A Milan court on Tuesday approved a class action filed by the CTCU consumer association against Meta Platforms in connection with personal data taken from Facebook Italy, the court order shows.
The court noted that the data scraping occurred between January 2018 and September 2019 and that Meta disclosed the incident in 2021. According to the court order, the breach touched approximately 533 million Facebook users around the world.
CTCU is pursuing damages on behalf of social media users who either lost control over their personal information or reasonably feared that control had been compromised, arguing that the treatment of their data violated provisions of the EU's General Data Protection Regulation.
A legal source cited by the court papers estimated that roughly 35 million Facebook users in Italy may be among those affected by the scraping episode.
Meta issued a statement disagreeing with the court's procedural decision. The company said the ruling is a procedural matter only and does not amount to any finding that it broke the law. Meta added that it is confident the action is without merit and will ultimately be dismissed.
The court's acceptance of the class action allows the consumer group to move ahead with the case on behalf of identified groups of users, while Meta's comments indicate the company intends to contest the claim on its merits.
The matter centers on allegations that the scraping episode deprived users of the ability to control their personal data in ways that contravened GDPR protections. The court order, the disclosure date, the estimated global and Italy-specific user counts, and the positions of the plaintiff group and Meta are the elements reported in the proceedings to date.
Context and next steps
The authorization of a class action is a procedural milestone that permits consolidated litigation. The court order itself does not resolve whether any legal violations occurred; that determination would follow later in the judicial process if the case proceeds.