Spain opens investigation into Meta over alleged large-scale privacy violations

Spain’s Prime Minister Pedro Sánchez has announced a formal investigation into Meta following allegations that the company covertly tracked the web activity of millions of Android users. The probe, which will be handled by the Committee on Economy, Trade and Digital Transformation of the Spanish Parliament, aims to determine whether Meta violated European privacy and digital-market rules.

The announcement follows research conducted by three academic centres: IMDEA Networks in Spain, KU Leuven in Belgium, and Radboud University in the Netherlands. According to their findings, Meta deployed a hidden mechanism that collected information about websites visited through Android browsers and linked that behaviour to users’ identities on Facebook and Instagram. Researchers say the tracking occurred even when users enabled incognito mode or a VPN, raising concerns about deliberate circumvention of privacy settings.

Spanish authorities will assess whether the alleged practices violated the General Data Protection Regulation (GDPR), the ePrivacy Directive, the Digital Markets Act (DMA), and the Digital Services Act (DSA). The findings also relate to class-action lawsuits already filed against Meta in Germany, the United States, and Canada. Sánchez stressed that the investigation aims to clarify the facts and uphold fundamental rights, stating that in Spain ‘the law takes precedence over any algorithm or any large technology platform.’

Alongside the probe, the government announced a wider package of measures to address four priority risks in the digital environment: disinformation, child protection, hate speech and social polarisation, and privacy. Sánchez said these measures deliver on commitments outlined at the World Economic Forum in Davos, where he warned about growing digital-era imbalances between technology companies and democratic institutions. While acknowledging the benefits of social media, he argued that regulatory action is necessary to restore trust and better protect citizens, particularly younger users.