Meta suffered a major defeat on Wednesday that could severely undercut its Facebook and Instagram advertising business after EU regulators found it had illegally forced users to effectively accept personalised ads.

The decision, including a fine of €390 million ($414 million), has the potential to require Meta to make costly changes to its advertising-based business in the EU, one of its largest markets.

The ruling is one of the most consequential judgments since the 27-nation bloc, home to roughly 450 million people, enacted a landmark data-privacy law aimed at restricting the ability of Facebook and other companies from collecting information about users without their prior consent. The law took effect in 2018.

The case hinges on how Meta receives legal permission from users to collect their data for personalised advertising. The company includes language in its terms of service agreement, the very lengthy statement that users must accept before accessing services like Facebook, Instagram and WhatsApp, which effectively means users must allow their data to be used for personalised ads or stop using Meta’s social media services.

Ireland’s data privacy board, which serves as Meta’s main regulator in the EU because the company’s European headquarters are in Dublin, said EU authorities determined that placing the legal consent within the terms of service essentially forced users to accept personalised ads, violating the European law known as the General Data Protection Regulation, or GDPR.

The decision does not specify how the company must comply with the ruling, but it could result in Meta allowing users to choose whether they want their data used for such targeted promotions.

If a large number of users choose not to share their data, it would cut off one of the most valuable parts of Meta’s business. Information about a user’s digital history — such as what videos on Instagram prompt a person to stop scrolling, or what types of links a person clicks when browsing their Facebook feeds — is used by marketers to get ads in front of people who are the most likely to buy.

The practices helped Meta generate $118 billion in revenue in 2021.

The penalty against Meta contrasts with regulations in the US, where there is no federal data privacy law and only a few states like California have taken steps to create rules similar to those in the EU. But any changes that Meta makes as a result of the ruling could affect users in the US; many tech companies apply EU rules globally because that is easier to implement than limiting them to Europe.

The EU judgment is the latest business headwind facing Meta, which was already grappling with a major drop in advertising revenue because of a change made by Apple in 2021 that gave iPhone users the ability to choose whether advertisers could track them. Consumer surveys suggest that a clear majority of users have blocked tracking.

Meta’s struggles come as it is attempting to diversify its business from social media to the virtual reality world known as the metaverse. It’s stock price has plummeted more than 60 per cent in the past year, and it has laid off thousands of employees.

Wednesday’s announcement relates to two complaints filed against Meta in 2018. Meta said it will appeal the decision, setting up what could be a prolonged legal fight that will test the power of the GDPR and how aggressively regulators use the law to force companies to change their business practices.