WASHINGTON A new era of internet regulation is about to begin.

Years after Facebook and Google went public, regulators in the United States and abroad are finally taking a closer look at the internet behemoths. And theyre not only looking at the way these companies have come to dominate markets, but also examining the heart of the two firms business models. What they decide will have powerful implications for the way we do business on the internet.

Most people associate Facebook with cute family photos and think of Google like a semi-reliable encyclopedia. But these services have only a tangential relationship to the way either company actually makes money. The twin Silicon Valley titans rely on two closely intertwined technologies, customer surveillance and advertising, to maximize shareholder profits. The pair control 63 percent of the U.S. digital advertising market, and in 2016, they secured 99 percent of all digital advertising growth. That profit-making combo is exactly what regulators are focused on in 2018.

Many of the companies difficulties stem from the European Unions tough new stance on privacy. The biggest threat to their business model comes from the General Data Protection Regulation, new data privacy rules set to go in effect in the EU in May. For the most part, Facebook and Google prevent you from using their products if you decline to agree to their entire terms of service. You cannot pick and choose what to agree to and still use their free services.

The GDPR changes that by requiring online companies, in some cases, to get permission from each individual user to collect, share and combine their data for use by advertisers. Companies will not be allowed to ban people from their services who decline to share their data for advertising purposes. There are 508 million EU residents who will soon be able to opt out of helping Facebook and Google make money. If companies do not comply with the new regulations they will face fines totaling 4 percent of their global revenues.

These laws and regulations, as well as any associated inquiries or investigations or any other government actions, may be costly to comply with and may delay or impede the development of new products, result in negative publicity, increase our operating costs, require significant management time and attention, and subject us to remedies that may harm our business, including fines or demands or orders that we modify or cease existing business practices, Facebook stated in its most recent quarterly Securities and Exchange Commission filing.

But GDPR isnt the only trouble ahead for Facebook and Google . There are also myriad investigations underway into allegedly abusive practices by the firms.

After fining Google a record $2.8 billion in 2017 for prioritizing its own products over competitors in its online search results, the EUs competition commission continues to investigate the company for allegedly abusing its market dominance in the mobile phone market through its Android operating system. Germanys antitrust commission issued a preliminary report in December stating that Facebook uses its dominant position to place unfair conditions on its users by combining data from the Facebook main site with data retrieved from third party sources through its like button. In December, France gave Facebook one month to stop combining data from its WhatsApp platform with its Facebook platform without user consent or face sanctions and fines. Irelands antitrust enforcer has also investigated Facebook for sharing WhatsApp data without user consent.