Meta has been fined €405m by the Irish data watchdog for letting teenagers set up accounts that publicly displayed their phone numbers and email addresses.
The Data Protection Commission confirmed the penalty after a two-year investigation into potential breaches of the European Union’s general data protection regulation (GDPR).
Instagram had allowed users aged between 13 & 17 to operate business accounts on the platform, which showed the users’ phone numbers and email addresses. The DPC regulates Meta which is also the owner of Facebook and WhatsApp on behalf of the entire EU because the company’s European headquarters are in Ireland.
it’s the highest penalty imposed on Meta by the watchdog, after a €225m fine imposed in September 2021 for “severe” and “serious” infringements of GDPR at WhatsApp and a €17m fine in March this year.
The fine is the second largest under GDPR, behind the €746m levied on Amazon in July 2021.
“We adopted our final decision last Friday and it does contain a fine of €405m. Full details of the decision will be published next week.”
A DPC spokesperson
Caroline Carruthers, a UK data consultancy owner, said Instagram had not thought through its privacy responsibilities when letting teenagers set up business accounts and had shown an “obvious lack of care” in users’ privacy settings.
“This was a major breach that had significant safeguarding implications and the potential to cause real harm to children using Instagram.”
“The ruling demonstrates how effective enforcement can protect children on social media and underlines how regulation is already making children safer online.”
Andy Burrows, head of child safety online policy at NSPCC
Instagram said it was pausing work to address concerns raised by parents, experts and regulators. The move followed revelations from a whistleblower, Frances Haugen, that Facebook’s own research showed Instagram could affect girls mental health on issues such as body image and self-esteem.
Instagram has said that prior to September 2019, it had put user contact details on business accounts and had informed users during the setup process. Under-18s now have their account set to private automatically when they join the platform.
“This inquiry focused on old settings that we updated over a year ago, and we’ve since released many new features to help keep teens safe and their information private.”
“Anyone under 18 automatically has their account set to private when they join Instagram, so only people they know can see what they post, and adults can’t message teens who don’t follow them.”
“While we’ve engaged fully with the DPC throughout their inquiry, we disagree with how this fine was calculated and intend to appeal it. We’re continuing to carefully review the rest of the decision.”
A Meta spokesperson
