Case C-454/25 P, Meta Platforms Ireland v EDPB – can an opinion be challenged?
Some of the most consequential documents in EU data protection law are opinions. Meta’s appeal asks whether that label puts them beyond judicial review.
Facts
In April 2024 the European Data Protection Board adopted, under Article 64(2) of the GDPR, an opinion on the “consent or pay” models operated by large online platforms — the choice Meta had offered Facebook and Instagram users in the Union between accepting personalised advertising and paying a subscription. Article 64(2) opinions are requested by supervisory authorities on matters of general application; they are not addressed to any controller and, in law, bind only the authorities that must “take utmost account” of them. Meta brought an action before the General Court for annulment of the opinion and for compensation under Article 340(2) TFEU for the revenue it said it would lose. By order of 29 April 2025 in Case T‑319/24 (ECLI:EU:T:2025:435) the General Court (Tenth Chamber) dismissed the action — the annulment claim as directed against an act not open to challenge, the damages claim as manifestly lacking any foundation in law — without an oral hearing. Meta appeals on four grounds.
Grounds of Appeal
According to the Official Journal notice, the appellant relies on four grounds of appeal.
First, the General Court misinterpreted and misapplied the concept of an act open to challenge under Article 263(1) TFEU, in particular the principles reflected in paragraph 29 of Belgium v Commission (C-16/16 P), and failed to draw the correct conclusions from the interplay between Articles 64(2) and 65(1)(c) of Regulation (EU) 2016/679 (GDPR). The General Court also erred in law in holding that the principle of the autonomy of Union law has no interpretative impact on the conditions of admissibility in Article 263 TFEU.
Second, the General Court misinterpreted and misapplied Article 340(2) TFEU. As regards the ‘damage’ requirement, the loss of revenue was imminent and foreseeable in June 2024 and, in any event, where an applicant requests an injunction in accordance with the case-law arising from Galileo (T-279/03), such as the withdrawal of the Contested Opinion, the infringement of a fundamental right satisfies the condition of damage. As regards the ‘causality’ requirement, the General Court adopted an unduly narrow standard of causality that contravenes the case-law of the Court of Justice and general principles of non-contractual liability common to the Member States.
Third, the General Court exceeded its discretion under Article 126 of the Rules of Procedure of the General Court in violation of the right to effective judicial protection and the right to a fair trial (Article 47(1) and (2) Charter). In particular, the General Court’s sudden dismissal based on the alleged manifest lack of substance of the claim for compensation left the Appellant with no chance to submit evidence to support its claims for annulment and for compensation that postdates the closure of the written procedure.
Fourth, the General Court, in the order under appeal, infringed its duty to state reasons by relying on contradictory and insufficient reasoning.
Sources
OJ notice C/2025/4590 (EUR‑Lex) · Case file on CURIA · Order under appeal, T‑319/24 (ECLI:EU:T:2025:435) · Regulation (EU) 2016/679
Comment
The first ground is the one with a future. The Court’s test for a challengeable act is settled: it must be intended to produce binding legal effects capable of affecting the applicant’s interests. In Case C‑16/16 P, Belgium v Commission (ECLI:EU:C:2018:79) the Court applied that test to a Commission recommendation on online gambling and held it was not challengeable, precisely because a recommendation is by its nature non-binding. Meta invokes the same judgment, and the interest lies in what it draws from it: the argument is not that an Article 64(2) opinion is formally binding, but that its place in the GDPR’s machinery makes it so in substance. Article 65(1)(c) allows the Board to adopt a binding decision where a supervisory authority does not follow an opinion. An authority that departs from the consent-or-pay opinion therefore risks being overruled by the very body that wrote it; one that follows it will apply its terms to Meta in a decision Meta can challenge only nationally, and only after the fact. The opinion is, on this argument, a decision with a delay built in — and the General Court’s finding that it produced no legal effects looked only at the document and not at the mechanism.
The Court has not been receptive to substance-over-form arguments about soft law, and the appeal’s second limb — that “the autonomy of Union law” should shape the admissibility test — is unlikely to move it. But the GDPR’s consistency mechanism is unusual: the Board’s opinions are not guidance a regulator may weigh but the reference point against which a regulator’s own decision may be set aside. If they cannot be challenged directly, the only route to judicial review of the Board’s position on consent-or-pay runs through twenty-seven national procedures, each of which the Board can pre-empt. Whether that is an acceptable system of remedies is a question of Article 47, and the Court may prefer to answer it rather than to leave it.
The remaining grounds are about the way the General Court disposed of the case rather than what it decided. Dismissing a damages claim as “manifestly lacking any foundation in law” under Article 126 of the Rules of Procedure, without a hearing and before the applicant could adduce evidence of a loss that had not yet crystallised, is the kind of procedural economy the Court of Justice reviews reluctantly but does review; if the first ground fails, the third may still send the damages claim back.