Historical May 2023 decision. Do not treat it as a statement of all current transfer rules or appeal outcomes.
What happened
The Irish DPC’s May 2023 Meta decision included a €1.2 billion fine concerning transfers of Facebook user information from the EU/EEA to the United States. The published decision found an infringement of Article 46(1) following the Schrems II judgment. This article describes that decision, not the current legal position of every EU–US transfer.
Source: Irish DPC — original source ↗
What it means for your website
International transfer arrangements can change through legislation, adequacy decisions, court judgments and supplier updates. Keep a dated record of the arrangement you rely on and review it when the service changes. Avoid two equally unhelpful shortcuts: assuming all overseas tools are prohibited, or assuming a famous provider must have settled everything for your business. Your task is to understand what information leaves your systems and the arrangement that applies to it. Browser testing can identify some external connections, but it cannot certify the legal safeguards behind them. Treat the scan as evidence for a broader review where needed.
Three useful next steps
- Maintain a dated supplier and transfer record.
- Review changes to provider terms and locations.
- Seek specialist advice where the arrangement is unclear.
Sources & context
Official sources consulted on 1 October 2026. A regulator’s announcement records its findings at that time; it is not proof of payment or the outcome of every later appeal.
Irish DPC — original sourceOur practical suggestions are GDPRFix commentary. A public website scan cannot establish your full legal position. For advice on a specific obligation or enforcement matter, use a suitably qualified adviser.