Ireland's data privacy regulator issued a record fine of 405 million euros ($402 million) against Instagram following an investigation into its handling of children's data.
The decision comes after a two-year investigation into Instagram’s “business accounts,” which give users more advanced metrics for tracking views and likes. A 2019 study by data analyst David Stier found that more than 60 million Instagram users under the age of 18 were able to change their personal accounts into business accounts.
The problem is that, prior to 2019, business account users’ phone numbers and email addresses were often made public under the default settings.
“We adopted our final decision last Friday and it does contain a fine of €405 million,” Graham Doyle, deputy commissioner with the Irish Data Protection Commission (DPC), confirmed to The Washington Post.
Instagram—which, like Facebook, is owned by Meta—updated its settings over a year ago and has released new features to keep teens’ information private, a Meta spokesperson stated.
“Anyone under 18 automatically has their account set to private when they join Instagram, so only people they know can see what they post, and adults can’t message teens who don’t follow them,” the company said in an emailed statement.
The DPC has regulatory authority over a number of large technology companies—including Facebook, Apple, and Google—because their EU headquarters are located in Ireland. European policymakers have recently adopted several new regulations related to children’s online privacy. In a new law called the Digital Services Act, companies are “prohibited from using certain data to personalize advertising targeted at people under 18 years old,” reports The New York Times.
A year ago, the DPC fined another Meta company, WhatsApp, a then-record $266 million for privacy violations.
Andy Burrows, the head of child-safety-online policy at the National Society for the Prevention of Cruelty to Children, said of Instagram’s actions, "This was a major breach that had significant safeguarding implications and the potential to cause real harm to children using Instagram.”
Meta said it disagrees with the fine and plans to appeal. “We engaged fully with the DPC throughout their inquiry, and we’re carefully reviewing their final decision,” the company stated.
Further details regarding the DPC’s findings are expected to be announced next week.