Irish watchdog fines Instagram €405m for breaching children’s privacy rights

It’s the DPC’s biggest fine so far, and the second substantial fine imposed on Meta, after a €225m fine imposed on WhatsApp last year. A €17m fine on Facebook was also imposed by the Irish regulator more recently.

“We adopted our final decision last Friday and it does contain a fine of €405 million,” said a DPC spokesperson. “Full details of the decision will be published next week.”

The €405m fine is the result of a consultation process with other European data regulators. A spokesperson described the Irish DPC decision as “significant” as it is the first to deal with children’s private information.

“This Inquiry was commenced on 21 September 2020 on foot of information provided to the DPC by a third party, and in connection with processing identified by the DPC itself,” the spokesperson said.

The scope of inquiry focused on Facebook allowing child users between the ages of 13 and 17 to operate ‘business accounts’ on the Instagram platform.

"At certain times, the operation of such accounts required and facilitated the publication, to the world-at-large, the child user’s phone number and/or email address,” said the spokesperson.

At other times, Facebook operated a user registration system for the Instagram service whereby the accounts of child users were set to ‘public’ by default, thereby making public the social media content of child users, unless the account was otherwise set to ‘private’ by changing the account privacy settings.

Meta intends to appeal the fine, according to a spokesperson.

“This inquiry focused on old settings that we updated over a year ago, and we’ve since released many new features to help keep teens safe and their information private,” the spokesperson said.

"Anyone under 18 automatically has their account set to private when they join Instagram, so only people they know can see what they post, and adults can’t message teens who don’t follow them. While we’ve engaged fully with the DPC throughout their inquiry, we disagree with how this fine was calculated and intend to appeal it. We’re continuing to carefully review the rest of the decision.”

The Meta spokesperson added that the company is not appealing a €17m Facebook fine previously handed down by the Irish regulator.

The company had previously said it was unhappy with the fine, which it described as being related to “record-keeping practices” and “not a failure to protect people's information”.