Ius Omnibus v Meta (<13)

Identification of the Parties

Plaintiff: Associação Ius Omnibus

Defendants: Meta Platforms, Inc e Meta Platforms Ireland Ltd

Court

Lisbon District Court – Lisbon Central Civil Court (Judge 12)

Number of the process

12261/25.8T8LSB (Popular action)

Request (in summary)

a) Declare that, since April 1, 2010, in relation to consumers represented by Facebook, and since May 25, 2018, in relation to consumers represented by Instagram, the Defendants have violated privacy and personal data protection rules and consumer rights by adopting misleading commercial practices that violate privacy and by unlawfully processing personal data without obtaining the free, informed, specific, and unambiguous consent of the minors represented by Facebook and Instagram and their respective parental guardians, expressed through a positive and clear act, and by failing to process the personal data and information of consumers represented by Facebook and Instagram on the basis of contractual necessity and legitimate interest, and on the basis of any other valid legal basis for processing; by processing sensitive personal data without a basis for processing; by failing to provide transparent, comprehensible, and easily accessible information in clear and simple language about the nature, scope, limits, and extent of personal data processing operations, namely the extent and amount of personal data collected and processed, as well as the processing of sensitive personal data, confusing the purposes and grounds for processing, in particular, failing to sufficiently and adequately inform consumers represented by Facebook and Instagram about the processing of their personal data for advertising purposes, and failing to adequately inform them about the transfer of personal data to the United States of America, and, in pursuit of their goal of generating profits, exposing and creating risks of exposure of the intimacy of their private and family life, subjecting and exposing consumers represented by Facebook and Instagram to excessive surveillance, without consent, contractual necessity, or legitimate interest, and without any other valid legal basis for processing, used to significantly influence their decisions and behaviors, manipulating their digital and extra-digital conduct, restricting free and independent decision-making, distorting or risking distorting the choices of consumers represented by Facebook and Instagram; by failing to ensure the security of the personal data of consumers represented by Facebook and Instagram.

b) The Defendants be ordered to cease the unlawful practices in question:

(i.) Implementing mechanisms to ensure that children under the age of 13 cannot register for accounts or use Facebook and Instagram services without the proper authorization of their parents or guardians;

(ii.) Refraining from continuing to process the personal data of minors represented on Facebook and Instagram without a valid legal basis and in accordance with lawful purposes and to the extent necessary for those purposes;

(iii.) Closing all Facebook and Instagram accounts belonging to users under the age of 13 (thirteen), while safeguarding the possibility of lawful consent being given by the respective holders of parental responsibility for the account to be maintained;

(iv.) Implementing mechanisms that ensure cookies or other tracking technologies are placed on the devices of minors represented on Facebook and Instagram only when there is valid consent from those with parental responsibility or strict contractual necessity;

(v.) Providing information to minors represented on Facebook and Instagram and their respective parental guardians in a concise, clear, and easily accessible manner regarding the processing and scope of their personal data;

c) The Defendants be ordered to refrain from processing the personal data of minors represented on Facebook and Instagram to train the Defendants’ Artificial Intelligence systems, without a valid legal basis and for purposes that are not specific, explicit, and legitimate, and to delete the personal data collected and processed unlawfully, including data inferred and/or derived from the personal data collected;

d) Declare that the practices of the Defendants caused damage to the diffuse and/or collective interests of freedom, self-determination, and free development of personality, moral integrity, personal data protection, consumer relations protection, and privacy protection;

e) Declare that the practices of the Defendants caused damage to the homogeneous individual interests of the consumers represented Facebook and Instagram;

f) The Defendants be ordered, jointly and severally, to fully compensate all minors represented by Facebook and Instagram in this lawsuit for the damages caused to them by the unlawful practices in question.

Status of the lawsuit

In progress

Consumer’s summons

21.11.2025 and 28.11.2025 – Order summoning the consumers for them to intervene in the proceeding, if they wish, and to declare in the case file whether or not they accept being represented by the Plaintiff, or if, on the contrary, they exclude themselves from such representation, failing which their passivity will be deemed to constitute acceptance.

What is the object of this action?

This is a collective action lawsuit for the protection of consumer relations and privacy and the protection of personal data, for the protection of children, the protection of the free development of the personality and self-determination of minors, for the defense of the moral, psychological and physical integrity and health of minors and the homogeneous individual interests of consumers, filed by Ius Omnibus.

The action is filed under articles 52(3) and 60(3) of the Constitution of the Portuguese Republic, articles 2, 5, 6 and 12 of the Collective Actions Law (Decree-Law 114-A/2023, of December 5), and articles 31 and 546(2) of the Code of Civil Procedure.

What unlawful conduct by Meta is at stake in this lawsuit?

At issue is the adoption of a set of misleading commercial practices, the violation of privacy, and the improper processing of personal data of Facebook service users residing in Portugal who, after April 1, 2010, and on their first use of the Facebook service or at a later date, were not yet 13 (thirteen) years of age.

It also concerns the adoption of a set of misleading commercial practices, the violation of privacy and the improper processing of personal data of users of the Instagram service, residing in Portugal, who, after May 25, 2018, and on their first use of the Instagram service or at a later date, were not yet 13 (thirteen) years old.

With regard to the provision of its Facebook services since April 1, 2010, and Instagram services since May 25, 2018, Meta processes the personal data of Facebook and Instagram users residing in Portugal who are under the age of 13 (thirteen) without obtaining their consent or the consent or authorization of their legal guardians, contractual necessity, or proportional legitimate interest, in accordance with lawful purposes.

Meta collects and processes sensitive personal data from Facebook and Instagram users residing in Portugal who are under the age of 13 (thirteen) without their explicit consent, without the explicit consent of their parents or guardians, and without any other valid legal basis for the processing of personal data. Meta’s processing of Facebook and Instagram users’ personal data is intrusive.

Meta does not process the personal data of Facebook and Instagram consumers under the age of 13 (thirteen) residing in Portugal in accordance with personal data protection rules, including under conditions that ensure adequate protection of personal data against unauthorized or unlawful processing.

Until July 9, 2023, Meta transferred personal data of Facebook and Instagram consumers under the age of 13 (thirteen) residing in Portugal to the US without a valid basis and without adopting adequate safeguards to ensure that the personal data of these consumers benefited from the same level of protection as in the EU, subjecting these consumers and their personal data to unauthorized surveillance by US public authorities.

Meta adopts conditions that are not easily understandable, failing to clarify adequately and sufficiently the amount and extent of the personal data of Facebook and Instagram consumers under the age of thirteen (13) that it collects and processes, including the processing of their personal data for personalized advertising purposes and for the creation and development of artificial intelligence models, and conveys false and misleading information about its Facebook and Instagram services, exploiting the information asymmetry in relation to its users.

Meta has placed and continues to place cookies and other tracking technologies on devices used by Facebook and Instagram users under the age of 13 (thirteen) residing in Portugal, without obtaining their consent or the consent or authorization of their parents or legal guardians, and without many of these cookies and/or other tracking technologies being strictly necessary for the provision of Facebook and Instagram services.

Through this conduct, Meta exposes and creates risks of exposure of the private lives of minors represented on Facebook and Instagram, subjecting them to excessive surveillance, used to influence their decisions and behaviors in a significant way, manipulating their digital and non-digital conduct and restricting the free and independent decision-making of minors represented on Facebook and Instagram.

Meta thus violates fundamental rights guaranteed by the Constitution, personality rights, the Unfair Commercial Practices Act, and the General Data Protection Regulation.

If successful, the lawsuit will force Meta to end its illegal practices and compensate Facebook and Instagram users under the age of thirteen (13) who have been harmed.

Who is represented in this action?

This class action represents all consumers residing in Portugal who, after April 1, 2010, were under the age of 13 (thirteen) when they first used the Facebook service or at a later date. They will only be represented in this action for the period during which they were users of the Facebook service under the age of 13 (thirteen).

This class action also represents all consumers residing in Portugal who, after May 25, 2018, on their first use of the Instagram service or at a later date, were not yet 13 (thirteen) years of age are also represented in this class action. They will only be represented in this action for the period during which they were users of the Instagram service under the age of 13 (thirteen).

Consumers do not have to do anything to be represented in the action and to be entitled to compensation if the action is successful (they only have to request their compensation at that time).

Any consumer who does not wish to be represented in this action may exercise their right to opt out through their legal representatives if the consumer is a minor, by communicating this intention to the court. Consumers may also decide to intervene in the proceedings through their legal representatives if the consumer is a minor, in support of Ius Omnibus, within the time limit set by the Court.

What is being asked in this action?

Ius Omnibus asks the Court, in summary, to:

a) declare that, since April 1, 2010, in relation to consumers represented by Facebook, and since May 25, 2018, in relation to consumers represented by Instagram, the Defendants have violated privacy and personal data protection rules and consumer rights by adopting misleading commercial practices that violate privacy and by unlawfully processing personal data without obtaining the free, informed, specific, and unambiguous consent of the minors represented by Facebook and Instagram and their respective parental guardians, expressed through a positive and clear act; by failing to process the personal data and information of consumers represented by Facebook and Instagram on the basis of contractual necessity and legitimate interest, and on the basis of any other valid legal basis for processing; by processing sensitive personal data without a basis for processing; by failing to provide transparent, comprehensible, and easily accessible information in clear and simple language about the nature, scope, limits, and extent of personal data processing operations, namely the extent and amount of personal data collected and processed, as well as the processing of sensitive personal data, confusing the purposes and grounds for processing, in particular, failing to sufficiently and adequately inform consumers represented by Facebook and Instagram about the processing of their personal data for advertising purposes, and failing to adequately inform them about the transfer of personal data to the United States of America; and, in pursuit of their goal of generating profits, exposing and creating risks of exposure of the intimacy of their private and family life, subjecting and exposing consumers represented by Facebook and Instagram to excessive surveillance, without consent, contractual necessity, or legitimate interest, and without any other valid legal basis for processing, used to significantly influence their decisions and behaviors, manipulating their digital and extra-digital conduct, restricting free and independent decision-making, distorting or risking distorting the choices of consumers represented by Facebook and Instagram; by failing to ensure the security of the personal data of consumers represented by Facebook and Instagram;

b) The Defendants be ordered to cease the unlawful practices in question:

(i) Implementing mechanisms to ensure that children under the age of 13 cannot register for accounts or use Facebook and Instagram services without the proper authorization of their parents or guardians;

(ii) Refraining from continuing to process the personal data of minors represented on Facebook and Instagram without a valid legal basis and in accordance with lawful purposes and to the extent necessary for those purposes;

(iii) Closing all Facebook and Instagram accounts belonging to users under the age of 13 (thirteen), while safeguarding the possibility of lawful consent being given by the respective holders of parental responsibility for the account to be maintained;

(iv) Implementing mechanisms that ensure cookies or other tracking technologies are placed on the devices of minors represented on Facebook and Instagram only when there is valid consent from those with parental responsibility or strict contractual necessity;

(v) Providing information to minors represented on Facebook and Instagram and their respective parental guardians in a concise, clear, and easily accessible manner regarding the processing and scope of their personal data;

c) The Defendants be ordered to refrain from processing the personal data of minors represented on Facebook and Instagram to train the Defendants’ Artificial Intelligence systems, without a valid legal basis and for purposes that are not specific, explicit, and legitimate, and to delete the personal data collected and processed unlawfully, including data inferred and/or derived from the personal data collected;

d) Declare that the practices of the Defendants caused damage to the diffuse and/or collective interests of freedom, self-determination, and free development of personality, moral integrity, personal data protection, consumer relations protection, and privacy protection;

e) Declare that the practices of the Defendants caused damage to the homogeneous individual interests of the consumers represented Facebook and Instagram;

f) The Defendants be ordered, jointly and severally, to fully compensate all minors represented by Facebook and Instagram in this lawsuit for the damages caused to them by the unlawful practices in question.

How do class actions and consumer redress work?

The mass compensation mechanism for consumers used here, provided for in the Portuguese rules on class actions, has not yet been tested in practice to the final stage. However, according to the law, the following will happen if the court finds in favor of Ius Omnibus:

a) The court will set the total amount of compensation to be paid by Meta to Facebook and Instagram consumers and determine how individual compensation will be distributed to each consumer (e.g., direct payment by a defendant or distribution by an entity designated by the court);

b) The court will set the manner and deadline for the represented Facebook and Instagram consumers to claim their share of the compensation (not distributed directly), and this information will be publicized in various ways;

c) Consumers (who do not receive compensation directly from a Defendant) must contact the entity responsible for managing the compensation fund, through their legal representatives if the consumer is a minor, and submit the evidence decided by the court and payment instructions in order to receive their share of the compensation;

d) At the end of the period set by the court, if any part of the total amount of compensation remains unclaimed by consumers:

(i) This amount will be used to pay the expenses incurred by Ius Omnibus in connection with the action;

(ii) The remainder shall be handed over to the State, in the proportion of 60% to the Fund for the Promotion of Consumer Rights and 40% to the Institute for Financial Management and Justice Equipment, I.P.

Do consumers need to contact the Court or Ius Omnibus?

Consumers do not have to contact the Court or Ius Omnibus, but it may be in their interest to do so.

All consumers residing in Portugal who, after April 1, 2010, in relation to the Facebook service, and/or after May 25, 2018, in relation to the Instagram service, on their first use of the Facebook and/or Instagram services or at a later date, were not yet 13 (thirteen) years old, are automatically represented in this class action.

If they do not wish to be represented, they must exercise their right to opt out through their legal representatives if the consumer is a minor.

If they wish to be represented, they do not need to do anything else for now to be entitled to compensation if Ius Omnibus wins this action.

At the end of the proceedings, if the action is successful, they may contact the entity designated by the Court (where applicable) to request compensation through their legal representatives if the consumer is a minor.

However, if they wish to intervene in the action in support of Ius Omnibus, they may do so within the time limit set by the Court through their legal representatives if the consumer is a minor.

All consumers represented in this action are invited to contact Ius Omnibus immediately, through their legal representatives if the consumer is a minor, so that their details can be recorded and they can be kept informed by Ius Omnibus of all developments in the case, ensuring that they do not miss the opportunity to claim compensation when the time comes. They can do so using the form available on this page.

How is this case funded?

Preparing a lawsuit of this nature in an adequate manner, allowing it to succeed, is extremely expensive, requiring the hiring of specialized lawyers and consultants. The success of the action depends on the proper handling of broad and technical facts, within an extremely complex area of legal, economic and technological knowledge. Effective reaction is also subject to the vast financial and human resources that will be mobilized by the counterparties.

However, consumers will never have to pay any money, bear any costs or waive any part of the compensation to which they are entitled. The case is financed by a foreign law firm that specializes in consumer protection actions, Lieff Cabraser Heimann & Bernstein.

The financing contract is subject to the scrutiny of the court, without the financier being able to interfere or determine the management of the case by Ius Omnibus.

The funder assumes all the risk and costs. If Ius Omnibus loses the case, the funder is not entitled to any compensation. If Ius Omnibus wins the case, the funder will receive the amount that the court decides is appropriate and fair.

The funder will only receive this amount if a portion of the overall compensation paid by the Defendants remains after the deadline for consumers to apply for individual compensation has expired. The remaining amount is then allocated in accordance with the applicable legal provisions.