The highest legal adviser to the Court of Justice of the European Union said in a preliminary opinion that any EU country can take legal action against companies such as Facebook over violations of data privacy rules—not just the main regulator in charge of the company.

"The lead data protection authority cannot be deemed as the sole enforcer of the GDPR in cross-border situations, and must, in compliance with the relevant rules and time limits provided for by the GDPR, closely cooperate with the other data protection authorities concerned," the opinion said.

If adopted by the Court of Justice, the ruling could have significant consequences for tech companies, as some EU countries are more aggressive than others on enforcement of the General Data Protection Regulation, known as GDPR, that was implemented in 2018. The companies could therefore face more investigations.