Two of the biggest ad platforms rewrote their data rules within a week of each other, and European regulators now have a simple question: how high can the fine go?
What changed
Google’s October 16 privacy update quietly added an exception to a promise that has stood since July 2021. The policy still says Google does not show personalized ads based on Drive, Gmail or Photos content, but now adds “unless you choose” to make that data available to other Google services. The help page names Search as the service that may use “summaries, excerpts, generated media, and inferences” from those files, while conceding that a summary “may just be the email or file” in some cases.
Meta’s revised Commercial Terms moved from October 30 to November 20. They would let Meta crawl any website “associated with” a business that uses its products. The earlier language about training AI has gone from the UK preview; the current frame covers advertising and business products plus integrity and security. Section 7 says continued use after an update counts as agreement, so the only real alternative is to stop using Meta for business—which publishers argue is an abuse of market power.
Where the fines could land
No regulator had opened a case as of October 24. But the legal ceilings are clear:
- GDPR: up to 4% of worldwide turnover, or €20 million, whichever is higher.
- DMA: 10% for a first breach and 20% for repeat violations, plus daily penalties.
- Antitrust: up to 10% of worldwide turnover.
- Digital Services Act: up to 6% for very large online platforms.
Against 2025 revenue, a 10% DMA ceiling would be roughly $40.28 billion for Alphabet and $20.10 billion for Meta. Those are legal maximums, not estimates. Real fines have landed far lower; Google’s €890 million DMA penalty was below 1% of Alphabet’s 2025 revenue, and Meta’s €200 million DMA fine was about one-tenth of 1%.
Why this matters to marketers
The bigger risk is product change, not the cheque. EU enforcement has already forced Meta to run less personalised ads, which its filing describes as less relevant and effective. If Google brings Personal Intelligence to Europe, the consent design will determine how many inbox-derived signals ever reach ad selection. The feature launched in the US in January but the worldwide Gemini rollout in April excluded the EEA, Switzerland and the UK, so practical exposure is limited for now.
Both companies posted a quarter of negative free cash flow because AI infrastructure spending jumped—Alphabet at negative $5.9 billion in Q2 and Meta at negative $2.12 billion in Q3. That is not a cash shortage: Meta ended September with $82.45 billion in cash, and Alphabet held $242.5 billion at June 30.
What to do before November 20
If your brand runs a Facebook or Instagram business account, treat November 20 as a compliance deadline. Review the Commercial Terms and get a legal call on continued use. Audit consent flows if you are planning any EU data play, and build first-party data so targeting does not depend entirely on platform signals.
Source: PPC Land
