Fines issued to Meta Platforms from the EU 2024| ��ƽ��

Select fines issued to Meta for EU data protection and privacy violations as of September 2024 (in million euros)

Date - authority - violation	Fine in million euros
Sep 2024 -DPC - storing user passwords in plaintext	91
May 2023 - DPC - data transfers	1,200
Jan 2023 - EU Commission - illegal ad practices	390
Nov 2022 - DPC - data scraping	265
Sep 2022 - DPC - Instagram child privacy setting	405
Mar 2022 - DPC - data breaches	17

Download

Source

Show detailed source information?

Already a member?

Source

Release date

September 2024

More information

Region

Europe

Survey time period

March 2022 to September 2024

Citation formats

In September 2024, the Irish Data Protection Commission fined Meta Ireland 91 million euros after passwords of social media users were stored in 'plaintext' on Meta's internal systems rather than with cryptographic protection or encryption. In May 2023, the EU fined Meta 1.2 billion euros for violating laws on digital privacy and putting the data of EU citizens at risk through Facebook's EU-U.S. data transfers. European privacy legislation is seen as being far stricter than American privacy law, and the sending of EU citizens’ data to the United States resulted in the record breaking penalty being issued to the tech giant.

In January 2023, after it was discovered that Meta Platforms had improperly required that users of Facebook, Instagram, and WhatsApp accept personalized adverts to use the platforms, the company was issued a 390 million euro fine by the European Commission. EU regulators claim that the social media giant broke the General Data Protection Regulation (GDPR) by including the demand in its terms of service. In addition, Meta was fined 405 million euros by the Irish Data Protection Commission (DPC) in September 2022 for violating Instagram's children's privacy settings. In November 2022, the DPC fined Meta a further 265 million euros for failing to protect their users from data scraping.

GDPR violations in 2022

Social media sites and companies are not the only types of online services upon which users' data can potentially be compromised. In 2022, the online service with the biggest fine for violating GDPR was e-commerce and digital powerhouse Amazon, which was issued a 746 million euro fine. Furthermore, in December 2021, Google was penalized 90 million euros for GDPR violations.

What are the most common GDPR violations?

Since GDPR went into effect in May 2018, fines have been imposed for a variety of reasons. As of June 2022, companies' non-compliance with general data processing principles accounted for the largest share of fines, resulting in over 845 million euros worth of penalties. Insufficient legal basis for data processing was the second most common violation, amounting to 447 million euros in fines.