Instagram fined €405m by Irish data protection regulator

Instagram stock image

The Data Protection Commission (DPC) has fined Instagram €405m for breaking the privacy rights of children.

The watchdog found Instagram allowed children aged between 13 and 17 to operate business accounts on the platform.

Phone numbers and email addresses of children were publicly accessible at times.

Some Instagram accounts for children were also found to be set as 'public' by default, instead of 'private'.

A DPC spokesperson told the Irish Examiner: “We adopted our final decision last Friday and it does contain a fine of €405m". 

The fine is the largest fine the authority has ever issued and it said full details of the decision will be published next week.

This inquiry was commenced on September 21 2020 on foot of information provided to the DPC by a third party, and in connection with processing identified by the DPC itself.

The scope of inquiry concerns two types of processing carried out by Facebook Ireland Limited.

The DPC states that Facebook Ireland Limited firstly allowed child users between the ages of 13 and 17 to operate ‘business accounts’ on the Instagram platform. 

It is alleged that at certain times, the operation of such accounts required and/or facilitated the publication (to the world-at-large) of the child user’s phone number and/or email address.

Furthermore, the DPC claims that at certain times, Facebook Ireland Limited operated a user registration system for the Instagram service whereby the accounts of child users were set to “public” by default, thereby making public the social media content of child users, unless the account was otherwise set to “private” by changing the account privacy settings.

A spokesman for Meta, the company that owns Instagram, said in a statement to PA: “This inquiry focused on old settings that we updated over a year ago, and we’ve since released many new features to help keep teens safe and their information private.

“Anyone under 18 automatically has their account set to private when they join Instagram, so only people they know can see what they post, and adults can’t message teens who don’t follow them.

“While we’ve engaged fully with the DPC throughout their inquiry, we disagree with how this fine was calculated and intend to appeal it.

“We’re continuing to carefully review the rest of the decision.”