Irish fine Instagram $400M over data

Ireland has fined Instagram a record $400 million for alleged mishandling of teens’ data.

The decision by the Irish Data Protection Commission came after a two-year investigation into Instagram’s “business accounts,” which give users more advanced metrics for tracking views and likes, but before 2019 were prone to publishing users’ phone numbers and email addresses. Instagram’s minimum age for users is 13.

A 2019 study by data analyst David Stier found that more than 60 million Instagram users under 18 years old were allowed to change their personal accounts into business accounts. And many did, partly motivated by access to metrics such as how many people had visited a profile and the number of views for individual posts. But the underage users could be unaware that their contact information was exposed by default.

Instagram “engaged fully” with the Irish regulator throughout the investigation but disagreed with how the penalty was calculated, a spokesperson for its parent company, Meta Platforms Inc., said in an emailed statement.

“This inquiry focused on old settings that we updated over a year ago, and we’ve since released many new features to help keep teens safe and their information private,” according to the statement, which noted that Meta Platforms is carefully reviewing the decision and considering an appeal.

The inquiry into Instagram, conducted under European Union privacy rules introduced in 2018, is one of several investigations into Meta Platforms companies by Data Protection Commissioner Helen Dixon’s office.

Meta Platforms’ WhatsApp unit was fined nearly $223 million last year, while Facebook was fined $ 16.8 million in March, meaning the Instagram fine brings Ireland’s total penalties against the company over data and privacy issues to nearly $641 million in the past two years.

The latest penalty is the most Ireland has fined any company over data privacy and the second-highest related fine in the EU after Luxembourg’s regulators fined Amazon.com Inc. about $739 million last year.

Data regulators in several other EU countries initially objected to Ireland’s proposals to penalize Instagram, but they managed to agree on the ruling as part of a Pan-European enforcement model, which authorizes data regulators to impose stiff fines for breaches.

The Irish regulator supervises a number of multinational tech giants, including Apple Inc., Alphabet Inc.’s Google, Meta Platforms and other companies that have their EU headquarters in Ireland.