Meta's lead data protection regulator, the Irish Data Protection Commission (DPC), issued the final decisions but only after more than a year of dispute with over EU DPAs who disagreed with its draft decision (which did not object to Meta claiming contractual necessity to microtarget ads); and, at the last, after incorporating a binding decision by the European Data Protection Board (EDPB) — which settled the dispute by forcing the DPC to reject Meta's claim of contractual necessity. The EDPB also required Meta to substantially increase the size of the financial penalty issued to Meta for breaching the EU's General Data Protection Regulation (GDPR). So while the Irish DPC's name and branding is on these documents they are a product of a co-regulatory process that's baked into the GDPR, via a cooperation mechanism for dealing with cross-border cases.