Meta got fined $400 million for failing to protect kids' privacy on Instagram

• Ireland's data watchdog gave Meta a 405 million euro ($403 million) fine.
• The fine is targeted at Instagram's handling of data from underage users.

Ireland's data watchdog the Data Protection Commission handed Meta a 405 million euro ($403 million) fine on Monday, the agency confirmed to Insider.

The Irish DPC acts as the EU's regulator for several US tech giants including Meta because their headquarters are based in the country.

The DPC fine was given to Instagram for failing to protect children's privacy on its platform. The fine was partly based on the fact Instagram had allowed children to operate business accounts on its platform. Instagram business accounts show the account holder's phone number and email address, meaning that data was exposed.

Complimentary Tech Event

Transform talent with learning that works

Capability development is critical for businesses who want to push the envelope of innovation.Discover how business leaders are strategizing around building talent capabilities and empowering employee transformation.Know More

The DPC also found the accounts of 13 to 17 year-olds were set to "public" as their default setting.

A DPC spokesperson told Insider full details of the ruling will be published next week.

A Meta spokesperson told Insider in a statement: "This inquiry focused on old settings that we updated over a year ago, and we've since released many new features to help keep teens safe and their information private."

The spokesperson added Instagram users under the age of 18 automatically have their accounts set to "private" rather than "public." He added adult users can't privately message users under 18 unless they follow the adult's account.

"While we've engaged fully with the DPC throughout their inquiry, we disagree with how this fine was calculated and intend to appeal it. We're continuing to carefully review the rest of the decision," the spokesperson added.

The fine is the second-biggest issued to a tech company under Europe's GDPR data protection laws. The largest was a $887 million fine issued to Amazon in July 2021.

Meta is starting to rack up DPC fines. The DPC fined the tech giant 17 million euros ($16.9 million) in March 2022 for failing to protect user data from breaches.

It also fined Meta subsidiary WhatsApp $266 million in September 2021 for not being transparent enough with users about how their data was shared with its parent company.