Instagram hit with €405m fine for kids' privacy breach

Instagram has been slapped with a €405m (£349m) fine by the Irish Data Protection Commission for violating GDPR by failing to protect the personal data of teenage users.

The penalty follows a two-year investigation which found that the Meta-owned business had allowed users aged between 13 and 17 to operate business accounts on the platform, which showed the users’ phone numbers and email addresses.

The DPC also found the platform had operated a user registration system which meant the accounts of 13-to 17-year-old users were set to “public” by default.

The penalty is the highest imposed on Meta by the watchdog, after a €225m fine against WhatsApp in September 2021 for “severe and serious” infringements of GDPR, and a €17m fine in March this year.

The fine is the second largest under GDPR; Amazon holds the dubious record, with a €746m levied by the Luxembourg data protection authority in July 2021.

A DPC spokesperson said: “We adopted our final decision last Friday and it does contain a fine of €405m. Full details of the decision will be published next week.”

In a statement, Meta confirmed it planned to launch an appeal. It added: “This inquiry focused on old settings that we updated over a year ago and we’ve since released many new features to help keep teens safe and their information private.

“Anyone under 18 automatically has their account set to private when they join Instagram, so only people they know can see what they post and adults can’t message teens who don’t follow them.

“While we’ve engaged fully with the DPC throughout their inquiry, we disagree with how this fine was calculated and intend to appeal it. We’re continuing to carefully review the rest of the decision.”