Rıza veya Öde Görüşünün Dava Edilebilirliği

–

the application lodged at the Registry of the General Court on 27 June 2024,

–

the plea of inadmissibility raised by the European Data Protection Board by separate document lodged at the Court Registry on 18 September 2024,

–

the applicant’s observations on the plea of inadmissibility lodged at the Court Registry on 31 October 2024,

–

the applications to intervene of the Council of the European Union, the European Parliament and Chamber of Progress lodged at the Court Registry on 19 September, 1 and 2 October 2024, respectively,

1

By its action, the applicant, Meta Platforms Ireland Ltd (‘Meta’), seeks, first, under Article 263 TFEU, the annulment of Opinion 8/2024 of the European Data Protection Board (‘the EDPB’) of 17 April 2024 on valid consent in the context of ‘consent or pay’ models implemented by large online platforms (‘the contested opinion’) and, secondly, under Article 268 TFEU, compensation for the damage which it claims to have suffered as a result of that opinion.

2

The contested opinion was adopted by the EDPB, under Article 64(2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1), at the request of three supervisory authorities in the field of personal data protection, namely the Datatilsynet (Data Protection Authority, Norway), the Autoriteit Persoonsgegevens (Data Protection Authority, Netherlands) and the Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (Commissioner for Data Protection and Freedom of Information, Hamburg, Germany). Those authorities sought an opinion on the circumstances and conditions under which practices implemented by ‘large online platforms’, whereby users are offered a choice between consenting to the processing of personal data for behavioural advertising purposes and paying a fee to access the service without their personal data being processed for those purposes (‘consent or pay’ models), could be considered to satisfy the requirement for valid consent, within the meaning of Regulation 2016/679.

3

In the contested opinion, the EDPB lists the elements to be assessed, on a case-by-case basis, to determine whether a controller – within the meaning of point 7 of Article 4 of Regulation 2016/679 – must be regarded as a ‘large online platform’ for the purposes of that opinion, while making clear that that list is not exhaustive and that those elements do not apply cumulatively. Those elements include the fact that the platform attracts a large number of data subjects as users, the position of the undertaking on the market, the number of data subjects, the volume of data processed and the geographical extent of the processing activity. The contested opinion states that the concept of ‘online platform’ may cover, but is not limited to, ‘online platforms’, as defined in Article 3(i) of Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital Services Act) (OJ 2022 L 277, p. 1), and that ‘large online platforms’ may also be controllers of ‘very large online platforms’, as defined in Article 33(1) of that regulation, or ‘gatekeepers’, as defined in Article 3(1) of Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector and amending Directives (EU) 2019/1937 and (EU) 2020/1828 (Digital Markets Act) (OJ 2022 L 265, p. 1).

4

On the substance, the EDPB explains in the contested opinion that, when users are asked to consent to the processing of their personal data with a view to sending them behavioural advertising, that consent, in order to be valid, must be obtained in accordance with the principles and rules set out in Regulation 2016/679. It must, in particular, be freely given, specific, informed and unambiguous, and must relate to the processing of data in compliance with the principles of necessity, proportionality, purpose limitation, data minimisation and fairness. The EDPB makes clear that the assessment by the competent national supervisory authorities of whether those conditions have been complied with must be carried out on a case-by-case basis.

5

The EDPB takes the view that, in most cases, it will not be possible for a ‘large online platform’, as referred to in the contested opinion, to comply with the requirements for valid consent if it gives users only a ‘binary choice’ between consenting to the processing of personal data for behavioural advertising purposes and paying a fee in order to be able to access the service concerned without receiving behavioural advertising. It states that, when developing an ‘alternative’ to the version of the service with behavioural advertising, large online platforms should consider providing users with an ‘equivalent alternative’ that does not entail payment of a fee. If, however, they choose to charge a fee for access to the ‘equivalent alternative’, they should also consider offering a further alternative, free of charge and without behavioural advertising, with, for example, a form of advertising involving the processing of less (or no) personal data, such as contextual advertising, targeted advertising on topics chosen by the user or general advertising. According to the EDPB, in most cases, whether or not a further alternative without behavioural advertising is offered by the controller, free of charge, will have a substantial impact on the assessment of the validity of consent, in particular as regards whether the data subject may refuse or withdraw consent without detriment.

6

In relation to that last point, the EDPB states, inter alia, that the fee charged to access the paid version of the service should not be such as to inhibit data subjects from making a free choice and from refusing to give consent. It makes clear that personal data cannot be regarded as a tradeable commodity and that the right to the protection of those data is a right that applies to everyone, regardless of payment of a fee or financial status. Detriment may also arise where non-consenting data subjects do not pay a fee and thus face exclusion from the service, especially where the service plays a key role in their daily lives or their participation in social life or is decisive for access to professional networks.

7

Furthermore, the EDPB states that it is also necessary to take account of the controller’s position and the power it wields vis-à-vis the data subject. If, in a given situation, there is a clear imbalance between the controller and the data subject, the latter may feel compelled to take a decision that he or she would not otherwise take. The EDPB adds that, when faced with a ‘consent or pay’ model, data subjects should be free to choose which data processing purpose or purposes they accept, rather than having to consent to a bundle of purposes.

8

The contested opinion also includes considerations on the conditions under which the consent collected from users by large online platforms in the context of ‘consent or pay’ models in relation to behavioural advertising can be considered to be informed, specific and unambiguous.

9

Meta claims that the Court should:

10

In its plea of inadmissibility raised under Article 130(1) of the Rules of Procedure of the General Court, the EDPB contends that the Court should:

11

In its observations on the plea of inadmissibility, Meta claims that the Court should:

12

Under Article 130(1) and (7) of the Rules of Procedure, the Court may give a decision on inadmissibility, by way of an order, without going to the substance of the case if a defendant makes an application asking it to do so. In addition, under Article 126 of those rules, where an action is manifestly lacking any foundation in law, the Court may at any time decide to give a decision by reasoned order without taking further steps in the proceedings.

13

In the present case, the Court, taking the view that it has sufficient information from the documents before it, has decided to give a decision without taking further steps in the proceedings.

14

The EDPB contends that the claim for annulment is inadmissible in so far as, first, the contested opinion is not a challengeable act and, secondly, the contested opinion is not of direct or individual concern to Meta.

15

As regards the first ground of inadmissibility, the EDPB submits that the contested opinion has no legal effect on Meta’s situation. It states that opinions adopted under Article 64 of Regulation 2016/679 differ from binding decisions under Article 65(1) thereof, since the former do not produce legal effects of their own. According to the EDPB, Article 64(7) of that regulation provides solely that the competent supervisory authorities are to ‘take utmost account’ of those opinions; only a subsequent binding decision may make the content of such an opinion of mandatory application for a supervisory authority.

16

Meta, first of all, submits that if actions for annulment of an opinion of the EDPB issued under Article 64(2) of Regulation 2016/679 were inadmissible, the autonomy of EU law would be undermined. Data subjects may bring legal proceedings on the basis of such opinions before the courts of States which are parties to the Agreement on the European Economic Area (EEA) but which are not members of the European Union, States in which Regulation 2016/679 applies by virtue of that agreement. Those courts cannot refer a question to the Court of Justice of the European Union for a preliminary ruling on the validity of those opinions under Article 267 TFEU, thus risking a conflict in the interpretation and application of EU law. Meta argues that it must therefore be possible at the outset for the legality of such opinions to be reviewed in an action for annulment before the EU Courts, thereby ensuring the uniform application of the law throughout the EEA.

17

Next, in its observations on the plea of inadmissibility, Meta claims that, if its action for annulment were declared inadmissible, that would lead to a breach of its right to effective judicial protection, enshrined in Article 47 of the Charter of Fundamental Rights of the European Union. The EDPB used a formally non-binding instrument to impose rules specifically aimed at Meta in an effort to avoid direct review by the EU Courts. That is why the action for annulment would enable Meta’s right to be enforced.

18

Lastly, Meta states that, irrespective of the form it takes, the contested opinion produces binding legal effects. It is open to the EDPB, de facto, to compel national supervisory authorities to comply with an opinion issued under Article 64(2) of Regulation 2016/679 by adopting a binding decision to that effect, as provided for in Article 65(1)(c) of that regulation. The facts, it is argued, demonstrate that the EDPB intends to force its views on the Data Protection Commission (Ireland), which is the lead authority for handling cases concerning Meta. The drafting style used in the contested opinion itself shows that the margin of discretion of supervisory authorities and the self-assessment margin of large online platforms are extremely limited, if not non-existent. According to Meta, the situation here differs from that in the case which gave rise to the order of 9 July 2019, VodafoneZiggo Group v Commission (T‑660/18, EU:T:2019:546), relied on by the EDPB, which concerned comments made by the European Commission in the context of the European consultation procedure provided for in Directive 2002/21/EC of the European Parliament and of the Council of 7 March 2002 on a common regulatory framework for electronic communications networks and services (Framework Directive) (OJ 2002 L 108, p. 33), as last amended by Directive 2009/140/EC of the European Parliament and of the Council of 25 November 2009 (OJ 2009 L 337, p. 37). Indeed, the contested opinion was issued in the context of the ‘consistency mechanism’ established by Regulation 2016/679 and not in the context of a consultation procedure. Meta adds, in essence, that by disregarding the Court of Justice’s assessment given by way of a preliminary ruling in its judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social network) (C‑252/21, EU:C:2023:537) – in paragraph 150 of which the lawfulness, in the light of Regulation 2016/679, of ‘consent or pay’ models is not precluded – the contested opinion produces binding legal effects vis-à-vis Meta.

19

The Court of Justice has consistently held that an action for annulment under Article 263 TFEU must be available against all acts adopted by the institutions, bodies, offices and agencies of the European Union, whatever their nature or form, which are intended to produce binding legal effects capable of affecting the interests of the applicant by bringing about a distinct change in his or her legal position (see, to that effect, judgments of 11 November 1981, IBM v Commission, 60/81, EU:C:1981:264, paragraph 9, and of 18 November 2010, NDSHT v Commission, C‑322/09 P, EU:C:2010:701, paragraph 45 and the case-law cited).

20

In order to determine whether an act produces binding legal effects, it is necessary to examine the substance of that act and to assess those effects on the basis of objective criteria, such as the content of that act, taking into account, as appropriate, the context in which the act was adopted and the powers of the institution which adopted it (see judgment of 20 February 2018, Belgium v Commission, C‑16/16 P, EU:C:2018:79, paragraph 32 and the case-law cited).

21

As regards the content of the contested opinion, as is apparent from the summary set out in paragraphs 4 to 8 above, that act provides a framework for evaluating the ‘consent or pay’ models of large online platforms in the light of the rules laid down in Regulation 2016/679 concerning valid consent, reminding supervisory authorities of the aspects they must check. The EDPB states on numerous occasions in the contested opinion that the evaluation must be carried out on a case-by-case basis.

22

It is true that, in the contested opinion, the EDPB focuses on the situation in which a large online platform does not offer users a free alternative to consenting to the processing of personal data for behavioural advertising purposes, but only a paid alternative, and states that, in most cases, that situation is likely to result in the invalidity of such consent, if given. However, the EDPB makes clear in the contested opinion that that assessment depends on a number of factors, including whether or not the service in question is an important part of the user’s social or professional life and the cost of the paid alternative. It also sets out various possibilities for free alternatives.

23

Furthermore, although, as Meta observes, the contested opinion uses words such as ‘should’, ‘should not’ and ‘in most cases’, the passages containing such wording, read in the light of the document as a whole, appear to be calling for an in-depth consideration of the options that each large online platform could offer to users as an alternative to consenting to behavioural advertising, rather than censuring ‘consent or pay’ models across the board as far as those platforms are concerned. Thus, for example, paragraphs 180 and 181 of the contested opinion, which form part of that opinion’s conclusions and are underscored by Meta, are to be read in conjunction with the next paragraph thereof, which outlines all of the factors to be taken into account in order to determine whether consent given to a large online platform in the context of a ‘consent or pay’ model is valid.

24

It cannot therefore be inferred from the wording of the contested opinion that it is intended in itself to produce binding legal effects.

25

In addition, the fact that the contested opinion was adopted at a time when different supervisory authorities were examining the ‘consent or pay’ models of large online platforms, in particular the model used by Meta, cannot, in itself, lead to the conclusion that that opinion is binding. A number of instruments exist to ensure the consistent application of Regulation 2016/679, as provided for in Article 63 thereof, some of which are binding while others are merely advisory.

26

In that connection, the contested opinion was adopted – as is apparent from its recitals and paragraphs 7 to 12 thereof – on the basis of Article 64(2) of Regulation 2016/679. That provision is worded as follows:

‘Any supervisory authority, the Chair of the [EDPB] or the Commission may request that any matter of general application or producing effects in more than one Member State be examined by the [EDPB] with a view to obtaining an opinion, in particular where a competent supervisory authority does not comply with the obligations for mutual assistance in accordance with Article 61 or for joint operations in accordance with Article 62.’

27

The contested opinion has nothing to do with the circumstances contemplated in the last limb of that provision, but instead concerns a ‘matter of general application’, namely, as explained in paragraph 2 above, the circumstances and conditions under which the ‘consent or pay’ models of large online platforms may be considered to meet the requirement for valid consent, within the meaning of Regulation 2016/679 (see paragraph 3 of the contested opinion).

28

Contrary to the submissions of the EDPB, Regulation 2016/679 does not contain any provision requiring supervisory authorities to ‘take utmost account’ of an opinion under Article 64(2) thereof. The obligation to ‘take utmost account’ of an opinion of the EDPB, set out in Article 64(7) of Regulation 2016/679, applies to opinions issued under Article 64(1) thereof, which relate not to general matters but to certain specific types of draft decision of the supervisory authorities that those authorities must communicate to the EDPB during the procedure for the adoption of those decisions. If the supervisory authority concerned does not intend to follow, in whole or in part, the opinion issued to it under that provision, it must notify the Chair of the EDPB thereof, which triggers the process for the adoption of a binding decision of the EDPB, as provided for in Article 64(8). No such rules are laid down in relation to opinions of the EDPB on general matters issued under Article 64(2) of Regulation 2016/679, such as the contested opinion. Those are therefore opinions to which no special authority is attached.

29

It is true that Article 65(1)(c) of that regulation provides that the EDPB is to adopt a binding decision ‘where a competent supervisory authority does not request the opinion of the [EDPB] in the cases referred to in Article 64(1), or does not follow the opinion of the [EDPB] issued under Article 64’ and that, ‘in that case, any supervisory authority concerned or the Commission may communicate the matter to the [EDPB]’. In addition, as regards opinions on general substantive matters, as in the present case, if, in a procedure conducted by a lead supervisory authority concerning one or more specific cross-border data processing operations, that authority departs, in whole or in part, from an opinion of the EDPB of that kind by means of a draft decision which it is required to draw up under Article 60(3) of Regulation 2016/679, it is possible that the EDPB may have to revisit the matter under discussion by adopting a binding decision under Article 65(1)(a) of that regulation. However, in both cases, the opinion adopted under Article 64(2) of Regulation 2016/679, like the contested opinion, is not in the nature of an act which is in itself binding, since it is only by means of a subsequent binding decision of the EDPB that the guidelines contained in that opinion may, having regard to the EDPB’s powers, where appropriate, later become instructions of mandatory application by the supervisory authorities. The fact – to which Meta referred – that such an opinion is one of the instruments of the consistency mechanism provided for in Regulation 2016/679 does not change that. The consistency mechanism, like the rules on cooperation between supervisory authorities, provides for a non-binding advisory phase before the adoption, where appropriate, of binding decisions of the EDPB.

30

It follows from the foregoing that the contested opinion does not produce binding legal effects vis-à-vis third parties.

31

That is all the more so as regards Meta. Even if the applicant were in the situation with which the contested opinion is concerned, in the absence of a full analysis of its case – which, as far as the public authorities are concerned, is primarily for the competent supervisory authorities to carry out – that opinion cannot on any view produce binding legal effects in respect of it and bring about a distinct change in its legal position.

32

Similarly, if Meta were to decide to apply, on its own initiative, the evaluation framework set out in the contested opinion and to draw the appropriate conclusions therefrom, or if the Irish Data Protection Commission were to apply that evaluation framework itself, adopting in respect of Meta, if necessary, the corrective measures provided for in Article 58(2) of Regulation 2016/679, then they would do so without being legally bound to take such action by the contested opinion.

33

In that regard, the fact – to which Meta referred – that the Irish Data Protection Commission informed Meta that, in its view, it was required to take account of the contested opinion, relying on Article 57(1)(g) of Regulation 2016/679, under which each supervisory authority is to cooperate with the other supervisory authorities with a view to ensuring the consistent application of that regulation, cannot endow the contested opinion with a binding force which it does not have per se and which the obligation to cooperate in question does not confer on it either. An obligation to cooperate in order to implement a harmonised policy within the European Union cannot make non-binding acts of the European Union binding, even if those acts must be taken into consideration (see, to that effect and by analogy, judgment of 13 February 2014, Mediaset, C‑69/13, EU:C:2014:71, paragraphs 27 to 32).

34

Moreover, contrary to what Meta argues, the possibility of the EDPB issuing a subsequent binding decision addressed to the competent supervisory authorities tasked with reviewing the ‘consent or pay’ model used by Meta, a decision that reproduces all or part of the evaluation framework set out in the contested opinion, is not sufficient to consider that decision to be binding from the outset. It also cannot be ruled out that the specific examination in question might lead to a reassessment, in that case, of the general guidelines set out in the contested opinion.

35

In addition, even assuming that, as Meta submits, the contested opinion disregards the Court of Justice’s assessment of ‘consent or pay’ models given by way of a preliminary ruling in its judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social network) (C‑252/21, EU:C:2023:537), that cannot, in the light of its non-binding nature, alter Meta’s legal position either.

36

Having regard to all of the foregoing considerations, it must be held that the contested opinion is not an act that may be challenged by Meta.

37

Contrary to Meta’s submissions, that finding does not undermine Meta’s right to effective judicial protection, enshrined in Article 47 of the Charter of Fundamental Rights. Since the contested opinion does not produce binding legal effects, the fact that it is not open to challenge by Meta by way of an action for annulment cannot constitute a breach of its right to effective judicial protection. The considerations contained in that opinion could affect Meta directly only if they were included in a decision of a supervisory authority or a court of a Member State or another State party to the EEA Agreement. If that were the case, those decisions may be or will have been assessed by a court meeting the requirements of that article.

38

The finding that the contested opinion is not an act that may be challenged by Meta also cannot be called into question by Meta’s argument that the content of that opinion could be assessed differently by the courts of States party to the EEA Agreement that are not members of the European Union and by the courts of Member States of the European Union, which, unlike the former, may refer questions to the Court of Justice for a preliminary ruling, something which could, it is argued, undermine the unity of EU law.

39

Such a possibility is inherent in the system in place in the EEA Agreement in order to ensure the proper implementation of the rules applicable under that agreement. That system is based on two pillars of supervision and judicial review, the first applying to Member States of the European Union and the second to the other States party to the EEA Agreement. As far as the latter are concerned, in particular, Article 108(2) of the EEA Agreement and Article 34 of the Agreement between the EFTA States on the establishment of a surveillance authority and a Court of Justice (OJ 1994 L 344, p. 1) provide that a reference may be made to the Court of the European Free Trade Association (EFTA) by a court of those States for an opinion on the interpretation of those rules, thus including the interpretation of Regulation 2016/679. If such a reference were made, the EFTA Court could thus state its view on the extent to which the considerations set out in the contested opinion are consistent with that regulation. It could also, where appropriate, state that those considerations are not binding. As regards the Member States of the European Union, the Court of Justice could be asked by a court of an EU Member State to assess the validity of the contested opinion. Even though Article 263 TFEU excludes the review by the Court of Justice, by way of an action for annulment, of acts which have no binding legal effects, the Court may, pursuant to Article 267 TFEU, assess the validity of such acts when it gives a preliminary ruling (see judgment of 15 July 2021, FBF, C‑911/19, EU:C:2021:599, paragraph 54 and the case-law cited).

40

It must be noted that, following those procedures, possible differences in the assessment of an EU act by the two Courts may arise in any of the many areas governed by the EEA Agreement. The result of endorsing Meta’s reasoning – according to which actions for annulment against non-binding EU acts must be allowed if possible differences in assessment are to be avoided – would thus be to disregard and subvert, to a very large extent, the conditions of admissibility of actions for annulment as defined in Article 263 TFEU.

41

The possibility of the unity of EU law being undermined, as indicated by Meta, is therefore a potential drawback linked to the fact that EU rules apply by virtue of an international agreement outside the territory of the EU Member States, in another judicial system. That potential drawback – which, moreover, is taken into account in the EEA Agreement, Article 111 of which provides for a dispute settlement mechanism, involving the Court of Justice if necessary – cannot result in a breach of EU rules within the European Union.

42

It follows from all of the foregoing considerations that the court must uphold the plea of inadmissibility raised by the EDPB, in so far as it is directed against the claim for annulment, and, consequently, must reject that claim as inadmissible, without it being necessary to rule on the other ground of inadmissibility relied on by the EDPB.

43

The EDPB also pleads that the claim for compensation is inadmissible because, in essence, it is closely linked to the claim for annulment, which must be declared inadmissible.

44

It should be borne in mind that the EU Courts are entitled to assess, according to the circumstances of each case, whether the proper administration of justice justifies the dismissal of the action on the merits without first ruling on its admissibility. In the present case, it is necessary, in the interests of procedural economy, to examine at the outset the substance of Meta’s claim for compensation, without first ruling on its admissibility, since that claim is, for the reasons set out below, manifestly unfounded (see, to that effect and by analogy, judgment of 26 February 2002, Council v Boehringer, C‑23/00 P, EU:C:2002:118, paragraphs 51 and 52).

45

Meta states that, by adopting the contested opinion, the EDPB committed a sufficiently serious breach of rules of law intended to confer rights on it. It claims to be suffering damage that is imminent and foreseeable with sufficient certainty. According to Meta, a large number of users of its applications will choose the free alternative which it will be obliged to offer them by reason of the contested opinion, in addition to a choice between consenting to the receipt of behavioural advertising and paying to access the service concerned without receiving such advertising. That, it is argued, will lead to a significant reduction, first, in its advertising revenue from advertisers willing to pay a good price to place behavioural advertising, but a lower price to place other types of advertising, and, secondly, in its revenue from advertising-free user subscriptions. Even if the contested opinion was only temporary in nature and was reversed at a given point in time, Meta states that it may have lost some advertisers for good. Meta also submits that there is a direct causal link between the contested opinion and the alleged damage, since the former is the decisive cause of the latter. The EDPB has worked to ensure that that opinion is perceived as binding and account must be taken of the threat of its content being reproduced in binding decisions adopted by the same body or being cited by the courts, especially those of EFTA States party to the EEA Agreement which cannot refer questions to the Court of Justice for a preliminary ruling on its validity. In that regard, Meta restates the arguments put forward in support of the proposition that the contested opinion produces mandatory legal effects (see paragraph 18 above).

46

Based on the non-contractual liability of the European Union and as compensation for the alleged damage suffered, Meta seeks the adoption of the measures set out in its form of order reproduced in the second indent of paragraph 9 above.

47

It is settled case-law that the European Union may incur non-contractual liability under the second paragraph of Article 340 TFEU only if three cumulative conditions are fulfilled, namely the unlawfulness of the conduct alleged against the institutions, bodies, offices or agencies of the European Union, the fact of damage and the existence of a causal link between that conduct and the damage complained of (see, to that effect, judgments of 4 July 2000, Bergaderm and Goupil v Commission, C‑352/98 P, EU:C:2000:361, paragraphs 39 to 42, and of 28 October 2021, Vialto Consulting v Commission, C‑650/19 P, EU:C:2021:879, paragraph 138).

48

The cumulative nature of those conditions means that, if any one of them is not satisfied, the action for damages must be dismissed in its entirety and it is unnecessary to consider the other conditions (see judgment of 25 February 2021, Dalli v Commission, C‑615/19 P, EU:C:2021:133, paragraph 42 and the case-law cited). Furthermore, the EU Courts are not obliged to examine whether those conditions are satisfied in any particular order (judgment of 9 September 1999, Lucaccioni v Commission, C‑257/98 P, EU:C:1999:402, paragraph 13).

49

It is appropriate to examine first of all the condition relating to the fact of the alleged damage.

50

As regards that condition, it should be recalled that the damage must be ‘actual and certain’. By contrast, purely hypothetical and indeterminate damage does not give rise to compensation (see judgment of 26 October 2011, Dufour v ECB, T‑436/09, EU:T:2011:634, paragraph 192 and the case-law cited). However, the requirement relating to the existence of certain damage is met where the damage is imminent and foreseeable with sufficient certainty, even if the damage cannot yet be precisely assessed (see judgment of 3 December 2015, CN v Parliament, T‑343/13, EU:T:2015:926, paragraph 118 and the case-law cited).

51

Furthermore, it is for the applicant to adduce conclusive evidence of, in particular, the existence of the alleged damage (see, to that effect, judgments of 16 July 2009, SELEX Sistemi Integrati v Commission, C‑481/07 P, not published, EU:C:2009:461, paragraph 36 and the case-law cited, and of 8 November 2011, Idromacchine and Others v Commission, T‑88/09, EU:T:2011:641, paragraph 25 and the case-law cited).

52

In the present case, the damage alleged by Meta consists in the reduction in advertising and subscription revenues which it claims will result from the ‘requirement’, purportedly imposed by the contested opinion, to offer users a free alternative in addition to a choice between consenting to the receipt of behavioural advertising and paying to access the service concerned without receiving such advertising. Meta submits that the Irish Data Protection Commission ‘will feel obliged’ to impose such an alternative ‘in some form’ or will have to do so in response to a binding decision adopted by the EDPB under Article 65(1)(c) of Regulation 2016/679.

53

It must be stated that that damage is based on a misunderstanding of the contested opinion – which, as has been found, inter alia, in paragraphs 21 and 30 above – seeks, in essence, only to provide a framework for evaluating the ‘consent or pay’ models of large online platforms in the light of the rules laid down in Regulation 2016/679 concerning valid consent and is not intended in itself to produce binding legal effects. It is also based on future and uncertain events, since any decision by the Irish Data Protection Commission to apply that evaluation framework on its own initiative or the adoption by the EDPB of a binding decision on the matter are mere possibilities.

54

Accordingly, the condition relating to the existence of actual and certain damage is not satisfied.

55

In addition, the condition relating to the causal link concerns the existence of a sufficiently direct causal nexus between the conduct alleged against the institution, body, office or agency of the European Union and the damage, the burden of proof of which rests on the applicant, so that the conduct complained of must be the determining cause of the damage (see judgment of 13 December 2018, European Union v ASPLA and Armando Álvarez, C‑174/17 P and C‑222/17 P, EU:C:2018:1015, paragraph 23 and the case-law cited). Put another way, the Court must consider whether the unlawful act at issue is the immediate cause of the damage alleged in order to establish the existence of a direct relationship of cause and effect between the conduct of which the European Union is accused and the damage complained of (judgment of 20 January 2010, Sungro v Council and Commission, T‑252/07, T‑271/07 and T‑272/07, EU:T:2010:17, paragraph 49).

56

In the present case, it is clear that no such relationship has been established between the contested opinion and the damage alleged by Meta. It follows from the analysis carried out in paragraphs 20 to 36 above that the contested opinion does not produce mandatory legal effects; in other words, it is not binding. Therefore, it cannot be the sufficiently direct cause of the potential reduction in revenue that Meta claims to expect. Such damage could be the direct result of intentional conduct on Meta’s part or of possible decisions imposed on it, prompting it to offer users a free alternative in addition to a choice between consenting to the receipt of behavioural advertising and paying to access the service concerned without receiving such advertising.

57

All of the claims submitted on the basis of the non-contractual liability of the European Union must therefore be rejected as manifestly lacking any foundation in law, without it being necessary to examine the condition relating to the unlawfulness of the conduct alleged against the EDPB.

58

Accordingly, the action must be dismissed in its entirety.

59

In those circumstances, there is no need to rule on the applications to intervene submitted by the Council of the European Union, the European Parliament and Chamber of Progress, a company governed by US law.

60

Under Article 134(1) of the Rules of Procedure of the General Court, the unsuccessful party is to be ordered to pay the costs if they have been applied for in the successful party’s pleadings. Since Meta has been unsuccessful, it must be ordered to pay the costs, in accordance with the form of order sought by the EDPB.

61

In addition, under Article 144(10) of the Rules of Procedure, if, as here, the proceedings in the main case are concluded before the application to intervene has been decided, the applicant for leave to intervene and the main parties must each bear their own costs relating to the application to intervene. Given that the applications to intervene were not notified either to Meta or to the EDPB and they were therefore not put in a position where they might incur costs in that regard, the Council, the Parliament and Chamber of Progress must each be ordered to bear their own costs relating to the applications to intervene.

On those grounds,

THE GENERAL COURT (Tenth Chamber)

hereby orders: