01When Facebook Was the Internet
In 2013, Facebook launched the programme Internet.org, renamed Free Basics in 2015. The idea sounded appealing: in countries with expensive data tariffs, people would be able to access a selection of websites free of charge, including Facebook, Wikipedia, some news sites and health apps.[1]
Free Basics was a Walled GardenWalled GardenA closed digital ecosystem in which a company controls which content and services are available. With Free Basics, Facebook decided which websites users were allowed to visit for free, and which they were not., an enclosed garden that Facebook controlled. Facebook decided which websites were permitted. Competitors found it difficult to be included. Anyone signing up first had to create a Facebook account.[2]
India: The Great Failure
India was Facebook's most important target market. In 2015, Free Basics launched there through a partnership with Reliance Communications. Facebook promoted the programme aggressively — including through a campaign in which Indian users automatically sent pre-written emails to the regulatory authority TRAI without fully realising it. TRAI publicly described this as "astroturfingAstroturfingFabricated grassroots pressure: a company simulates broad public support. Facebook caused Indian users to automatically send pre-written emails to the regulatory authority." — simulated grassroots pressure.
On 8 February 2016, TRAI banned Free Basics in India. The reason: violation of net neutralityNet neutralityThe principle that all data on the internet must be treated equally — regardless of whether it comes from Google, a small blog or Facebook. No provider may be given preferential or disadvantaged treatment. Free Basics violated this, because only Facebook-approved sites were free of charge.. The internet must not be divided into first- and second-class offerings.[1]
Egypt: Who Gets the Data?
In Egypt, Free Basics ended because Facebook refused to give the Egyptian government surveillance access to user data.[4] With Free Basics, the question was who gets the data.
The Hidden Problem: Users Were Secretly Charged
Free Basics promised free internet — but only for a limited list of approved content. Everything else — ordinary websites or videos outside the programme — would have consumed regular data allowances and therefore cost money.
Internal documents published by whistleblower Frances Haugen showed that this happened anyway. Through technical errors or intentionally embedded content, videos and material appeared in Free Basics that did not belong to the free package. The system quietly deducted this data from users' credit balances, without warning, without explanation. Internally, Facebook called the problem "leakage".
In Pakistan alone, users were charged an estimated $1.9 million per month in this way. The same occurred in nearly two dozen other countries. Particularly hard hit were people on prepaid plans worth just a few dollars — they only noticed something was wrong when their entire credit balance had been exhausted.[6][7]
02The Most Serious Case
Before 2012, fewer than 1% of the population in Myanmar had internet access. Then a wave of telecoms liberalisation arrived. Smartphones became affordable, data tariffs cheap. Millions of people suddenly came online — almost all via Facebook. In 2015, Free Basics followed.
"For many in Myanmar, Facebook is Google, LinkedIn, Tinder, Tumblr, and Reddit, all in one."
Schissler, Yale University, 2024 [13]What Happened in 2016–2017
The Myanmar military (Tatmadaw) launched "clearing operations" against the Muslim Rohingya minority from 2016 onwards. What followed was described by the UN as genocide.
- At least 6,700 Rohingya were killed in the first month of the attacks
- Over 700,000 Rohingya fled to Bangladesh
- Villages were burned to the ground; women were subjected to mass rape
In the weeks before: a torrent of hate speech, disinformation and incitement to violence — on Facebook.[8]
What the UN Says
The UN Fact-Finding Mission on Myanmar concluded that Facebook played a "determining role" in enabling the violence. The UN Human Rights Council described Facebook as a "useful tool for those seeking to spread hatred".
According to the UN report, the military operated dozens of ostensibly independent Facebook pages to spread hatred against the Rohingya. Accounts with a combined following of nearly 12 million — roughly half of all Myanmar Facebook users — were only removed in 2018.[11]
Amnesty International: Meta Knew
In September 2022, Amnesty International published the report "The Social Atrocity: Meta and the Right to Remedy for the Rohingya". It drew on interviews with refugees, former Meta employees and internal documents from the Haugen leak.
Core finding: Facebook's algorithmsAlgorithmComputational rules that determine which content appears in your feed. Facebook's algorithm favours emotionally charged content because it generates more engagement — even when that content is hate speech or disinformation. actively amplified anti-Rohingya content because it was emotionally provocative and increased time spent on the platform. Not out of malicious intent — because that is how the business model functions. Outrage keeps users on the platform longer.[9]
An internal Meta document from August 2019 openly acknowledged the problem:
"We have evidence from a variety of sources that hate speech, inflammatory political speech and misinformation on Facebook are affecting societies around the world. We also have strong evidence that our core product mechanics, such as virality, recommendations and optimising for engagement, are a significant cause of why these types of speech flourish on the platform."
Internal Meta document, August 2019, as cited by Amnesty International"While the Myanmar military was committing crimes against humanity against the Rohingya, Meta was profiting from the echo chamber of hatred that its algorithms created."
Agnès Callamard, Secretary-General of Amnesty International [9]The Lawsuit: $150 Billion
In December 2021, Rohingya refugees filed a class action against Meta — in the United States and the United Kingdom — claiming $150 billion. The US federal court dismissed the case in January 2024 due to an expired statute of limitations. The plaintiffs appealed — the case is currently before the 9th Circuit Court of Appeals.[54]
In parallel, Amnesty International, Open Society and Victim Advocates International filed a SEC whistleblower complaintSECSecurities and Exchange Commission — the US financial markets regulator. Whistleblowers can file complaints when companies mislead investors about risks. Amnesty International filed such a complaint against Meta concerning Myanmar. in January 2025: Meta had misled investors about its role in Myanmar and failed to disclose the risks in its annual reports — even though the company was internally aware of the escalating violence.[55][56]
Meta has so far paid no reparations and denied all liability.
03Duterte and the Troll FactoriesTroll factoryOrganised groups of paid employees who operate mass fake accounts on behalf of political actors, spread disinformation and intimidate critics. Duterte's 2016 campaign deployed hundreds of such trolls.
The Philippines is regarded in research as "Patient Zero" of the political weaponisation of social media. Katie Harbath, then head of global elections policy at Facebook, used this term herself in a speech.[21]
Over 90% of the Philippine population (around 110 million people) use Facebook. For many, it is the only portal to news and public discourse.
Duterte's 2016 Election Campaign
Rodrigo Duterte won the 2016 presidential election with a sophisticated network of paid trolls, fake accounts and coordinated disinformation campaigns — on Facebook. And Facebook trained him to do it:
"To grow the Philippine market, Facebook trained then-presidential candidate Duterte and his campaign staff how to use its technology."
Washington Post, 25 February 2019 [17]Maria Ressa and the Consequences
Maria Ressa, founder of the Philippine investigative outlet Rappler and later Nobel Peace Prize laureate (2021), systematically documented the scale of the disinformation campaigns. The consequence: the Philippine government brought tax charges against Rappler; Ressa was arrested and subjected to a travel ban. Update 2025: in 22 out of 23 proceedings, Ressa was acquitted or the charges were dropped, including all tax charges (February 2025) and the anti-dummy case (June 2025). The only remaining matter is the appeal in the 2020 cyber-libel conviction before the Philippine Supreme Court.
Ressa told the US press: "Facebook is to blame." The company had known that its algorithm placed hatred and lies above real news, and had done nothing.[18]
04WhatsApp Tilts an Election
Brazil, 2018: Jair Bolsonaro wins the presidential election. The disinformation campaign did not run via Facebook posts but via WhatsApp mass messages — coordinated, organised, forwarded millions of times.[25]
The problem: WhatsApp is end-to-end encryptedEnd-to-end encryptionMessages are encrypted on your device and only decrypted on the recipient's device. Not even WhatsApp/Meta can read the content. The problem: fact-checkers also cannot see disinformation in encrypted groups.. Fact-checkers cannot view content. Lies spread in closed groups before anyone can respond. Researcher Fernanda Campagnucci spoke of an "information ecosystem that favours disinformation".[26]
In 2022, the same pattern repeated itself during the elections between Lula and Bolsonaro — despite platform deletion obligations.[27]
Chapter 5 — India05BJP and the Hate Speech Pact
In 2020, the Wall Street Journal revealed that Ankhi Das, then Facebook's head of policy for India, South and Central Asia, had internally blocked the application of hate speech rules to politicians of the ruling BJP (Bharatiya Janata Party), because she feared it would harm Facebook's business interests in India.[31]
Ankhi Das resigned in October 2020 — after several BJP politicians whose hate speech had been exempted from enforcement were identified and publicly named.[36]
06The Shift to the Right
The chronology:
Earlier, in the summer of 2024, Trump had publicly threatened to have Zuckerberg imprisoned, and Meta was facing an ongoing FTC monopoly lawsuit. Trump's reaction to the abolition of fact-checkers: Meta had "come a long way".
What the End of Fact-Checking Means
According to the Poynter Institute, Meta's fact-checker partnerships funded 45% of the total income of all professional fact-checking organisations worldwide. The end of these partnerships affects not only Meta's platforms but the entire industry, including independent organisations that verify disinformation outside of Facebook.[43]
Update: FTC Monopoly Lawsuit
The FTCFTCFederal Trade Commission — the US consumer protection authority. In 2020 it sued Meta over the acquisition of Instagram and WhatsApp, with the aim of forcing Meta to break up. The case is under appeal. sued Meta in 2020 over the purchase of Instagram (2012) and WhatsApp (2014) — with the aim of forcing Meta to break up. On 18 November 2025, Judge James Boasberg ruled in Meta's favour: the FTC had not been able to prove that Meta held a monopoly — TikTok and YouTube are now regarded as genuine competitors. On 20 January 2026, the FTC filed an appeal.[57][59]
What the trial documents show: Zuckerberg's own 2012 email concerning the Instagram acquisition became public: "One way of looking at this: we are really buying time."
Chapter 7 — PRISM07The NSA's Access to Your Facebook Data
When you use Facebook, your data ends up on servers in the United States. That is widely known. Less well known is the fact that US intelligence agencies can access this data — without a judge, without suspicion, without you ever finding out. The programme is called PRISMPRISMSecret mass surveillance programme of the NSA since 2007. Allows direct access to user data from US technology companies — Facebook since 2009. Exposed by Edward Snowden in 2013. Affects all non-US citizens, meaning all EU users..
What PRISM Is
PRISM is a secret surveillance programme of the NSA (National Security Agency), established in 2007 under the Bush administration. Legal basis: Section 702 FISASection 702US law permitting the NSA to demand communication data on non-US citizens directly from technology companies — without a court order, without suspicion, without notification. Every Facebook user in Germany automatically meets the conditions. of 2008. This law allows the NSA to demand communication data on non-US citizens outside the United States directly from US technology companies — Facebook has been participating since 2009.[63]
The mechanism: the NSA passes a "selectorSelectorA search term for surveillance: for example, an email address or telephone number. The NSA passes the selector to the FBI, which legally compels Facebook to hand over all data." to the FBI — for example, an email address. The FBI issues a legally binding directive to Facebook. Facebook is obliged to hand over all communication content relating to that selector — on an ongoing, automatic and comprehensive basis. According to leaked NSA documents, at the time of the Snowden revelations 91% of all NSA data under FISA 702 came from PRISM.[64]
Section 702 requires no concrete suspicion, no individual judicial authorisation and no notification of those affected. It is sufficient that the target is not a US citizen and is located outside the United States. Every Facebook user in Germany automatically meets this condition. Section 702 was renewed in April 2024 for a further two years and lapsed for the first time on 12 June 2026, after the House and Senate failed to agree on reform despite two short extensions. That does not end the surveillance: the FISA Court certifications from March 2026 run until March 2027, and collection under them continues.[65]
Snowden Reveals PRISM — 2013
On 6 June 2013, The Guardian and the Washington Post published secret NSA presentation slides — leaked by Edward Snowden, then an NSA contractor. The slides confirmed publicly for the first time: PRISM exists; Facebook is involved; the NSA can access emails, direct messages, photos and metadata.
Zuckerberg immediately stated that Facebook had "never received a blanket request" from any authority. PRISM operates through targeted directives to individual selectors. The sum of these accesses can affect millions of users.[66]
Schrems I and II — Europe's Response
Austrian data protection activist Max Schrems filed a lawsuit against Facebook Ireland a few weeks after the Snowden revelations. His argument: the transfer of EU user data to the United States was illegal because US intelligence law cannot guarantee adequate data protection.
The European Court of Justice (ECJ) ruled in his favour twice:
- Schrems I (October 2015): The EU–US Safe Harbour agreement is invalid. US surveillance programmes such as PRISM are incompatible with the EU's fundamental right to privacy.
- Schrems II (July 2020): Its successor "Privacy Shield" is also invalid — for the same reasons. As long as Section 702 exists, US companies cannot adequately protect EU data.[67]
- EU–US Data Privacy Framework / DPF (July 2023): A new agreement entered into force; Meta has since transferred Facebook data on this basis. The DPF survived its first legal challenge in September 2025 (the Latombe case before the General Court). NOYB is preparing a more comprehensive case before the ECJ. The underlying structural problem of FISA 702 remains unresolved.
After Schrems II, Meta switched to so-called Standard Contractual ClausesSCCsEU standard contractual clauses for international data transfers. After the fall of Privacy Shield, the last legal basis on which US companies may process EU data. Problem: they offer no protection against FISA 702, since US law takes precedence. (SCCs) and implemented technical safeguards — including data encryption. The Irish DPCDPCData Protection Commission — the Irish data protection authority. Responsible for Meta across the entire EU, since Meta's European headquarters are in Dublin. Has imposed Meta fines totalling over €2.5 billion. examined whether these measures were sufficient. The conclusion was clear: No. FISA 702 obliges Facebook to hand over data on request. Encryption offers no protection if the company holds the key itself and can be legally compelled to surrender it.[68]
Chapter 8 — Europe vs. Meta08GDPR Fines: €2.5 Billion and Rising
Meta is by far the most frequently and heavily penalised company under the GDPRGDPRGeneral Data Protection Regulation — the EU data protection law since 2018. Violations can be punished with up to 4% of worldwide annual turnover. Meta has received over €2.5 billion in GDPR fines to date.. Meta appears six times on the list of the ten highest GDPR fines ever imposed.[50]
| Year | Amount | Reason |
|---|---|---|
| 2022 | €405m | Instagram: children's data made public; accounts without consent |
| Jan. 2023 | €390m | Facebook + Instagram: users coerced into consenting to advertising |
| May 2023 | €1.2bn | Facebook: EU user data transferred to the US without a valid legal basis — highest GDPR fine ever imposed |
| Dec. 2024 | €251m | Facebook: 2018 data breach affecting 29 million accounts |
The €1.2 billion fine is the direct consequence of PRISM and Schrems II: Facebook transferred EU user data to the United States for years — even after Privacy Shield was declared invalid in 2020. None of the technical safeguards Meta implemented were sufficient to prevent access by US intelligence agencies under FISA 702.[49][68]
"The maximum fine would be over four billion. And Meta knowingly violated the GDPR for ten years in order to make a profit."
Max Schrems, Austrian data protection activist09It Is a System
Meta is a political power.
In countries where Facebook is the internet, Meta decides which information people see, and which they do not. It decides which politicians are exempted from hate speech rules. It decides whether algorithms amplify or dampen hatred.
Myanmar, the Philippines, Brazil and India follow the same pattern. And when the political climate shifts, as it did in the United States in 2024, Meta shifts with it.
The FTC's appeal against Judge Boasberg's ruling has been pending since 20 January 2026.