A Canadian appellate court has ruled that Facebook breached federal privacy laws by not getting meaningful consent from users before handing their personal data to third parties and failed in its obligations to safeguard it.

A unanimous three-judge panel of the Federal Court of Appeal said Facebook, now known as Meta Platforms, didn’t adequately inform users who signed up to the platform between 2013 and 2015 about risks to their data, as required by Canada’s Personal Information Protection and Electronic Documents Act.