On Tuesday, Ireland’s privacy agency confirmed to Forbes that late last week it had issued a 405 million euro ($401 million) fine against Instagram over how it had allowed teens to inadvertently and publicly expose their personal email addresses and phone numbers. The fine was first reported by Politico.
In 2016, when Instagram introduced “business” profiles, it gave users access to new analytics tools to help them understand reach and engagement. Some users under 18 decided to convert their profiles to gain access to those tools, seemingly without realizing that by doing so they were making public their email addresses and phone numbers.
By early January 2019, David Stier, a California data scientist, happened upon this critical data exposure, and began to sound the alarm to Instagram and journalists. In June 2019, Stier filed a formal breach notification to Ireland’s Data Protection Commission, which led to this investigation.
In an emailed statement sent to Forbes, Sophie Vogel, a Meta spokesperson, said the company had taken several steps to mitigate further data leaks by minors.“This inquiry focused on old settings that we updated over a year ago, and we’ve since released many new features to help keep teens safe and their information private,” Vogel wrote.
“Anyone under 18 automatically has their account set to private when they join Instagram, so only people they know can see what they post, and adults can’t message teens who don’t follow them.”
Nevertheless, Vogel also said Meta disagrees with “how the fine was calculated,” and added that the company intends to appeal. She did not respond to further questions asking her to elaborate on the company’s reasoning.
Stier told Forbes on Tuesday that the fine is insufficient given the gravity of the offense.
“They knowingly displayed children’s cell phone numbers and email in plain sight for months after they were notified of this,” he said. “The risks to children from Meta’s practices is incalculable; a fine of just 1% of their recent net income could be seen as a very small price to pay for putting millions of children in harm’s way.”
In 2021, Meta profited over $39.3 billion.
The DPC intends to release the full details of its decision next week.