Metafines & penalties

The FTC imposed a $5B penalty and sweeping new privacy restrictions after finding that Facebook deceived users about their ability to control personal data, in violation of a 2012 consent order. Third-party apps had harvested data on up to 87 million users in the Cambridge Analytica episode. It was the largest privacy penalty in history at the time.

Texas settled claims that Meta captured facial-recognition data of millions of Texans through photo tag suggestions without consent, in violation of Texas biometric law. It was the largest single-state privacy settlement at the time.

The Irish DPC fined Meta for continuing to transfer EU users' personal data to US servers after the Schrems II ruling, exposing that data to potential US surveillance without adequate safeguards. It is the largest GDPR fine ever issued.

The European Commission found that Meta tied Facebook Marketplace to its social network and imposed unfair conditions on rival online-classifieds services.

A class-action settlement resolved claims that Facebook's tag-suggestion faceprinting violated Illinois' Biometric Information Privacy Act. Roughly 1.6 million Illinois users received payouts.

The DPC found that Instagram business accounts publicly exposed children's phone numbers and email addresses by default.

The DPC found that Facebook (€210M) and Instagram (€180M) relied on a terms-of-service contract, rather than valid consent, to justify personalised advertising. The decision forced a change in how Meta seeks a legal basis for ads.

The DPC found that design failures allowed the scraping of roughly 533 million users' phone numbers and personal details, which were later leaked online.

The DPC found that WhatsApp failed to properly explain to users and non-users how their data was processed and shared with other Meta companies.

In one of the first Digital Markets Act fines, the Commission found that Meta's pay-or-consent model forced Facebook and Instagram users to either pay a subscription or accept full data combination for personalised ads, without a genuine less-data alternative. Meta adjusted the model after the decision.

The DPC fined Meta over a series of twelve data breaches in 2018, finding it had failed to have appropriate technical and organisational measures in place.

South Korea's PIPC fined Meta for collecting sensitive data, including religion, political views, and sexual orientation, on roughly 980,000 users for advertising without consent.