The European Commission, which oversees data protection, decided on Wednesday to expand the prohibition on “behavioural advertising” on Facebook and Instagram, which was enforced by Norway, a non-EU country, to all 30 member states of the EU and the EA.

The owner of the two social media platforms, U.S. software company Meta Platforms (META.O), has resisted efforts to limit the practice, so the restriction on such advertising, which targets users by harvesting their data, is a setback.

Meta runs the risk of getting fined up to 4% of its global turnover, the Norwegian data regulator said.

The decision by the European Data Protection Board (EDPB) is an instruction to the data regulator of Ireland, where Meta’s European headquarters are located, to impose a permanent ban on the company’s use of behavioural advertising within two weeks, EDPB said in a statement to Reuters.

“On 27 October, the EDPB adopted an urgent binding decision … to impose a ban on the processing of personal data for behavioural advertising on the legal bases of contract and legitimate interest across the entire European Economic Area,” it said.

Meta on Wednesday said it had already said it would give users in the EU and the EEA the opportunity to consent, and would offer, in November, a subscription model to comply with regulatory requirements.