Meta’s earning call yesterday was upbeat on better than expected revenue for the quarter. However buried in its disclosures to investors is a stark warning on looming regulatory risk it’s facing in Europe — where a decision is expected in a matter of weeks (by May 12) that could see the tech giant ordered to suspend its transatlantic data flows.

“We expect the Irish Data Protection Commission (IDPC) to issue a decision in May in its previously disclosed inquiry relating to transatlantic data transfers of Facebook EU/EEA user data, including a suspension order for such transfers and a fine,” Meta’s CFO wrote in its Q1 2023 report.

We’ve covered the (very) long-running saga — which hinges on a clash between US surveillance laws and EU privacy rights — most recently here and here. So regular TechCrunch readers will already know that a key development Meta is hoping will save its bacon in Europe is the adoption of a new high level data transfer pact which aims to resolve the legal uncertainty around EU data exports.

However the negotiations over this replacement deal have dragged on longer than expected and EU institutions are still reviewing the draft decision the Commission announced in December. So while the bloc had initially suggested the deal might be finalized by the end of 2022, it was forced to revise the estimate — saying in December that it hoped everything would be nailed down before July.

Since then, multiple EU institutions involved in reviewing the deal have been raising concerns — so there’s still no firm word on when exactly the thing might be done. (Or, indeed, whether a new deal will survive the inevitable legal challenges, given the two prior pacts got invalidated by the Court of Justice of the EU.)

In its earnings report, Meta tells investors it’s hopeful the new EU-US data framework will arrive soon enough to be implemented before the deadline for a suspension of its EU transfers — meaning, were these stars to align, it could reboot its claim to have an authorized mechanism for its EU transfers and flick the suspension order away — however the company also warns it “cannot exclude the possibility” that adoption won’t happen soon enough to prevent such an order.

“Our ongoing consultations with policymakers on both sides of the Atlantic continue to indicate that the proposed new EU-U.S. Data Privacy Framework will be fully implemented before the deadline for suspension of such transfers, but we cannot exclude the possibility that it will not be completed in time,” Meta writes. “We will also evaluate whether and to what extent the IDPC decision could otherwise impact our data processing operations even after a new data privacy framework is in force.”

During a call with investors, the social networking giant was asked about the potential impact on revenues if it is forced to suspend EU-US data flows on regulatory order. Responding, CFO Susan Li began by reiterating its hope that the new high level framework will save its bacon. However, if this sought for escape hatch fails to open in time, she warned investors Meta is facing a hit of around a tenth of its worldwide ad revenue — saying “roughly 10%” of this comes from ads delivered to Facebook users in EU countries.

Li caveated the disclosure by saying it’s difficult for Meta to forecast the overall impact of any EU data suspension at this point, given it lacks information on what a final order would contain — such as the length of a suspension.

Earlier in the call Meta’s CFO offered a breakdown of ad revenue growth by regions, saying it was strongest in the “Rest of World” segment (at 9%) during the quarter, followed by North America and Asia-Pacific (6% and 4%, respectively) — while she specified that Europe had declined 1%.