The Irish Data Protection Commission (DPC) fined Meta-owned social networking platform Instagram €405 million for violating the General Data Protection Regulation by publishing children’s email addresses and phone numbers.
Access the official press release here.
This is the second-highest fine under the GDPR after a €746 million penalty against Amazon and is the third imposed by the Irish regulator on a Meta-owned company.
The Irish DPC confirmed the fine in an emailed statement but denied additional comment.
The Irish authority issued the fine after triggering a dispute-resolution process to address the penalty’s input from other European data protection bodies.
The fine, which is now the largest for a Meta-owned company after a €225 million fine for WhatsApp and a €17 million fine for Facebook, is intended to punish Instagram for violating children’s privacy, including the publication of children’s email addresses and phone numbers.
At least six more investigations involving Meta-owned companies are now being conducted by the Irish DPC.
A Meta spokesperson has since released the following:
“This inquiry focused on old settings that we updated over a year ago, and we’ve since released many new features to help keep teens safe and their information private,”
“Anyone under 18 automatically has their account set to private when they join Instagram, so only people they know can see what they post, and adults can’t message teens who don’t follow them. We engaged fully with the DPC throughout their inquiry, and we’re carefully reviewing their final decision.”
