The europe-v-facebook.org group has indicated that it is ready to sue Facebook in Ireland, the company's international headquarters, but warns this could cost between €100,000 and €300,000 (£81,000 and £243,000).
The group is still hoping for a "positive outcome" from its complaints over Facebook's data protection policies to the Irish Data Protection Authority (ODPC), but fears that legal action may be required to bring about change.
europe-v-facebook.org feels that the ODPC investigation into privacy and data protection on Facebook has not gone far enough. It wants a legally binding ruling on all of its 22 complaints against Facebook.
In September, the Irish regulator said that Facebook had implemented to its satisfaction "the great majority" of its recommendations, including new measures turning off facial recognition in Europe.
europe-v-facebook.org accepted that there has been some progress, but claimed that Facebook is still "just going half the way to compliance with the law".
On some of the complaints, the group said it wondered whether the ODPC had actually checked Facebook's claims, or just "blindly trusted" the social network.
"In many cases the Irish authority is massively departing from the common understanding of the underlying EU law," europe-v-facebook.org said.
According to europe-v-facebook.org, more than 40,000 users who have exercised their right to get a copy of all their data held by Facebook have still not received it, and in some cases the legal deadline of 40 days has passed.
In its own tests, the group found that the tools provided to access personal data on Facebook at times just brought up blank pages.
An external expert gave evidence to the Irish authority's review of data security at Facebook, but europe-v-facebook.org believes that this relied on "unproven submissions" by the firm.
The expert said that if Facebook had implemented the features it said it had implemented, then it would be secure, but the protest group said that this was "like an engineer that says that as long as he hasn't read about a bridge collapsing it should be perfectly safe".
europe-v-facebook.org now has 21 days to appeal against any decision by the Irish authority, but feels that legal action may be needed to really bring about change.
It is estimating that the cost of this could be between €100,000 and € 300,000, although admits that there is no limit on court costs, and no option for legal aid or a class action.
But it also feels that taking Facebook to court over its data security policies could deliver a "landmark" verdict, bigger even than the EU anti-trust case against Microsoft in 2008, that resulted in an €860 million fine for the US tech giant.
"If we get these things before the courts, it is very likely that it goes all the way to the European Court of Justice," europe-v-facebook.org said.
"Such a case would be a landmark for the whole IT industry, equal to the anti-trust cases against Microsoft. If this would be only about Facebook such a procedure would rather not make sense."
To finance the legal costs, the group has started a "crowd funding" platform allowing www.crowd4privacy.org users to support the cause. If it does not raise enough money, or no longer needs the money, then the donations will be refunded.
Max Schrems, spokesman for europe-v-facebook.org, said: "On average people have so far donated a bit more than €20. If we get 5,000 supporters, we can get the most important things before the courts.
"If we even get 15,000 supporters, we should be able take all necessary actions. And if we don't make it, we can at least say that we have tried everything we could."