Grafa logo

Tech

Meta wins procedural victory as EU high court revives WhatsApp fine appeal

Written by Jon CuthbertPublished fev. 10 2026Last Updated fev. 10 2026

Share

The European Court of Justice (ECJ) ruled on Tuesday, February 10, 2026, that WhatsApp Ireland’s legal challenge against the European Data Protection Board (EDPB) is admissible, breathing new life into a five-year battle over a €225 million ($268 million) privacy fine.

The decision sets aside a previous lower-court ruling and refers the case back to the EU General Court to be decided on its merits.

The dispute traces back to 2021, when the Irish Data Protection Commission (DPC) significantly increased a penalty against WhatsApp following a "binding decision" from the EDPB.

The watchdog had intervened to demand more aggressive enforcement regarding how WhatsApp shares user data with other Meta (NASDAQ:META) owned platforms.

While a lower tribunal initially dismissed WhatsApp’s appeal—arguing the company could not sue the EDPB directly because the final fine was technically issued by Irish regulators—the ECJ has now clarified that such "binding decisions" by EU-level watchdogs are indeed open to direct legal challenge by the companies they affect.

This ruling marks a critical turning point for the enforcement of the General Data Protection Regulation (GDPR).

By confirming that the EDPB’s interventions have a "direct concern" for companies, the court has opened a pathway for tech giants to bypass national regulators and challenge the EU’s central privacy authority in Luxembourg.

The General Court will now have to examine whether the EDPB overstepped its authority when it ordered the Irish watchdog to "jack up" the penalty, a move Meta has characterized as a violation of procedural fairness.

The outcome is being closely watched across the technology sector as it defines the power dynamics between national regulators and the central Brussels-based watchdog.

For Meta, the procedural victory provides a rare opportunity to potentially roll back one of the largest fines in GDPR history, even as it faces mounting regulatory pressure on multiple continents, including a simultaneous data-privacy showdown in the Indian Supreme Court.