Meta Fined €405 Million for Mishandling Teenagers’ Data on Instagram

Meta has been slapped again with a hefty fine in the European Union (E.U). This time Ireland’s Data Protection Commission (DPC) penalized the company €405 million (approx. $402 million) for mishandling teenagers’ data, which goes against GDPR rules. Ireland’s DPC finalized the decision and penalty last Friday, with full details yet to be published. 

Two Years in the (Decision) Making

The investigation into Meta’s handling of teenagers’ data started almost two years ago. The probe specifically focused on how Meta’s subsidiary Instagram allowed teenagers aged 13-17 to create business accounts on the platform, which made their contact information, such as phone numbers and email addresses, publicly available. The platform also allegedly made the accounts of a few young users public by default. 

The probe began when a data scientist found that many users, including teenagers, switched to business accounts on Instagram, and their contact details were displayed on their profiles. Many users switch to the business account on Instagram as it provides access to better user engagement analytics. The platform later removed the feature from personal accounts in a few countries. 

However, Meta told the Associated PressOpens a new window that while it had fully cooperated with DPC during the investigation, it disagreed with the penalty and intended to appeal it. Further, in a detailed statement to PoliticoOpens a new window , a Meta spokesperson said, “this inquiry focused on old settings that we updated over a year ago, and we’ve since released many new features to help keep teens safe and their information private.” The spokesperson further said, “anyone under 18 automatically has their account set to private when they join Instagram, so only people they know can see what they post, and adults can’t message teens who don’t follow them. We engaged fully with the DPC throughout their inquiry, and we’re carefully reviewing their final decision.”

See more: Meta Fined $18.6M Under GDPR for Failing to Protect User Data

The Third Biggest Penalty for Meta

The €405 million fine is the third biggest one by Ireland’s privacy watchdog imposed on Meta. The penalty easily exceeds the €225 million fine the DPC had imposed in 2021 after it found that WhatsApp had not informed the E.U. citizens clearly how it collected and used their data. There were a few other smaller fines against Meta related to record-keeping issues. The current penalty is also the second biggest one after the fine of €746 millionOpens a new window imposed by the Luxembourg National Commission for Data Protection against Amazon last year. Meta is also facing similar investigations and lawsuits in other geographies.

The way Meta, and specifically Instagram, handle its young users’ online experiences has been closely scrutinized over the last few years, partially thanks to Frances Haugen’s explosive testimonyOpens a new window about Instagram’s harmful effects on young users’ mental health. Instagram’s subsequent efforts to build products for young users have been met with backlash.

Meta’s move following this fine is yet to be seen.

What do you think about the penalty imposed by the Irish DPC on Meta? Let us know on FacebookOpens a new window , TwitterOpens a new window , and LinkedInOpens a new window .

MORE ON GDPR AND ANTITRUST PENALTIES IN E.U.

Google and Meta Fined Nearly $250M by French Privacy Watchdog

Apple and Google Fined €10 Million Each by Italy’s Competition Regulator

Allegations of Behavior Profiling for Ad Targeting Lands Amazon $888M in Record GDPR Fines