EU top court unblocks WhatsApp’s fight against millions in privacy fines

WhatsApp can pursue its challenge against a €225 million privacy fine, the EU’s top court said Tuesday.

The decision opens up a legal avenue for companies to challenge decisions by the European Data Protection Board (EDPB), which gathers data protection authorities from across the EU.

It’s expected to unblock a queue of appeals where the EDPB has overruled a national regulator, and paves the way for WhatsApp’s owner Meta to challenge billions in other privacy fines.

Tuesday’s ruling by the Court of Justice of the EU (CJEU) stems from a 2021 decision by the Irish Data Protection Commission (DPC) to fine WhatsApp €225 million for not being transparent enough with users about what it does with their data.

The Irish privacy regulator had originally proposed a lower fine of €30 million to €50 million, but its peers from across Europe disagreed with how the Irish authority had calculated the fine and ordered Ireland to raise the fine to €225 million.

The top court said Tuesday that decisions by Europe’s board of privacy regulators — which are technically binding on national regulators — are open to challenge by the companies affected.

“The EDPB is an unelected authority whose decisions can directly impact businesses and people across the EU,” a WhatsApp spokesperson said, adding that Tuesday’s decision “upholds our argument that those businesses and people should be able to challenge decisions the EDPB makes against them, so that it can be held fully accountable by the EU courts.”

WhatsApp appealed the EDPB decision in 2021, arguing that the board went beyond its powers when raising the fine amount.

Tuesday’s ruling is the final judgment after years of legal wrangling that previously saw the lower court, the EU’s General Court, throw out WhatsApp’s challenge. Tuesday’s decision affirms an opinion from the top court’s advocate general in March 2025.

In that opinion, the court advisor pointed out that there are at least ten other challenges to board decisions pending before the EU’s General Court, and almost all of them involve Meta.

In its release, the EU’s top court ruled that the EDPB’s decision was of “direct concern” to WhatsApp since it unconditionally bound the Irish privacy regulator, and “brought about a distinct change in the legal position of that undertaking [WhatsApp].”

The case will now go back to the EU’s General Court for a decision on the amount of the fine and whether WhatsApp breached the GDPR.

The EDPB said it “takes note” of Tuesday’s ruling and “stands ready to defend its decision on the merits.”

This story was updated with the EDPB’s reaction to the decision.