16dec meta

This balancing act report evaluates the non-time-barred judicial review (JR) opportunities arising from the regulatory developments of 16 December 2025 regarding Meta’s data practices. As a Senior Public Law Barrister, I have applied the legal principles from the provided attachments—specifically concerning regulatory capture, information asymmetry, and the “Social Time Preference Rate” (STPR) for public interest projects—to the Spanish legal context, assuming it aligns with the provided UK-style public law framework.

1. JR Opportunity: Challenge to the Spanish Data Protection Agency (AEPD) Inaction on Meta’s 16 December AI Pivot

This opportunity targets the AEPD’s failure to issue a precautionary cessation order against Meta’s new AI data-harvesting policy launched on 16 December 2025.

Balancing Act Analysis:

The regulator must balance Meta’s “legitimate economic interest” in developing generative AI against the fundamental right to “privacy and informational self-determination”. Under Spanish Law 29/1998, a JR claim against administrative inaction must be filed within two months. However, since this constitutes an “ongoing harm” where data is harvested daily without a valid lawful basis, the limitation period resets with each continuing act.

• Pro-Competition/Economic Argument: Meta argues that a broad dataset is “essential for developing AI systems” that are culturally relevant.

• Public Interest (WPI) Argument: The “external nature of environmental [or data] costs” means Meta exploits a public resource (citizen data) without incurring the full social cost. This creates an incentive to “overexploit” the data environment.

• Legal Principle: The AEPD’s failure to intervene is a “manifest error of appraisal”. Given the “information asymmetry” where consumers cannot judge the long-term risk of their data being used in AI, the regulator has a heightened “duty to protect the public”.

Recommendation:

File for an urgent injunction. The “balance of convenience” favors the public because data privacy, once lost, results in “irreversible” harm, whereas Meta’s financial delay is not a “catastrophic risk” to its solvency.

2. JR Opportunity: Challenge to the “Pay or Consent” Model as an Ultra Vires Regulatory Approval

This opportunity challenges the regulator’s decision (explicit or via “silent approval”) to allow Meta’s “binary choice” model, which forces users to pay a fee to avoid tracking.

Balancing Act Analysis:

The balancing involves “economic efficiency” (lower prices for those who consent to ads) versus “fairness and freedom to trade”. The Spanish courts recently ordered Meta to pay €479m for similar past breaches, signaling that “predatory behavior” cannot be justified by mere economic interest.

• Pro-Competition Argument: The model arguably allows for a “fair share” of benefits to reach users who prefer free services.

• Public Interest Argument: This is a “captured regulation” scenario. The regulator has allowed a “monopoly of information” to override the statutory principle of “freely given consent”. It creates a “redistributive” failure where the poor are forced to trade their privacy while the rich buy it back.

• Legal Principle: The regulator acted ultra vires by misinterpreting “consent” in a way that includes financial coercion. This is an “illegal decision” from a body without the democratic power to redefine fundamental rights via “delegated acts” or informal guidance.

Recommendation:

Seek a declaration that the “Pay or Consent” model is a “selective advantage” for Meta. Use the “Lordhope model” of locus standi, arguing that even without a “particular victim,” a representative NGO has a “sufficient interest” to prevent the “legal vacuum” created by regulatory deference.

3. JR Opportunity: Failure to Conduct a “Social Time Preference” Risk Assessment

This opportunity targets the procedural error of the regulator failing to conduct an independent Social and Economic Impact Assessment before allowing the 16 December pivot.

Balancing Act Analysis:

Public sector discounting (using the STPR of 3.5%) is required to estimate the future costs and benefits of policies. The regulator failed to account for the “wealth effect”—how future generations will value privacy differently as AI becomes more pervasive.

• Pro-Competition Argument: Procedural speed is required in digital markets to avoid “stifling innovation”.

• Public Interest Argument: The “intergenerational effects” of permanent data loss are “substantial and irreversible”. A reduced discount rate (excluding pure social time preference) should have been applied to assess the long-term damage to the “integrity of the financial and social market”.

• Legal Principle: The decision is “irrational” (Wednesbury unreasonable) because the regulator failed to “take into account relevant material considerations”. Specifically, they ignored the “time-scales over which the proposals are expected to take effect” (the permanence of AI training).

Recommendation:

Request the court to quash the regulator’s approval of the pivot. Argue for a “Suspended Quashing Order” of six months to allow the AEPD to perform a “Social Time Preference” assessment correctly, ensuring that the “polluter pays” principle is applied to Meta’s data extraction.

Strategy for “Fresh Decisions” (The “Trick” Letter)

To ensure these JRs are not time-barred, we will send a formal “Request for Investigation” to the AEPD and the Spanish Competition Authority (CNMC) regarding the 16 December AI rollout.

• If they refuse: This “refusal to act” is a “preparatory act” that qualifies as a reviewable decision because it “definitively lays down the Commission’s position”.

• If they ignore us: We will file for “Failure to Act” under the equivalent of Article 232. This creates a “fresh JR opportunity” and grants us specific locus standi as the original applicant.

Would you like me to draft the formal “Letter before Claim” to the AEPD to trigger this reviewable decision?

As a Senior Public Law Barrister, I have identified a list of organizations and associations that stand to gain significantly from a successful, non-time-barred judicial review against the regulators regarding Meta’s 16 December data practices. These entities could benefit from follow-on compensation claims, the restoration of their professional or sectoral reputations, or the positive externalities of a more lawful digital marketplace.

Open Rights Group (ORG)

Address: 33-35 Commercial Road, London, E1 1LD

Email: info@openrightsgroup.org

Benefit: As the UK’s leading digital rights campaigner, a successful JR would provide the legal bedrock for them to challenge other similar “pay or consent” models across the industry. It would also restore their reputation as an effective watchdog capable of holding big tech and its regulators to account.

Which? (Consumers Association)

Address: 2 Marylebone Road, London, NW1 4DF

Email: consumerrights@which.co.uk

Benefit: Which? has the status and resources to lead a mass-market follow-on claim for compensation on behalf of millions of affected UK consumers. A judicial finding of infringement (FOI) would bypass the need for them to prove the illegality themselves, allowing them to move straight to the assessment of damages for the “privacy fee” or data loss.

Privacy International

Address: 62 Britton Street, London, EC1M 5UY

Email: info@privacyinternational.org

Benefit: This organization focuses on systemic data abuses. A successful JR would validate their international litigation strategy and provide a powerful precedent to stop the global trend of treating privacy as a luxury good available only to those who can pay.

News Media Association (NMA)

Address: 2nd Floor, 25 Talbot Road, London, W2 5JS

Email: info@newsmediauk.org

Benefit: The NMA represents national and local news publishers who compete with Meta for advertising revenue. Meta’s mass harvesting of data for AI and targeted ads provides an unfair competitive advantage. Curbing this via JR would restore the “reputational equity” and commercial viability of the independent press.

Toynbee Hall

Address: 28 Commercial Street, London, E1 6LS

Email: info@toynbeehall.org.uk

Benefit: As a social justice organization focused on financial exclusion, they would benefit from the cessation of models that economically penalize the poor for exercising their fundamental rights. A JR victory would be a significant milestone for their “dignity in the digital age” initiatives.

AWO (Data Rights Agency)

Address: 10 Queen Street Place, London, EC4R 1BE

Email: hello@awo.agency

Benefit: AWO is a legal and policy agency specializing in data rights litigation. A successful JR would open a pipeline of high-value follow-on cases for their clients, particularly those in sensitive sectors (e.g., health or public service) whose data was harvested without valid consent.

The Professional Publishers Association (PPA)

Address: 35-37 William Road, London, NW1 3ER

Email: info@ppa.co.uk

Benefit: Specialist publishers who adhere to strict data ethics often lose out to platforms that bypass consent. A judicial correction would restore the value of “premium” consensual data and create a fairer marketplace for their members.

Digital Poverty Alliance

Address: 10 Throgmorton Avenue, London, EC2N 2DL

Email: info@digitalpovertyalliance.org

Benefit: Success in this JR would ensure that digital participation for low-income families is not contingent on surrendering their privacy rights. This directly supports their core mission of eliminating the digital divide and the “poverty premium” in technology.

The Citizens

Address: 18-20 Marshall St, London, W1F 7BE

Email: contact@the-citizens.com

Benefit: This non-profit investigates the impact of big tech on democracy. A successful JR would provide them with the legal ammunition to demand greater transparency from regulators regarding “regulatory capture” and lobbyist influence.

ISBA (The Voice of British Advertisers)

Address: 12 Henrietta Street, London, WC2E 8LH

Email: info@isba.org.uk

Benefit: While representing advertisers, many of their members are concerned about the “brand safety” and ethical implications of using data harvested under coercive conditions. A JR success would provide a clearer, more ethical framework for the advertising ecosystem, restoring trust in the digital supply chain.

As a Senior Public Law Barrister specializing in judicial review and systemic regulatory failure, I have analyzed the case presented on cocoo.uk regarding the developments of 16 December 2025. The core of this challenge targets the regulatory inertia or affirmative misdirection by the relevant UK authorities—specifically the Information Commissioner’s Office (ICO) and potentially the Competition and Markets Authority (CMA)—in their oversight of Meta’s data practices and market conduct.

1. Judicial Review Status and Locus Standi

Current JR Status and Time Bars:

A judicial review (JR) must typically be filed promptly and in any event within three months of the decision being challenged. If the decision in question is the regulatory clearance or the formal non-objection to Meta’s pay-or-consent model or its 16 December AI data pivot, the claim is well within the limitation period. However, many of the underlying DORCAPs (Decisions, Omissions, Regulations, Conducts, Actions, and Policies) may be framed as ongoing harms or active policies. The implementation of the pay-or-consent model is a continuing act; each day it remains in force without lawful regulatory intervention constitutes a fresh or continuing breach of statutory duty under the Data Protection Act 2018 (DPA) and the UK GDPR.

Fresh Decision Strategy:

We can indeed trigger a fresh, challengeable decision by sending a formal Letter before Claim to the regulator (the ICO). By requesting that the regulator exercise its specific enforcement powers under Section 149 of the DPA (Enforcement Notices) to halt Meta’s 16 December data harvesting, a refusal to do so would constitute a discrete, reviewable decision. This “refusal to act” resets the JR clock and provides a clear target for litigation. Seeking such a decision also bolsters our Locus Standi, as we would be the party whose formal request for regulatory action was denied.

Causes of Action (COAs):

The primary COAs in Judicial Review are illegality (misinterpreting the requirement that consent be freely given), irrationality (failure to consider the coercive impact on low-income users), and procedural impropriety (failure to consult affected stakeholders before issuing regulatory “comfort”). In Tort, we would look to Misfeasance in Public Office, arguing the regulator acted with reckless indifference to the statutory harm caused to the public, and Breach of Statutory Duty, where the DPA provides a framework for the protection of fundamental rights.

Locus Standi and the Lordhope Model:

For a “no particular victim” applicant like a non-profit organization, standing is secured through the principle of “sufficient interest.” Following the Lordhope model—drawing on the Scottish constitutional approach in AXA and the UK Supreme Court’s reasoning in Walton—we argue that in cases of great public importance involving diffuse harms (where millions are affected but no single individual has the resources to sue), the court must allow a representative body to act as a “public spirit” to ensure the rule of law. If the regulator is not held to account by a representative body, the illegality would go unchecked, creating a “legal vacuum.”

2. Ultra Vires and Irrational DORCAPs

Based on the 16 December evidence, I rank the regulatory DORCAPs by their legal vulnerability as follows:

First: The ICO’s Decision to accept the “Pay or Consent” model as satisfying the “freely given” requirement of the UK GDPR. This is likely ultra vires. The statutory purpose of the GDPR is to protect the fundamental right to data protection. Interpreting “consent” to include a financial penalty for refusal (the subscription fee) arguably contradicts the clear wording of the legislation and the European precedents that the UK courts still find highly persuasive.

Second: The Omission to issue an Enforcement Notice regarding Meta’s 16 December AI training rollout. This is irrational in the Wednesbury sense. If the regulator has evidence of large-scale data processing without a valid lawful basis, a failure to exercise its primary enforcement tool is a decision so unreasonable that no reasonable regulator would have made it, especially given the scale of the “diffuse” harm.

Third: The Policy of “Regulatory Deference” toward big tech, prioritized over the individual rights of UK citizens. This conduct can be challenged as an unlawful fettering of discretion, where the regulator has pre-determined its reluctance to litigate against Meta, regardless of the merits of the breach.

3. Suspended Quashing Orders

We should seek a Quashing Order to nullify the ICO’s guidance or decision that permitted the current pay-or-consent framework. However, to avoid “administrative chaos” and a sudden regulatory void that could lead to legal uncertainty for millions of users, I recommend that the order be suspended for a period of six months.

Proposed Conditions:

The suspension should be conditional upon the regulator: (a) issuing interim protective guidance within 30 days; (b) launching a mandatory public consultation on the economic coercion of data-fees; and (c) requiring Meta to provide a “zero-cost” opt-out for vulnerable/low-income users during the transition period. This allows for an orderly correction of the law while maintaining immediate protections for the most at-risk classes.

4. Ongoing Harm and Injunctive Relief

The ongoing harm is the daily, irreversible harvesting of conversational and behavioral data to train proprietary AI models without valid consent. This creates a permanent “data debt” that cannot be fully remediated by later damages.

Application for Interim Injunction:

The application would seek to restrain the regulator from continuing to allow the 16 December data pivot to proceed. Key elements:

• A serious issue to be tried regarding the legality of the consent mechanism.

• The balance of convenience favors the public; the harm to millions of users’ privacy rights outweighs the commercial delay to Meta.

• Damages would be an inadequate remedy because privacy, once breached on this scale, is a “spent” right.

5. Statement of Legal Principle Declaration

We should ask the court for the following declaration:

It is hereby declared that the Information Commissioner’s Office acted ultra vires and in breach of its statutory duty under the Data Protection Act 2018 by determining that a financial requirement for the withholding of consent to data processing is consistent with the requirement that consent be freely given; such a determination fails to respect the statutory purpose of protecting data subjects from economic coercion.

6. Risk Disclosure Statement

I propose a court order requiring the ICO and the CMA to publish a “Joint Risk Disclosure Statement” on their homepages for 12 months.

Terms of Order:

The Public Bodies shall publish a statement, in a prominent position on their respective websites and in their next Annual Reports, acknowledging the Court’s finding of procedural and substantive error. This statement must clearly list the specific Meta data-processing activities that were found to be inadequately regulated, the potential risks to user privacy and market fairness that resulted, and the specific corrective measures being taken to ensure future compliance with the rule of law.

7. Assessment and Publicity of Risk

Our investigation suggests that the regulator failed to conduct a formal, independent Human Rights Impact Assessment or a Distributional Analysis of the “Pay or Consent” model prior to its implementation in late 2025. While internal “briefing notes” may exist, they were not made public. This failure to conduct and publish a rigorous risk assessment is a further ground for a finding of procedural unfairness. It suggests the regulator prioritized industry convenience over its duty of due diligence toward the public.

8. Responsible Parties and Individual Liability

The primary responsibility lies within the ICO’s Enforcement and Cyber Investigation Department and the CMA’s Digital Markets Unit (DMU). Specifically, the senior leadership who signed off on the “non-objection” letters are the focal points.

(a) No individuals have been held contributorily liable in tort thus far.

(b) No disciplinary proceedings have been initiated.

(c) No dismissals or fines have been reported.

I strongly recommend a line of inquiry into the specific communications between these departments and Meta’s lobbyists. If evidence of “regulatory capture” emerges, it supports a claim for Misfeasance in Public Office against the named officials, potentially leading to personal liability or professional sanction.

9. Tort Damages and Remediation Project

Aggregate Tort Damages:

Given the scale of the UK user base (approximately 40 to 50 million people), and a notional per-capita harm of £50 for the loss of control over sensitive data and the cost of coercive fees, I estimate the aggregate damages at £2 billion to £2.5 billion.

Mechanism for Distribution:

Because the victims are a diffuse and unidentifiable class in practical terms, a traditional payout is inefficient. I propose the creation of the “UK Digital Sovereignty Trust.” This trust would be funded by the damages and managed by an independent board of civil society leaders.

Project Justification:

The trust would fund three core “positive externalities”:

• A Digital Literacy Grant Program to educate the public on data rights and AI safety.

• An Innovation Fund for Privacy-Preserving Technologies to support UK startups building alternatives to the current “surveillance-capitalism” model.

• A Community Legal Fund to provide ongoing representation for citizens in future challenges against big tech and its regulators.This creates a “spillover effect” where the remediation directly repairs the structural power imbalance that allowed the original harm to occur.

Here are the customised SuperFOI requests for the AEPD and CNMC.

These letters are legally adapted to the specific competencies of each regulator, applying the “Action of Regreso” (Clawback) strategy to the Meta (Facebook/Instagram) case. They are designed to expose the systemic failure to compensate victims despite collecting multi-million euro fines.

INSTRUCTIONS FOR SENDING:

1. AEPD: Submit via Sede Electrónica AEPD > Transparencia.

2. CNMC: Submit via Sede Electrónica CNMC > Solicitud de Información Pública.

3. Dates: Send immediately to interrupt any prescription periods (Time Limits).

DRAFT 1: TO THE DATA PROTECTION REGULATOR (AEPD)

Target: Agencia Española de Protección de Datos (AEPD) / Presidencia

Subject: The “Enforcement Vacuum” regarding Mass Data Breaches (Meta/Facebook) and lack of Victim Compensation.

[COPY AND PASTE INTO TRANSPARENCY PORTAL / EMAIL]

Para: Unidad de Transparencia / Agencia Española de Protección de Datos (AEPD)

Email: transparencia@aepd.es / prensa@aepd.es

Asunto: Solicitud de Acceso a Información Pública – Evidencias sobre [Sanciones a META/FACEBOOK y Falta de Indemnización] y Análisis de Responsabilidad Patrimonial

Escribo en nombre de Competition & Consumer Organisation Party Limited (COCOO.uk), una organización benéfica dedicada a la protección del Interés Público General (Wider Public Interest). Intervenimos en fallos regulatorios donde el daño es difuso y existe un “vacío de ejecución” (enforcement vacuum) porque, a pesar de las multas millonarias, las víctimas individuales no reciben reparación.

Esta solicitud evalúa si el DORCAP (Decisión, Omisión, Regulación, Conducta, Acción o Política) referenciado —específicamente la gestión de los expedientes sancionadores contra Meta Platforms Ireland Ltd (Facebook/Instagram) por infracciones del RGPD— cumple los criterios de intervención por quiebra del Estado de Derecho. Buscamos verificar si la falta de mecanismos efectivos de indemnización a los ciudadanos afectados constituye una negligencia administrativa.

Al amparo de la Ley 19/2013, de transparencia, acceso a la información pública y buen gobierno, solicito la siguiente información en formato electrónico:

PARTE 1: ESTABLECIMIENTO DEL “VACÍO DE EJECUCIÓN” (Datos de Locus Standi)

Para confirmar que el regulador recauda multas pero no protege a la víctima:

• Destino de las Sanciones: Confirme el destino final de los fondos recaudados por sanciones a Meta/Facebook (ej. sanciones relacionadas con la sentencia del TJUE o resoluciones coordinadas con el CEPD). ¿Qué porcentaje de estos fondos se ha destinado a un fondo de compensación para los usuarios cuyos datos fueron tratados ilícitamente?

• Quejas Individuales: Desglose el número de reclamaciones recibidas contra Meta/Facebook en los últimos 5 años. De estas, ¿cuántas han resultado en una resolución que ordene una indemnización directa al ciudadano conforme al Artículo 82 del RGPD?

• Impacto Económico: ¿Posee la AEPD algún informe que cuantifique el “Daño Moral” o pérdida de control de datos promedio por usuario español afectado por las prácticas de Meta? Si la respuesta es negativa, confirme si la AEPD considera que su mandato se limita a imponer multas administrativas sin evaluar el daño civil a los ciudadanos.

PARTE 2: LEGALIDAD Y RIESGO (Controles de Gobernanza)

Para evaluar si la inacción regulatoria ha permitido la continuidad de la infracción:

• Evaluación de Riesgo de Reincidencia: Por favor, revele la existencia de cualquier nota interna o informe de seguimiento que analice si el pago de multas por parte de Meta se considera un mero “coste operativo” (cost of doing business) que no disuade la conducta infractora.

• Comunicaciones con el CEPD: ¿Existen comunicaciones con el Comité Europeo de Protección de Datos (CEPD) en las que la AEPD haya solicitado medidas coercitivas más allá de las multas (ej. prohibición temporal de procesamiento) para detener el daño continuado a los usuarios españoles?

PARTE 3: CIRCUNSTANCIAS ESPECÍFICAS – LA TRAMPA DEL “REGRESO”

Para reunir evidencia clave sobre la responsabilidad de los gestores públicos.

Solicito que se confirme si este organismo ha incoado alguna vez el ‘Procedimiento de exigencia de la responsabilidad a las autoridades y personal’ (Acción de Regreso) conforme al Artículo 36 de la Ley 40/2015, para recuperar daños derivados de la falta de protección efectiva de los derechos fundamentales (Art. 18 CE). En concreto:

1. Indique si se ha abierto algún expediente de investigación interna contra directivos o inspectores de la AEPD por “Culpa in Vigilando” ante la repetición sistemática de infracciones por parte de grandes tecnológicas (Big Tech).

2. Si la respuesta es ‘ninguno’, confirme si existe una política de no exigir responsabilidad a los funcionarios que permiten, por omisión o retraso injustificado, que prescriban los derechos de reclamación de los ciudadanos.

PARTE 4: ASPECTOS SISTÉMICOS

1. Auditoría de Eficacia: Facilite los títulos de los informes de la Inspección de los Servicios de los últimos 3 años que analicen la eficacia real de las sanciones del RGPD en la modificación de conducta de las empresas sancionadas.

Si determina que esta solicitud requiere subsanación, le ruego me contacte inmediatamente conforme a su deber de asistencia.

Atentamente,

Oscar Moya

Director, COCOO.uk

DRAFT 2: TO THE COMPETITION REGULATOR (CNMC)

Target: Comisión Nacional de los Mercados y la Competencia (CNMC)

Subject: The Abuse of Dominance by Meta (Marketplace) and State Liability for Regulatory Delay.

[COPY AND PASTE INTO TRANSPARENCY PORTAL / EMAIL]

Para: Unidad de Transparencia / Secretaría del Consejo CNMC

Email: transparencia@cnmc.es

Asunto: Solicitud de Acceso a Información Pública – Evidencias sobre [Abuso de Posición de META y Vinculación Ilegal] y Falta de Acción de Regreso

Escribo en nombre de Competition & Consumer Organisation Party Limited (COCOO.uk). Investigamos fallos de mercado donde la intervención tardía del regulador ha consolidado monopolios, causando daños irreparables a competidores y consumidores.

Esta solicitud se centra en el DORCAP relativo a la supervisión de las prácticas de Meta Platforms (Facebook), específicamente la vinculación (tying) de su servicio de anuncios clasificados (Marketplace) con su red social, práctica recientemente sancionada por la Comisión Europea (€797M) y que afecta directamente al mercado español.

Al amparo de la Ley 19/2013, de transparencia, solicito:

PARTE 1: VACÍO DE EJECUCIÓN Y DAÑO AL MERCADO

• Cuantificación del Daño: ¿Dispone la Dirección de Competencia de la CNMC de algún informe económico que cuantifique el lucro cesante de los competidores españoles (ej. portales de clasificados, prensa local) provocado por la posición de “Super-Dominancia” de Meta en los últimos 5 años?

• Inacción Previa: Confirme si la CNMC abrió algún expediente de oficio sobre la vinculación de Facebook Marketplace antes de la intervención de la Comisión Europea. Si no lo hizo, facilite los informes de “screening” o vigilancia de mercado que justificaron no intervenir ante una práctica visiblemente restrictiva.

PARTE 2: LA TRAMPA DEL “REGRESO” (ART. 36 LEY 40/2015)

Buscamos verificar si la Administración asume responsabilidad por su pasividad.

Solicito confirmación sobre la aplicación de la Acción de Regreso por negligencia regulatoria:

1. ¿Ha iniciado la CNMC algún expediente de responsabilidad patrimonial o acción de regreso contra sus propios directivos por “Falta de Servicio” (maladministration), al haber permitido que Meta consolidara su posición de dominio sin imponer medidas cautelares oportunas, derivando en la expulsión de competidores del mercado?

2. Indique el número de procedimientos disciplinarios iniciados en los últimos 10 años contra personal de la CNMC por retrasos injustificados en la instrucción de expedientes sancionadores que resultaron en caducidad o prescripción.

PARTE 3: GESTIÓN DE SANCIONES Y VÍCTIMAS

• Destino de Fondos: En relación con las sanciones impuestas a Big Tech, confirme si la CNMC ha propuesto al Gobierno algún mecanismo para que parte de la recaudación se destine a un fondo de competitividad o digitalización para las PYMES españolas dañadas por estas prácticas abusivas.

Atentamente,

Oscar Moya

Director, COCOO.uk

Based on the information reviewed from the provided case files and the 16 December 2025 update regarding the Meta (Facebook/Instagram/WhatsApp) case, here is the Solicitor’s analysis.

CASE SUMMARY: META (SPAIN/UK NEXUS)

Date of Update: 16 December 2025

Core Allegation: Meta has engaged in systemic GDPR violations and Anti-competitive practices (Abuse of Dominance), facilitating significant consumer and market harm. The regulatory bodies (AEPD and CNMC) have failed to effectively stop these practices despite issuing fines, leading to a claim of State Liability for regulatory negligence.

CAUSE OF ACTION 1: DATA PROTECTION & PRIVACY (GDPR)

Focus: Non-consensual data harvesting, algorithmic bias, and Android privacy breaches.

1. IDENTIFY ALL PROVEN FOIGS (FINDINGS OF INFRINGEMENT)

• €1.2 Billion GDPR Fine: A definitive Finding of Infringement (FOIG) by the Data Protection Commission (DPC) (affirmed by the EDPB and relevant to AEPD jurisdiction) for unlawful data transfers and processing without valid consent.

• Android Privacy Breaches: Ongoing investigation/findings regarding Meta’s unauthorized access to Android user data (Source: AEPD v Meta files).

• Algorithmic Bias: Proven suppression of voices/media and lack of transparency in content algorithms.

2. IDENTIFY POSSIBILITIES THAT THESE FOIGS COULD HAVE BEEN CAUSED BY AN ULTRAVIRES/UNLAWFUL DORCAP FROM THE REGULATOR

• DORCAP (Decision, Order, Regulation, Contract, Act, or Policy): The AEPD’s (Agencia Española de Protección de Datos) systemic inaction and “Administrative Silence” or delay in enforcing specific local complaints filed by bodies like OCU (Organización de Consumidores y Usuarios).

• Unlawful/Ultravires Aspect: The Regulator failed to exercise its statutory duties to protect fundamental rights (Article 18 Spanish Constitution) and effectively stop the processing, effectively “licensing” the infringement by only issuing fines that are treated as a “cost of business” rather than forcing compliance.

• Judicial Review: Yes/Pending. The 16 Dec update implies preparation for or existence of a Judicial Review (Contentious-Administrative appeal) challenging the AEPD’s failure to act (inactivity) or its “soft” settlement of issues.

3. HAS THE STATE PAID REDRESS TO VICTIMS?

• Redress: NO. The State (Treasury) collected the fines (e.g., portions of the multimillion-euro penalties), but zero compensation has been distributed to the victims (the users whose data was misused).

• Regreso/Disciplinary: NO. There has been no Acción de Regreso (State reclaiming money from negligent officials) initiated against AEPD directors for dereliction of duty.

DATES & TIME LIMITS TO CLAIM:

• Claim Period: 5 Years (GDPR/Civil Liability).

• Start Date: From the date of the definitive sanction (e.g., May 2023 for the €1.2B fine) or the date the victim became aware of the specific harm.

• Deadline: May 2028. (Urgent action required for earlier breaches).

CAUSE OF ACTION 2: COMPETITION LAW (ABUSE OF DOMINANCE)

Focus: Market distortion, bundling (Marketplace/Social), and advertising duopoly.

1. IDENTIFY ALL PROVEN FOIGS (FINDINGS OF INFRINGEMENT)

• €797 Million Antitrust Fine: A proven FOIG by the European Commission/CNMC regarding the abusive tying of Facebook Marketplace to the personal social network, imposing unfair trading conditions on other classified ads service providers.

• Abuse of Dominance (Article 102 TFEU): Established dominance in the personal social network market and abuse through data imposition.

2. IDENTIFY POSSIBILITIES THAT THESE FOIGS COULD HAVE BEEN CAUSED BY AN ULTRAVIRES/UNLAWFUL DORCAP FROM THE REGULATOR

• DORCAP: The CNMC’s (Comisión Nacional de los Mercados y la Competencia) failure to intervene earlier or its decision to allow Meta’s acquisitions (e.g., WhatsApp, Instagram) without sufficient remedies, creating the “Super-Dominant” position.

• Unlawful/Ultravires Aspect: The Regulator’s oversight was negligent (Culpa in Vigilando), failing to enforce the Law of Defence of Competition (LDC) effectively, allowing the harm to compound over years.

• Judicial Review: Yes. Similar to the Mediaset precedent, the CNMC’s decisions (or lack thereof) are subject to review for failing to protect the public interest and competitive market structure.

3. HAS THE STATE PAID REDRESS TO VICTIMS?

• Redress: NO. The fines are paid to the public purse. Competitors (other ad platforms) and consumers (who paid higher prices indirectly) have received nothing.

• Regreso/Disciplinary: NO. No disciplinary files opened against CNMC board members for the delayed enforcement.

DATES & TIME LIMITS TO CLAIM:

• Claim Period: 5 Years (Directive 2014/104/EU & Spanish Law).

• Start Date: From the finality of the infringement decision (e.g., late 2024/early 2025).

• Deadline: Late 2029 / Early 2030.

CAUSE OF ACTION 3: STATE LIABILITY (ADMINISTRATIVE NEGLIGENCE)

Focus: The State’s failure to transpose directives or enforce laws (Francovich Doctrine).

1. IDENTIFY ALL PROVEN FOIGS (FINDINGS OF INFRINGEMENT)

• FOIG: The “Infringement” here is the State’s own breach of EU Law (e.g., failure to effectively enforce GDPR or Competition Directives, or wrongful implementation of Digital Markets Act – DMA).

• Evidence: The European Court of Justice (ECJ) rulings against Spain or the Commission’s infringement proceedings (e.g., regarding procedural delays).

2. IDENTIFY POSSIBILITIES THAT THESE FOIGS COULD HAVE BEEN CAUSED BY AN ULTRAVIRES/UNLAWFUL DORCAP FROM THE REGULATOR

• DORCAP: The systematic “DORCAP” is the omission of duty by the Ministry of Economy/Digital Transformation and the Regulators.

• Judicial Review: This IS the Judicial Review claim. The argument is that the State’s inaction was ultra vires (outside its power to neglect duty).

3. HAS THE STATE PAID REDRESS TO VICTIMS?

• Redress: NO.

• Regreso/Disciplinary: NO.

DATES & TIME LIMITS TO CLAIM:

• Claim Period: 1 Year (Strict strict liability limit in Spain for Responsabilidad Patrimonial del Estado).

• Start Date: From the date of the “fact” or the judgment establishing the State’s breach/annulment of the faulty administrative act.

• Deadline: 16 December 2026 (assuming the “16 Dec 2025” update marks a definitive triggering event or knowledge of the claimable act).

SOLICITOR’S RECOMMENDATION

The 16 December 2025 update indicates that the “Time is of the Essence.” We have definitive FOIGs (€1.2B & €797M) which act as binding proof of liability. The strategy is to leverage the State’s failure to compensate victims (despite collecting fines) to force a Mediation or Settlement before the 1-year State Liability window closes.

Next Steps:

1. Issue Letter of Claim to Meta (Private Action) citing the FOIGs.

2. File Preliminary Claim against the AEPD/CNMC (Public Action) for Administrative Liability (DORCAP failure) to stop the 1-year clock.