WhatsApp has recently gained significant support in its ongoing legal battle against the European Union's privacy watchdog, the European Data Protection Board (EDPB). On March 27, 2025, Advocate General Tamara Capeta of the Court of Justice of the European Union (CJEU) issued a non-binding opinion that criticized a lower tribunal's previous ruling regarding WhatsApp's challenge against the EDPB.
The conflict dates back to 2021 when the Irish data protection authority imposed a hefty fine of 225 million euros (approximately $242.2 million) on WhatsApp. This penalty stemmed from complaints about the company's handling of personal data in Ireland. The fine was escalated after the EDPB intervened, raising concerns over WhatsApp's data practices.
In 2022, WhatsApp sought to contest the EDPB's decision in a lower tribunal. However, the tribunal rejected the challenge, stating that WhatsApp lacked the legal standing to sue the authority, as it was not directly affected by the EDPB's ruling. Instead, the tribunal suggested that WhatsApp could pursue the matter in a national court regarding the Irish fine.
Following this setback, WhatsApp escalated the issue to the CJEU, Europe's highest court, seeking a more favorable outcome. The case, designated as C-97/23 P WhatsApp Ireland Ltd v European Data Protection Board, has drawn considerable attention due to its implications for privacy regulations across the EU.
In her opinion, Advocate General Capeta asserted that WhatsApp's challenge against the EDPB's decision should be considered admissible, and she recommended that the case be referred back to the General Court for a decision on its merits. This opinion is particularly noteworthy given that the CJEU tends to follow the recommendations of its advisers in approximately four out of five cases.
As the legal proceedings unfold, the CJEU is expected to issue a ruling in the coming months. This decision could have far-reaching consequences not only for WhatsApp but also for how data privacy regulations are enforced within the EU. The case highlights ongoing tensions between tech companies and regulatory bodies as they navigate complex issues surrounding user data and privacy rights.
WhatsApp's legal challenges reflect a broader trend in which technology companies are increasingly scrutinized for their data practices. The EU has been at the forefront of establishing stringent privacy regulations, particularly with the implementation of the General Data Protection Regulation (GDPR) in 2018. This regulation has set a high standard for data protection, compelling companies to be more transparent and accountable in their data handling practices.
The implications of the CJEU's forthcoming decision could resonate beyond WhatsApp, potentially shaping future cases involving data privacy and the authority of regulatory bodies. As the landscape of digital privacy continues to evolve, the outcome of this case will likely influence how companies approach compliance and governance in the digital age.
In the meantime, both WhatsApp and the EDPB are preparing for the next steps in this legal saga, with stakeholders on both sides keenly awaiting the court's ruling. The outcome will not only determine the fate of WhatsApp's fine but also set a precedent for how similar cases will be handled in the future.
As this situation develops, it underscores the critical balance that must be struck between protecting user privacy and allowing tech companies the freedom to operate and innovate. The case serves as a reminder of the ongoing challenges faced by regulators in keeping pace with the rapid advancements in technology and the complexities of data management in today's interconnected world.
