> To recap: a law was put in place 5 years ago that said if you get consent you can basically use data in any way, with some very vague and general language about how consent can be gathered and what it means.

The article makes it seem pretty straightforward:

> Meta explained that its updated terms rely on the GDPR concept of "contractual necessity". The GDPR mostly prohibits companies from forcing users to turn over personal information to use their services. The only exception is when that information is necessary to execute a contract: For instance, a car sharing app needs to know your location so that it can show cars near you.

For a car sharing app, it is necessary for them to get your location for the service to work. In Facebook's case, personalized ads are not necessary for Facebook to work. Since it isn't necessary, Facebook needs to get express permission to use personal information for ads.

Facebook took an overly optimistic view of the law expecting regulatory capture to allow them to skirt the rules. It didn't work, so their investment was a poor one. Regulators didn't force Facebook to make a poor investment.

Also, Facebook can decide to pay the users it tracks in Europe. Maybe the investment has poor returns, but the money hasn't entirely gone to waste yet.