Which regulator fined Meta over Instagram minors’ privacy in September 2022?

The Data Protection Commission fined Meta over Instagram minors’ privacy in September 2022. More precisely, Ireland’s Data Protection Commission imposed a €405 million penalty on Meta Platforms Ireland Limited over Instagram’s handling of children’s personal data.

The inquiry examined settings affecting users aged 13 to 17. At certain times, young users’ accounts could be public by default, and Instagram’s business-account registration process could expose children’s email addresses or phone numbers. The regulator found breaches of several GDPR requirements, including transparency, data protection by design, and safeguards for children.

The case is often confused with the European Data Protection Board, which became involved after other European regulators objected to parts of Ireland’s draft decision. The EDPB issued a binding dispute-resolution decision, but Ireland’s Data Protection Commission was the supervisory authority that adopted the final decision and imposed the fine.

The penalty was announced in September 2022 and concerned older practices that Meta said had already been changed. It was one of several major privacy penalties imposed on Meta by Irish regulators.