The Irish DPC's decision proposes imposing an order on Facebook to bring its terms of service and Data Policy into GDPR compliance within three months. However, the DPC indicates that Facebook is permitted to rely on contractual necessity for its personalized advertising.