⚠ The Privacy ReckoningModerate threat

The data-and-targeting moat has always lived one major law away from a real constraint. So far Meta has faced a patchwork — Apple's device rules, Europe's tightening enforcement, a scatter of state statutes — but a comprehensive privacy regime, whether a US federal law or a decisive European settlement, could impose limits on data collection and use that reach the core of how the machine works, not merely its edges.

The danger is a rule that goes beyond cross-site tracking to restrict how Meta may use even its first-party data — requiring opt-in consent for personalized advertising, limiting how signals combine across its apps, or mandating data minimization. Such a law would strike the targeting where it is strongest, inside Meta's own walls, and no amount of first-party depth would fully protect against a rule about how that depth may be used.

For all the noise, comprehensive privacy legislation has proven remarkably hard to pass, especially in the United States, and where it exists it tends to permit consented personalization, which most users accept in exchange for a free service. Meta has also shown it can adapt its methods — modeled measurement, on-device processing, AI on first-party data — to comply while preserving much of the value.

Moderate is the right rating. A sweeping privacy law is the single regulatory event that could most constrain the data moat at its root, and the direction of policy runs that way — but such laws are slow and politically difficult, and consented personalization has so far survived every regime that has actually arrived — the EU's consent-or-pay and DMA rules are the live tests¹.