- Does this $25 billion fine really affect my company?
- What exactly happened with Meta, and why is it different from previous fines?
- How big is the privacy problem in Italy and Europe?
- What does the 'Pay or OK' model have to do with my company?
- Three concrete scenarios: what changes for an e-commerce, a professional firm, and a manufacturing company?
- Which tools and practices should I compare to get my compliance in order?
- Which rules do I need to know, and which risks do I need to manage now?
- How do I concretely start putting privacy in order across my campaigns?
- What mistakes are most common when managing privacy in digital campaigns?
- How can I tell if my company is truly privacy compliant?
- So, is privacy compliance really worth it for my company?
- How we see it at SHM
- Frequently Asked Questions
- A New Mexico judge ordered Meta to pay $25 billion for 43 million violations of user privacy, with interest at 15% per year until payment.
- Privacy penalties are rising everywhere: in Italy, the Garante adopted 807 measures in 2025 and received 2,415 data breach notifications.
- If you use Meta Ads, check your consents, legal bases for processing and tracking tool setup right away, before an inspection arrives.
$25 billion: that's the amount a New Mexico judge ordered Meta to pay after a jury found 43 million violations of consumer protection laws. If your company uses Meta Ads to collect data or run remarketing, this ruling concerns you too.
Does this $25 billion fine really affect my company?
Yes, even if you're not Meta. Every company that uses Meta platforms to collect data, run remarketing or profile audiences shares part of the responsibility for how that data is processed.
A New Mexico judge ordered Meta to pay $25 billion after a jury found 43 million violations of state consumer protection laws. The penalty is $5,000 per violation and accrues 15% annual interest until actual payment, according to Social Media Today.
For an Italian company, the point isn't paying that fine. The point is that authorities around the world, including the Italian Garante, are watching more and more closely how platforms and their advertisers handle user data. If you use Meta Ads, you're a data controller (meaning you decide why and how data is collected) and you answer for it under the law.
| Your situation | Concrete risk | why |
|---|---|---|
| You use the Meta Pixel on your site without explicit consent | No, for now | Data collection without a valid legal basis: GDPR violation |
| You run remarketing on customer lists uploaded to Meta | Medium | You need to verify that the original consent covers this use |
| You have a compliant cookie banner and documented consents | Yes | Solid legal basis, reduced risk but not eliminated |
| You use the 'Pay or OK' model to access content | No, for now | The EU Commission has already fined Meta over this model |
What exactly happened with Meta, and why is it different from previous fines?
It's not Meta's first fine, but it's the highest ever imposed by an American court for user privacy violations. What's new is that it comes from a jury, not an administrative authority.
The New Mexico ruling differs from European penalties because it stems from a civil trial with a jury. A jury determined that Meta unlawfully exposed user data, and the judge applied a fixed penalty of $5,000 for each of the 43 million violations found. The result is an astronomical figure: $25 billion.
In Europe the path is different, with penalties coming from data protection authorities, but the direction is the same. Over the past two years, Meta has racked up record fines in the Old Continent as well.
The €1.2 billion fine of 2023, imposed by the Irish authority for unlawful data transfers to the US, remains the European record, as reported by Techbusiness. In December 2024 came another fine of €251 million for a breach involving around 29 million Facebook accounts, 3 million of them EU users, according to 2b-advice. In April 2025 the European Commission added €200 million for the 'Pay or OK' model, deemed non-compliant with the principle of freely given consent, as documented in Meta's Form 10-Q filed with the SEC.
How big is the privacy problem in Italy and Europe?
GDPR fines in Europe have surpassed a cumulative €5.88 billion since 2018. Italy ranks fifth by total amount, and the Italian Garante is increasingly active.
According to data published by ICT Business based on the DLA Piper GDPR Fines Survey, total European fines in 2024 came to €1.2 billion, down 33% from 2023. But a lower total doesn't mean less scrutiny: the number of breaches notified every day in the EU rose from 335 in 2023 to 363 in 2024, according to Milano Finanza.
In Italy, the Garante (the Italian data protection authority) adopted 807 measures in 2025, 506 of them corrective or sanctioning, and collected over €37 million in fines, as reported by Legiscope. The signal is clear: the Italian authority is becoming more active, not less.
What does the 'Pay or OK' model have to do with my company?
The 'Pay or OK' model, where users choose between paying or accepting profiling, is under scrutiny both in Europe and in Italy. If you use it on your site or are considering it, you should know that the Italian Garante has opened a specific public consultation.
Here's how 'Pay or OK' works: users who don't want to be profiled have to pay to access the service. The European Commission has already ruled that Meta can't use it because it doesn't guarantee truly free consent. On April 29, 2025, the Italian Garante Privacy launched a public consultation to assess whether this model is compatible with the GDPR and the ePrivacy Directive for other operators too, not just Meta.
This means that if your site uses a paywall tied to consent to profiling, you could be in the spotlight. It's worth checking before a request for clarification arrives.
| Practice | Current status | Risk |
|---|---|---|
| Cookie consent with a free, documented choice | Compliant | Low |
| Cookie banner that blocks the site without consent | Non-compliant | High: already sanctioned by the Garante |
| 'Pay or OK' model to access content | Under review | High: Garante consultation opened in Apr. 2025 |
| Meta Pixel active without prior consent | Non-compliant | High: no legal basis |
| Conversions API with pseudonymized data and consent | Compliant (if set up properly) | Low |
Three concrete scenarios: what changes for an e-commerce, a professional firm, and a manufacturing company?
The risk isn't the same for everyone. It depends on how much data you collect, how you use it and whether you've documented consent. Here are three typical scenarios.
Illustrative examples: numbers are meant to show the reasoning, they are not real customer data.
| Company type | Typical Meta Ads use | Main risk | Priority action |
|---|---|---|---|
| E-commerce (e.g. fashion, furniture) | Pixel across the whole site, remarketing on abandoned carts, customer lists uploaded | High: collects behavioral data without always verifying consent | Cookie banner audit + check of the legal basis for every uploaded list |
| Professional studio (e.g., accountant, lawyer) | Lead generation with forms, lookalike audiences based on current customers | Medium: sensitive data (tax, legal) requires explicit consent | Check that the consent collected in the form covers use on Meta |
| B2B manufacturing company | LinkedIn and Meta campaigns for trade shows and brand awareness, little personal data | Low: professional audience, little end-consumer data | Review of the privacy policy and the record of processing activities |
Which tools and practices should I compare to get my compliance in order?
There's no one-size-fits-all solution. It depends on how exposed you are and how many resources you can commit. Here are the main options compared.
| Tool / Practice | What it does | Indicative cost | Suitable for |
|---|---|---|---|
| Consent Management Platform (CMP) | Manages cookie consent in a documented, verifiable way | From €0 to a few hundred euros/year | All sites with EU traffic |
| Meta Conversions API | Sends conversion data server-side, reducing reliance on the Pixel | Requires technical development (one-time) | E-commerce and sites with many conversions |
| Internal GDPR audit | Maps processing activities, checks legal bases and updates the record | Internal time or a consultant (€500-2,000) | All companies, at least once a year |
| External privacy consultant (DPO) | Oversees compliance on an ongoing basis | From €2,000/year and up | Companies with complex processing or sensitive data |
| Marketing team training | Reduces operational errors in campaign setup | Courses from €200 to €1,000 per person | Teams that run Meta and Google campaigns |
Which rules do I need to know, and which risks do I need to manage now?
The regulatory landscape has become more complex over the past two years. Beyond the GDPR, the Digital Markets Act and the Italian Garante's guidelines come into play.
The GDPR (General Data Protection Regulation) is the baseline rule: every collection of personal data must have a valid legal basis, usually explicit consent or legitimate interest, though the latter doesn't apply to advertising profiling.
The DMA (Digital Markets Act, the EU regulation on digital markets) directly concerns large platforms like Meta, but it has indirect effects on those who use them: if Meta changes its policies to comply, the tools available to advertisers change too.
The issue of watermarks and the identification of AI-generated content, which we explored in our article on AI watermarks in text and what they mean for Italian companies, ties in with this scenario: the more EU digital regulation expands, the more companies need to control every touchpoint with user data.
The question of digital platform compliance has also surfaced in the DSA and online fraud after Booking.com case: European authorities are raising the bar for everyone, not just the tech giants.
How do I concretely start putting privacy in order across my campaigns?
Five steps are enough to get a clear picture of where you stand and know where to act first.
- 1 · Marketing managerMap all data collection pointsList every form, pixel, tag and tracking tool active on the site. Include Meta Pixel, Google Tag, chat tools and CRM.
- 2 · Tech team or agencyCheck the cookie banner configurationConsent must be collected before any tracker fires. Use a certified CMP and test behavior on mobile and desktop.
- 3 · Privacy officer or consultantReview the legal bases for each processing activityAdvertising profiling requires explicit consent. Legitimate interest isn't enough for remarketing campaigns.
- 4 · Marketing managerCheck the customer lists uploaded to MetaEvery list must consist of people who have given explicit consent to the use of their data for advertising on third-party platforms.
- 5 · Privacy officerUpdate the record of processing activitiesDocument each processing activity with its legal basis, purpose, retention period and security measures. It's the first document the Garante asks for in an inspection.
What mistakes are most common when managing privacy in digital campaigns?
The most common mistakes aren't technical but organizational: everything gets delegated to the agency without checking, or the privacy policy gets updated while the technical setup stays untouched.
- Assuming it's only Meta's responsibility. The advertiser is the data controller for the data collected on its own website. Responsibility is shared, not delegated.
- Using the generic consent from the contact form for everything. Newsletter consent doesn't cover using data for advertising on Meta. You need separate, specific consents.
- Not updating your setup after switching platforms. If you change your CRM, e-commerce platform or email marketing tool, your data flows change and need to be rechecked.
- Overlooking employee data in B2B campaigns. Work email addresses are personal data too. LinkedIn and Meta campaigns on professional contact lists require care.
- Not training your marketing team. Whoever sets up your campaigns needs to know what they can and can't do with data. A good-faith mistake doesn't remove your liability.
Data governance also intersects with technology infrastructure. As we saw in our article on the costs of AI data centers and their impact on SMEs, technology choices have a direct effect on how company data is managed and secured.
How can I tell if my company is truly privacy compliant?
There are concrete indicators that show whether your compliance is solid or whether there are gaps to close before an inspection.
| Indicator | Positive signal | Risk signal |
|---|---|---|
| Cookie banner | Certified CMP, consent collected before any tracker fires | Informational banner that doesn't block trackers, or no banner at all |
| Record of processing activities | Updated within the last 12 months, with documented legal bases | Doesn't exist or hasn't been touched in years |
| Customer lists on Meta | Every list has verifiable, documented consent | Lists pulled from the CRM without checking the original consent |
| Privacy policy | Up to date, with specific references to Meta Ads and tracking tools | Generic, with no mention of the advertising platforms in use |
| Team training | The marketing team knows the basic GDPR rules | No specific training in the last 2 years |
| Data breach response | Documented procedure, clear deadlines for notifying the Garante | No procedure defined |
The $25 billion fine on Meta is an extreme case, but the Italian Garante's sanctions in 2025 (807 measures and over €37 million collected, according to Legiscope) show that even ordinary-sized companies are in the crosshairs. The difference between those who get fined and those who don't is often documentation: if you have an up-to-date record and verifiable consent, you start from a much stronger position.
European digital regulation is expanding fast. As we analyzed in our article on the €8.6 million RTB fine and programmatic campaigns, every digital advertising tool comes with specific obligations you can't ignore.
So, is privacy compliance really worth it for my company?
Worth it if you use Meta Ads with the Pixel, remarketing or customer lists, you have a website with European traffic, and you've never run a formal privacy audit. The risk is real, and an audit costs far less than a fine.
Somewhere in between: you already have a CMP and an up-to-date privacy policy, but you've never checked whether your technical setup matches the consents you've collected. A targeted check takes little time and closes the most common gaps.
Not yet if you don't collect personal data from end consumers, you don't use pixels or behavioral tracking tools, and your campaigns are only brand awareness on cold audiences. The risk is low, but an annual review of your privacy policy is still a good idea.
How we see it at SHM
For us, technology is a means, not an end. That goes for advertising tools too: the Meta Pixel, remarketing lists and Conversions API are powerful, but they must be set up with respect for the people on the other side of the screen. It's not just a legal matter. It's a matter of trust.
When we work with companies that use Meta Ads, the first thing we look at isn't ROAS (return on ad spend), but how solid the foundation under the campaigns is: documented consents, a consistent technical setup, an up-to-date privacy policy. A campaign built on poorly collected data is a campaign that will sooner or later cause problems.
If you want to understand where you're exposed and how to get the data governance in your campaigns in order, we can help with a targeted audit. We work on strategic AI and data integration, Meta campaigns set up in line with regulations, and training for company teams that manage complex digital processes. If you'd rather start with a conversation, get in touch.
Frequently Asked Questions
Not directly: the ruling comes from a New Mexico court and concerns Meta as a company. But every advertiser using Meta Ads is a data controller for the data collected on its own website, and answers for it before the Italian Garante and European authorities. The risk isn't the American fine. It's national penalties for anyone whose consents and configurations aren't in order.
First, check that the Pixel fires only after the user has given explicit consent through a compliant cookie banner. If the Pixel is active for all visitors without distinction, you're already violating the GDPR. Use a certified CMP (Consent Management Platform, a tool that manages consents) and test its behavior on mobile and desktop.
It hasn't been definitively declared illegal for all operators yet, but it's under scrutiny. The Italian Garante opened a public consultation in April 2025 to assess its compatibility with the GDPR. The European Commission has already fined Meta over this model. If you use it, now is the time to evaluate alternatives before a ruling arrives.
Yes, but only if every person on the list has given explicit consent to the use of their data for advertising on third-party platforms. Consent to a newsletter or to data processing for generic commercial purposes isn't enough. Check the wording of the original consent before uploading any list.
It depends on how complex your situation is. An audit with an external consultant starts at around €500-2,000 for an SME with a mid-sized website. That's far less than a Garante penalty, which can start at a few thousand euros and reach percentages of annual revenue for the most serious violations.
The agency is a data processor (meaning it acts on your behalf), but the main responsibility stays with you as the data controller. This means that if the agency misconfigures the Pixel or uploads lists without checking consents, you're the one who answers to the Garante. Always sign a data processing agreement (DPA) with your agency and review the setup regularly.
The fine on Meta isn't news about Meta: it's a mirror every company that collects data should look into.
Related articles
Discover more articles exploring similar topics, selected to offer you a more complete and stimulating perspective. Each piece of content is carefully chosen to enrich your experience.
