For four years, Meta has been battling European Union regulators over how its apps, Facebook and Instagram, collect user data to personalize ads. The key question for regulators was whether Meta’s so-called contract legal basis—which lumps the user consent agreement into its apps’ terms of services—forced its users to choose between consenting to data collection or losing all access to the social platforms.

Yesterday, the EU’s lead privacy watchdog, the Irish Data Protection Commission (DPC), finally reached two decisions, deciding that Meta had illegally forced consent from both Facebook and Instagram users. Now, Meta must pay a $414 million fine and update its apps over the next three months to come into compliance with the EU’s General Data Protection Regulation (GDPR).

Ars could not immediately reach DPC for comment.