user data misleads consumers under the UCPD. A ruling is expected within the coming months.

Separately, the Consumer Protection Cooperation Network coordinated action against Meta's subscription model, launched by France's Direction Générale de la Concurrence, de la Consommation et de la Répression des Fraudes in November 2023, remains ongoing as of the date of BEUC's report. According to BEUC, this coordinated enforcement effort had not concluded by early 2026, despite starting more than two years earlier.

What BEUC is asking authorities to do

The report closes with specific calls to three distinct sets of authorities. First, BEUC calls on the European Commission to impose periodic penalty payments on Meta under Article 31 of the DMA, a mechanism it describes as the appropriate tool to bring Meta into compliance urgently. Second, it calls on the CPC-Network to conclude its coordinated action and ensure full compliance with the EU consumer law acquis. Third, it calls on data protection authorities to continue their investigations into Meta's data collection practices under the GDPR and to issue decisions promptly.

The report does not represent an isolated intervention. The broader regulatory and litigation environment surrounding Meta's advertising data practices has intensified sharply since 2023. A Madrid court in November 2025 ordered Meta to pay €479 million to 87 Spanish digital publishers for competitive advantages obtained through unlawful data processing. German courts in February 2026 awarded €1,500 per plaintiff in four parallel proceedings for GDPR violations through Meta's Business Tools. An Austrian court in November 2025 granted Max Schrems comprehensive access to his Meta data after more than a decade of litigation. The EDPB and European Commission published over 100 responses to their draft DMA-GDPR joint guidelines earlier this month, with final rules expected later in 2026.

Why this matters for the marketing community

For advertisers and marketing professionals operating in European markets, the prolonged regulatory dispute over Meta's consent architecture has direct operational consequences. The entire European advertising targeting model on Facebook and Instagram now runs on a consent basis. Users who have not consented to full data processing receive less personalised advertising, which initial industry estimates suggested delivered 70% fewer onsite conversions and 61% fewer offsite conversions compared to personalised advertising. The proportion of European users on each path - and the validity of the consent underlying the personalised path - depends directly on how these legal disputes are resolved.

If periodic penalty payments are ultimately imposed by the Commission, Meta would likely be compelled to redesign the consent flow in ways that surface the less personalised option more prominently and remove the ad-break penalty. That structural change would, by the logic of the conversion impact estimates, shift a larger share of European users onto the lower-performing personalised targeting path - or onto no personalisation at all. Meta's advertising performance for European campaigns would be affected accordingly.

BEUC is the umbrella group for 42 independent consumer organisations from 31 countries, founded in 1962, and represents member organisations from all 25 EU member states as well as Albania, Iceland, North Macedonia, Norway, Switzerland, and the United Kingdom.

Timeline

2019 - German competition authority Bundeskartellamt prohibits Meta from combining personal user data from different sources without consent, providing the regulatory foundation for subsequent DMA provisions.
4 July 2023 - Grand Chamber of the CJEU rules in Case C-252/21 that dominant companies can obtain valid consent through choice between subscription and personalised ad-supported service.
September 2023 - European Commission designates Meta as a gatekeeper under the Digital Markets Act.
October 2023 - Meta announces its pay-or-consent subscription model, priced at €9.99/month (web) and €12.99/month (iOS/Android).
November 2023 - Meta rolls out the binary pay-or-consent mechanism on Facebook and Instagram. BEUC and 19 member organisations file complaint with the CPC-Network. Details covered by PPC Land.
February 2024 - BEUC coordinates GDPR complaints by member organisations to national data protection authorities across eight countries.
March 2024 - DMA obligations become legally binding for designated gatekeepers.
17 April 2024 - EDPB adopts Opinion 08/2024 on the validity of consent in consent-or-pay models. Meta files legal challenge against the opinion on 27 June 2024.
November 2024 - Meta amends user flow to introduce a three-way choice including a "less personalised ads" option. Subscription price reduced by 40% to €5.99/month (web) and €7.99/month (iOS/Android). Covered by PPC Land.
January 2025 - BEUC raises concerns about the November 2024 user flow with competent authorities.
23 April 2025 - European Commission fines Meta €200 million for DMA non-compliance related to the November 2023 binary model. Covered by PPC Land.
2 July 2025 - Meta formally appeals the Commission's €200 million decision. Covered by PPC Land.
June 2025 - Meta introduces minor changes to user flow under threat of periodic penalty payments.
25 September 2025 - German Federal Court of Justice refers question to CJEU on whether advertising services as "free" while exploiting user data misleads consumers under the UCPD.
19 November 2025 - Madrid court orders Meta to pay €479 million to Spanish publishers for GDPR advertising violations. Covered by PPC Land.
January 2026 - Meta introduces fourth iteration of consent-for-ads user flow, tested by BEUC on an Android Pixel 9a device on 28 January 2026.
3 February 2026 - Dresden Higher Regional Court awards €1,500 per plaintiff to four users for Meta Business Tools tracking violations. Covered by PPC Land.
6 March 2026 - Meta submits its third annual DMA compliance report to the European Commission. Covered by PPC Land.
13 March 2026 - European Commission and EDPB publish over 100 responses to draft joint DMA-GDPR guidelines. Covered by PPC Land.
17 March 2026 - BEUC publishes report BEUC-X-2026-021, "Users still stuck in the mud," finding Meta's January 2026 consent-for-ads mechanism non-compliant with the DMA, GDPR, and UCPD.

Summary

Who: BEUC - The European Consumer Organisation, an umbrella group representing 42 independent consumer organisations across 31 countries, founded in 1962 and headquartered in Brussels. The report's findings address Meta Platforms as the subject of the analysis, and call on the European Commission, the Consumer Protection Cooperation Network, and national data protection authorities to act.

What: BEUC today published a 13-page legal analysis, reference BEUC-X-2026-021, finding that Meta's January 2026 update to its consent-for-ads mechanism on Facebook and Instagram still fails to comply with the Digital Markets Act, the GDPR, and the Unfair Commercial Practices Directive. Specific failures identified include the structural positioning of the less personalised ads option within the user flow, the imposition of ad breaks as a penalty for choosing less data processing, the use of behavioural techniques including status quo bias, non-neutral language that frames the privacy-protective option negatively, and inadequate information disclosure about underlying data processing operations.

When: The report was published on 17 March 2026 and examines a user flow that Meta introduced in January 2026, itself the fourth iteration of a mechanism that originated in November 2023.

Where: The mechanism operates across Facebook and Instagram in the European Union, the European Economic Area, and Switzerland. BEUC conducted its testing on an Android Pixel 9a device in January 2026. The organisation is based in Brussels.

Why: Despite two and a half years of regulatory pressure, a €200 million fine, multiple court rulings across European jurisdictions, and three previous redesigns, BEUC concludes that the fundamental problems with Meta's consent architecture have not been resolved. The organisation argues that users still cannot freely provide valid consent under EU law because the design of the interface systematically steers them toward accepting full data processing, the less personalised option is presented as an inferior experience, and the information provided about data processing operations is insufficient for genuinely informed consent.