This article discusses data-related class actions in the UK following the announcement in January 2022 of a competitive collective action against Meta (Facebook) regarding data collection practices. This is notable as the first foray of competition collective actions into the area of data privacy and coincides with the Supreme Court’s decision in Lloyd v Google, appearing to limit the scope for collective data privacy claims under the CPR 19.6 representative action mechanism. The article looks at the recent expansion of the UK competition collective proceedings regime (especially since the UK Supreme Court’s judgment in Merricks v Mastercard set the bar for certification of US-style “class actions” for competition law breaches at an apparently low level) and considers the risk that this presents to businesses in the form of collective actions relating to the use (or alleged misuse) of data.