WhatsApp (Meta) vs EDPB case declared admissible by the CJEU – Will this set a precedent for future GDPR cases?

In February 2026, the Court of Justice ruled on the admissibility of WhatsApp’s case challenging the binding decision of the European Data Protection Board. This legal battle, which has been ongoing for years, has resulted in a declaration of admissibility that could have far-reaching consequences for future case law relating to the GDPR. 

In this policy monitor, we will provide an overview of the facts leading up to the case, the case's content before the Court of Justice, and its potential implications for companies.

On 10 February 2026 the Court of Justice ruled that the action brought by WhatsApp Ireland against Binding Decision 1/2021 of the European Data Protection Board (‘EDPB’) is admissible. The General Court had previously ruled that the action was inadmissible.

When the GDPR came into force in May 2018, a flood of complaints regarding WhatsApp, an American messaging service with billions of active users worldwide, were lodged with the Data Protection Commission (the Irish supervisory authority). These complaints, which came from both users and non-users, concerned the company’s processing of personal data.

In December 2018, the Data Protection Commission (‘DPC’) initiated an investigation into whether the company fulfilled, amongst other things, its obligations of transparency. This led to the DPC submitting a draft decision to all the other national supervisory authorities seeking their opinion on this matter. As no consensus was reached on certain matters of the draft decision (e.g. the manner in which the fines were calculated by the DPC and whether the principle of accountability was infringed),  the EDPB was involved in resolving the dispute, by adopting a position on the specific matter subject to objections. This led to the EDPB’s Decision 1/2021. In this decision, binding on all of the supervisory authorities, the EDPB found that certain provisions of the GDPR indeed had been infringed. The DPC was obliged to revise the corrective measures, including the amount of the total fines which originally was estimated to be a fine between 30 to 50 EUR million. 

Following this decision by the EDPB, the DPC proceeded to issue its final decision, which imposed fines for a total amount of 225 EUR million on WhatsApp.

Not satisfied with the consequences of the EDPB’s decision, WhatsApp initiated legal proceedings against it before the General Court via an action for annulment. The General Court, however, dismissed that action as inadmissible based on the argument that the EDPB’s decision is: 

1. not an act open to challenge and rather an intermediate act. Should WhatsApp want to challenge the decision, it can do so, however it would be limited to the final decision of the Irish supervisory authority before a national court, and;
2. the decision was not of direct concern to WhatsApp, among other reasons, because the decision does not constitute the final stage of the procedure set out in Articles 58, 60 and 65 of the GDPR. 

In reaction to this, WhatsApp initiated a challenge to the General Court’s order by appealing it before the Court of Justice (‘the Court’).

See the image below for guidance.

i. An act open to challenge

The Court determined that the EDPB’s decision is indeed an act open to challenge before the Courts of the European Union (both the General Court as well as the Court of Justice) for the purposes of the first paragraph of Article 263 TFEU.

In order to determine if an act produces binding legal effects, as mentioned under paragraph three of Article 263 TFEU, and in line with case law, the Court examined the following elements:

1. The substance of the act;
2. The effects in the light of objective criteria, such as content of the act, and as appropriate, the context in which it was adopted as well as the powers of the institution which adopted the act.

In the judgement, the Court states that the content of the act, i.e. the binding decision of the EDPB, and the powers of the body make it apparent that the decision at issue is an act which 1) emanates from an EU body and 2) is binding vis-à-vis third parties. 

To come to this conclusion, the Court refers to the following provisions of the GDPR:

ii. Of direct concern to WhatsApp

As mentioned before, Article 263 (4) TFEU states that any natural or legal person may institute proceedings against an act addressed to that person or which is of direct and individual concern to them, and against a regulatory act which is of direct concern to them and does not entail implementing measures. Thus, for an action to be admissible under this provision, the condition of direct and individual concern must be fulfilled.

• Individual concern

According to the Court WhatsApp is indeed individually concerned by the decision, since the decision concerns certain aspects of the draft final decision, which pertain to the situation of that undertaking.

• Direct concern

For a natural or legal person to be directly concerned by the decision, two cumulative conditions must be fulfilled.

1. The measure must have a direct impact on the legal situation of that person;
2. The measure leaves no room for discretion to the addressees who are entrusted with the task of implementing it. It is implemented purely automatic and based solely on EU provisions without the application of other immediate rules.

Relating to the first condition, the Court finds that there in indeed a direct link between the EDPB’s decision and its effects on WhatsApp’s situation. Following the EDPB’s intervention, WhatsApp was required to change its contractual relationship with the users of the messaging service.

With regard to the second condition, the Court determines that the EDPB’s decision is binding on both the lead supervisory authority (DPC), as well as the other supervisory authorities concerned. Both cannot depart from the EDPB’s position, and they are unconditionally bound by it. This pertains to the finding of the infringement as well as the obligation to increase the amount of the envisaged fines 

Whilst it is correct that the legal cases in question involve two different legal proceedings, one before the EU judicature (on the basis of Article 263 TFEU and in respect of the binding decision of the EDPB), and the other one before a national court (based on Article 78 GDPR, relating to the binding decision by the national supervisory authority), this does not mean that the effects of the EDPB’s decision should be qualified as ‘indirect’ in relation to WhatsApp.

Consequently, the Court states that the decision at issue is of direct concern to WhatsApp.

Based on the foregoing, the Court determines that the action brought by WhatsApp before the General Court is indeed admissible. It refers the case back to the General Court to consider the merits of the action.

Given the recent initiative by the European institutions to simplify data related legislation, such as the GDPR, this judgment by the Court of Justice is a welcome development for businesses, as it provides them greater legal predictability.

The judgment demonstrates that companies can indeed be affected individually and directly by decisions of the EDPB, even if those decisions are subsequently ‘transposed’ by the national supervisory authority into their own decision, which can be subject to a separate national appeals process. Furthermore, and even more importantly, it clarifies that an EU body such as the EDPB is not immune to judicial review. 

This decision could in that sense set a precedent for companies to directly challenge binding decisions of the EDPB at an EU-level. It can provide them with a degree of legal certainty in situations where the EDPB previously overruled the national decisions of the supervisory authority that had fewer negative implications for them (such as a lower fine amount). 

It remains to be seen how this case could potentially influence the manner in which the EDPB approaches its future binding decisions. It is worth highlighting, however, that no new binding decisions have been published in over two and a half years.