Originally published 2022-02-10.
In early February 2022 a single paragraph in Meta's annual report to the US Securities and Exchange Commission set off headlines across Europe: Facebook and Instagram might be pulled from the continent. The company, renamed from Facebook a few months earlier, said that if it lost its legal means of moving Europeans' data to the United States, it would probably be unable to offer its main apps in Europe.
Was it a threat, a bluff or a routine legal disclosure? Mostly the last. US-listed companies must tell investors about serious risks to their business, and this was one. Meta quickly said it had no plan to leave, and in the end Facebook and Instagram never went anywhere. But the warning pointed to a real legal problem that took until July 2023 to solve.
What Meta's annual report actually said
The passage appeared in the risk factors section of Meta's annual filing for 2021. It said that if a new transatlantic data transfer framework was not adopted, and the company could not keep using Standard Contractual Clauses or other alternatives, "we will likely be unable to offer a number of our most significant products and services, including Facebook and Instagram, in Europe." It added that this would seriously harm its business and finances.
Companies write such sections to protect themselves from accusations that they hid known dangers from shareholders. Language like "likely be unable" describes a possible future, not a decision. Meta was far from alone: reporting at the time noted that at least 70 companies, including ten European businesses, flagged similar data-transfer risks in their filings.
Meta's response: "no desire to withdraw"
As the story spread, Meta moved to calm things down. Markus Reinisch, its vice president of public policy for Europe, wrote that Meta was not wanting or threatening to leave and that reports suggesting otherwise were untrue. He added: "We have absolutely no desire to withdraw from Europe; of course we don't."
His point was that the company was describing a legal risk, not making a demand. Facebook had flagged similar concerns before, in earnings statements after earlier court rulings, but the 2022 report was the first time it named Facebook and Instagram specifically. That detail is what made the headlines.
Why data transfers were a problem in the first place
EU data protection law, the General Data Protection Regulation (GDPR), allows personal data to leave Europe only if it will be protected to a standard essentially equivalent to EU law. The question has always been whether US surveillance programmes allow that.
Two rulings by the Court of Justice of the European Union (CJEU), both triggered by complaints from Austrian privacy campaigner Max Schrems, made the answer complicated:
- On 6 October 2015 the court struck down Safe Harbor, the EU–US arrangement in place since 2000.
- On 16 July 2020, in the case known as Schrems II, it invalidated its successor, the Privacy Shield, over US intelligence agencies' access to data.
The 2020 ruling kept Standard Contractual Clauses (SCCs), model contracts between companies, alive in principle. But it said data protection authorities must stop transfers if the receiving company is exposed to surveillance that EU law does not allow. Some early reports blurred this point: it was the EU's top court, not Ireland's regulator, that ruled on SCCs. In September 2020 the Irish Data Protection Commission, Meta's lead regulator in the EU, then sent Facebook a preliminary order to stop sending EU users' data to the US. That pending case was the specific threat behind the February 2022 warning.
Not the first standoff: Australia in 2021
Meta's warning reminded many people of a real confrontation a year earlier. In February 2021 Australia was about to pass the News Media Bargaining Code, which would require big platforms to pay news publishers for content. On 17 February Facebook responded by blocking news on its platform in Australia: Australians could not see or share news links, and for a time some government, health and emergency pages were caught up in the block.
The ban lasted only days. On 22 February Facebook announced an agreement with the government after amendments were offered, news returned, and the law was enacted that month. Both episodes showed that the company was willing to take hard positions, and that governments and platforms usually find a compromise before users are cut off for long.
How the data dispute was resolved
Weeks after the annual report, on 25 March 2022, the European Commission and the United States announced an agreement in principle on a new transatlantic data framework. On 7 October 2022 President Biden signed Executive Order 14086, adding limits on US intelligence gathering and creating a Data Protection Review Court to handle complaints from Europeans.
The Irish case still reached its conclusion. On 12 May 2023 the Data Protection Commission fined Meta a record €1.2 billion and ordered it to suspend transfers of Facebook users' data within five months. Before that deadline mattered, the European Commission adopted its adequacy decision for the EU–US Data Privacy Framework on 10 July 2023, giving companies like Meta a new legal basis. Facebook and Instagram stayed online throughout.
Privacy campaigners, including Schrems's organisation noyb, have said they will challenge the new framework as well, so the long legal argument over transatlantic data may not be finished.
Reading corporate warnings without panic
The February 2022 story is a useful example of how a cautious line in a financial filing can turn into "Facebook to quit Europe" within hours. A few habits help when similar headlines appear:
- Find the original wording. "May", "could" and "likely" in a risk disclosure describe scenarios, not plans.
- Look for the company's follow-up statement. Here, Meta's clarification arrived within days.
- Ask what would have to happen first. A shutdown required a final regulatory order with no new framework in place, and governments were already negotiating one.
The dispute ended with a large fine and a new legal framework rather than a blackout, and with Europeans' data rights better defined than before.
Sources: The Independent (original report, February 2022); PetaPixel, 8 February 2022; Wikipedia: Schrems II; Wikipedia: EU–US Data Privacy Framework; Wikipedia: News Media Bargaining Code; PwC Legal, May 2023.
COMMENTS