Facebook and Instagram owner Meta Platforms Inc (NASDAQ:FB) has been fined €390mln (£346mln) by the Irish Data Protection Commission (DPC) for violating EU data regulations.
The watchdog found that Meta's method of obtaining consent to use people's data for ads on its platforms was unlawful.
Meta has three months to change its data usage practices, potentially altering the way a key part of its business operates.
The company has said that it intends to appeal the decision, arguing that it is "disappointed" and that the ruling does not prevent personalised advertising.
The DPC stated that Facebook and Instagram cannot "force consent" by telling users they must accept data usage or leave the platform.
As the social media giants have European headquarters in Ireland, the DPC is responsible for ensuring their compliance with EU data law.
The decision has been hailed as a major victory by privacy campaigners, who believe that it means Meta will have to give users real choice over how their data is used to target online advertisements.
Separately, Apple Inc (NASDAQ:AAPL) was fined a comparatively modest €8mln by France's data protection authority, CNIL, for violating privacy regulations.
The regulator found that Apple did not "obtain the consent of French iPhone users" before depositing and/or writing identifiers for advertising purposes on their devices.