The EU Holds a Regulatory Kill Switch to the Attention Economy
Or how the EU is on the cusp of killing Facebook and Instagram.
Less than one year into the second Trump term, we can see how the marriage between technocapitalism and American politics has been hugely favorable for BigTech and the country’s “homegrown AI” sector. Stock valuations and VC investments in AI are soaring. Apple CEO Tim Cook recently handed Trump a custom-made Apple plaque of 24-karat gold engraved with the President’s name and the text "Made in America", following the announcement of Apple’s new $100 billion investment in domestic manufacturing, on top of the $500 billion Apple has already committed.
Trump is a social media-kind-of President, seemingly crafted for the age of attention. His entertaining character and rhetorical style are a perfect match for the short-form video format, news headlines, trending social media posts, and virality in all its shades. If anything, Trump knows how to garner attention, good or bad attention - it doesn’t matter – because whoever gets people talking in the attention age, wins big.
While traditional allies of the US could dismiss Trump's first term as a one-off blunder, the second Trump term solidifies the fact that we live in a new era. An era where attention is the most valuable currency. An era that has been created by American BigTech and is defined by its lack of consistency or any pretense of order and structure. Moral values, community, real connections between people, and societal institutions that used to provide people with a sense of identity and belonging are sucked into a vortex where everything constantly changes form, and nothing matters besides the price on your attention.
Europe has been accused, for instance, in JD Vance’s keynote address at the 2025 Munich security conference, of suppressing free speech by censoring social media posts that express controversial viewpoints, false claims, or defamatory statements. Interestingly, the alternative to social media censorship appears to be worse. If people’s attention can be bought and sold without moderation, it opens the door to fascist propaganda and authoritarian control. Jason Stanley described this phenomenon in his book “How Propaganda Works” (2016).
“There is a simple and compelling argument, known since Plato, which would lead us to expect that even apparently robust liberal democracies are such in name only. The argument is as follows. A certain form of propaganda, associated with demagogues, poses an existential threat to liberal democracy. The nature of liberal democracy prevents propagandistic statements from being banned, since among the liberties it permits is the freedom of speech. But since humans have characteristic rational weaknesses and are susceptible to flattery and manipulation, allowing propaganda has a high likelihood of leading to tyranny, and hence to the end of liberal democracy.”
In this way, freedom of speech, an important democratic right, can ironically lead to the end of democracy.
The EU is facing a stark choice. On one hand, Europe’s territorial borders are threatened by Russian expansion, and it currently relies on the US for defense. On the other hand, we can safely say that the transatlantic partnership is no longer what it once was. President John F. Kennedy said about the EU in 1962, "The United States looks on this vast new enterprise with hope and admiration. We do not regard a strong and united Europe as a rival, but a partner”. In 2025, Trump told reporters, "Look, let's be honest, the European Union was formed in order to screw the United States. That's the purpose of it, and they've done a good job of it. But now I'm president."
From a European perspective, the dependency on American information technology is not the convenience it once was but more of a liability. Namely, the American social media platforms that serve the interests of BigTech are an existential threat to the EU’s data sovereignty, strict data privacy laws, and constituent limitations on free speech. Either the EU pushes back with the means that it has, or it must accept that the Charter of Fundamental Rights of the European Union is most valuable as training fodder for American AI models.
If the EU wants to set itself free from the attention economy, once and for all, it must ban targeted advertisement. I am not saying that it would be the right thing to do – necessarily - but in my view, it is the strongest leverage the EU has against Trump. Banning targeted advertisement would hurt American BigTech, but align with the principles of GDPR, free European citizens from foreign surveillance and manipulation, and effectively put an end to the attention economy in Europe.
In my paid analysis below, we shall see how the EU is moving slowly but steadily to a ban on targeted advertisement, with a focus on the regulatory measures against Meta. With ownership of Facebook and Instagram, Meta is the dark beating heart of the attention economy. The company disclosed in its earnings report from Q2 2025 that it earned $46.56 billion from selling ads, corresponding to 98% of its total revenue. Meta’s ads sale is based on an extensive user surveillance that - I have reason to believe – is irreparably violating European laws and ethical principles.
If the EU started to uphold the GDPR strictly and mercilessly against the American tech giants, I believe that Facebook and Instagram would no longer be able to operate in Europe. Other American tech giants would be in serious trouble too. Most obviously, Alphabet, the parent company of Google and YouTube, which earned approximately $71.3 billion from ads in Q2 2025, about 74% of its total quarterly revenue, based on targeted advertisement and some degree of user surveillance.
In the following sections, we will look at Meta’s regulatory issues in the EU regarding targeted advertisement and see how the situation is escalating towards a defining stalemate between the values of Meta and the EU.
Meta’s “Forced Consent”
On May 25, 2018 - the day GDPR entered into effect – noyb, the independent privacy watchdog founded by Austrian privacy activist Max Schrems, filed four complaints against Google, WhatsApp, Facebook, and Instagram over the platforms' use of “forced consent”.
The legal issue explained in a nutshell: All four platforms required users to agree to their entire privacy policy and terms of service as a condition for gaining access to their services. Technically, GDPR does allow “the performance of a contract” (Article 6 (1) (b)) as a legal basis for data processing, but this provision has to be interpreted narrowly. noyb referred to a report from 2014 by the EU’s independent advisory body on data protection and privacy, Article 29 Data Protection Working Party (now replaced by the European Data Protection Board), which made it clear that Article 6 (1) (b):
“is not a suitable legal ground for building a profile of the user’s tastes and lifestyle based on his click-stream on a website and the items purchased. This is because the data controller has not been contracted to carry out profiling, but rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract.”
When users signed up to Google, WhatsApp, Facebook, and Instagram, they were forced to agree to behavioral analysis and targeted advertisement as necessary contractual conditions, but cf. the Article 29 Data Protection Working Party’s guidance, this was not allowed.
On January 4, 2023, the Irish Data Protection Commissioner (DPC) issued a €390 million fine to Meta - €210 million for Facebook's violation and €180 million for Instagram’s violation. Google was issued a fine of €50 million by the French data authority CNIL on similar grounds, and WhatsApp was fined only €5.5 million by the DPC because it relies much less on personalized ads. The fines came with a prohibition to the platforms for relying on the “performance of a contract” in Article 6 (1) (b) as a legal basis for processing data about users for profiling and targeted advertisement. Six months later, the European Court of Justice (CJEU) reached the same conclusion in Case C-252/21 Bundeskartellamt, underlining that Meta’s use of data for personalized advertisement must be based on “consent” (Article (6) (1) (a)) as the legal basis, not “the performance of a contract” (Article (6) (1) (b)) or “legitimate interest” (Article (6) (1) (f)).
As one would expect of Meta, it refused to accept the European regulators' demands with a bowed head and didn’t immediately change its practice. Users were still required to accept all its terms of service to use Facebook and Instagram. In the wake of CJEU’s decision in Case C-252/21, the Norwegian data authority ordered Meta to temporarily suspend targeted advertisement in the country for three months, or face fines of up to one million Norwegian kroner (about $100,000) per day. Meta still refused to comply. The Norwegian data protection authority forwarded the matter to the European Data Protection Board (EDPB).
On October 27, 2023, the European Data Protection Board (EDPB) adopted an urgent binding decision in accordance with GDPR Article 66 (2) to impose a temporary ban on Meta's processing of personal data for “behavioural advertising” without a sufficient legal basis. The ban would have effect in the entire European Economic Area (EEA) (the EU member states + Iceland, Liechtenstein, and Norway). Finally, Meta was forced to react.
Starting in November, 2023, users in the EEA-area over the age of 18 have been offered paid versions of Facebook and Instagram without advertisement, currently for a monthly subscription price €5.99 on the web, €7.99/month on iOS and Android, and €4 and €5 for each additional account on the web and iOS/Android respectively.
The Data Used for Targeted Advertisement
We have now established that Meta’s processing of personal data for the purpose of targeted advertisement needs to be based on the explicit consent of users in the EU. The pay or consent model, which Meta is still using today, presumes that consent is a binary choice between either accessing a service or not accessing it. That is, unfortunately for Meta, not how the CJEU sees it.
In relation to another case against Facebook filed by Max Schrems, the Oberster Gerichtshof (Supreme Court of Austria) requested a preliminary ruling from the CJEU about the scope of consent for targeted advertisement (C-446/21). The facts of the case concerned that Schrems regularly received advertising targeted at homosexuals on Facebook, even though he had never posted about his sexuality or given any indication thereof. Nonetheless, Meta had inferred that Schrems was gay through third-party cookies and so-called social plug-ins, which allow users to like, share, comment, and send Facebook posts to friends through other websites. Additionally, Meta could draw inferences about Schrems from his friends list, which would show that he did civilian service with the Red Cross in Salzburg and was homosexual. Meta even held a list of Schrems activities outside Facebook, which included dating apps and dating websites for homosexuals, and a website of an Austrian political party. All of this sensitive information was stored without a time limit.
A key question in the case was whether Meta could legally store this data for an unlimited period of time and use it for the purpose of targeted advertisement based on Schrems’ consent alone?
The CJEU ruled that it could not. The data processing violated GDPR’s data minimisation principle in Article 5 (1) (c), which states that personal data shall be “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed”. Even with the users’ consent, Meta did not receive carte blanche for processing sensitive data about the data subject (Article 9 (1)) or store personal data about social media users for an unlimited period of time. According to the CJEU, such processing must be considered “a disproportionate interference in the rights guaranteed (..) by the GDPR”.
To sum up, targeted advertisement should be limited in scope and duration, even if the user consents to the data processing.
Meta’s Pay or Consent Model
To accommodate the CJEU’s demands, Meta began offering a new option to free users of Facebook and Instagram from November 2024, “with less personalized ads," which would “use significantly less data to show ads, so ads may be less relevant to a person’s interests.” Phrased in this way, it does sound peculiar that free users of Facebook and Instagram would prefer to see less relevant ads. The frustration of Meta’s lawyers is palpable in the announcement. As they see it, Meta has bent over backwards in an attempt to satisfy the demands of European regulators. First, by offering an ad-free version of its services, and then by giving users the option of seeing less personalized advertisements. In Meta's words, "these significant changes (..) goes beyond what is required in the law”. “Now the European legislators must finally be satisfied?” I imagine lawyers at Meta ask disgruntled and disheartened from dealing with so much vicious bureaucracy outside the land of Trump.
The truth is, however, that Meta’s pay or consent model is most likely unworkable under European data laws. The EU Commission fined Meta €200 million in April 2025 because the pay and consent model did not comply with the Digital Markets Act (DMA) between March 2024, when the model became binding, and November 2024, when Meta updated it to include an option with less personalized ads (the full decision is available here).
The November 2024 change, which applies in the EU today, is currently being assessed by the EU Commission for compliance with DMA. People with direct knowledge of the matter told Reuters last month that Meta is very unlikely to offer further changes to its pay or consent model, which will “almost certainly” lead to new charges. Under the DMA, fines for non-compliance can reach as much as 5% of a company's average daily worldwide turnover.
In my view, Meta and the EU regulators are reaching a critical junction that shows a fundamental difference in values. Meta insists that its current model complies with the DMA. The EU Commission emphasizes that the cost-free versions of Facebook and Instagram are not equivalent to the ad-free versions, for the simple reason that users need to pay. The only way that Meta could comply with the DMA is to offer a free version of Facebook and Instagram that is also free of targeted advertising. Only under those circumstances would users be given a free choice.
As an alternative to targeted advertisement, Facebook and Instagram could apply non-targeted advertisement. However, that would be detrimental to the user experience since ads would then appear on feeds at random, generally be much less relevant, and ultimately generate fewer clicks and revenue for advertisers. Another way to go would be if Meta complied with the EU Commission's demands and created cost-free, ad-free alternatives to their two social media services. But if users had a legitimate option to use Facebook and Instagram without targeted advertisement, how many would prefer to use them with? Chancers are not that many. Meta would be prevented from profiting on those users, undermining the business model completely.
Closing Thoughts
Privacy is considered a fundamental human right in the EU, on par with freedom of speech. In the US, privacy has traditionally not been granted the same weight and emphasis, and that is why Facebook and Google have managed to grow so monstrously big. I don’t think this conflict in values between the EU and the US has ever been confronted head-on. But unless the EU takes the unlikely route of submitting to MAGA like Apple CEO Tim Cook and neglects its founding values, a confrontation is inevitable. The pressure BigTech currently faces to conform to European values is becoming more and more tangible.
Just last month, a German court ordered Meta to pay €5.000 to a Facebook user for tracking him on third-party websites via cookies. A court in Brussels recently ruled that tracking-based advertising by Google, Microsoft, Amazon, and X, across Europe, has no legal basis. The Digital Services Act already prohibits showing targeted advertisements to minors (Article 28 (2)). The success of American BigTech hinges upon what would be considered privacy infringements in the EU. Meta claims that “personalized advertisement (..) will always be the cornerstone of a free and inclusive internet”. We will see.