Metafines & penalties

Fifty-one state and territory attorneys general settled claims that Meta designed Instagram and Facebook to be addictive for minors, knowingly exposed young users to mental-health harm, and misled the public about how safe its platforms were. Meta will pay a guaranteed $12.1B over ten years, rising to $17.1B if other major social platforms agree to adopt the same safeguards.

The FTC imposed a $5B penalty and sweeping new privacy restrictions after finding that Facebook deceived users about their ability to control personal data, in violation of a 2012 consent order. Third-party apps had harvested data on up to 87 million users in the Cambridge Analytica episode. It was the largest privacy penalty in history at the time.

Texas settled claims that Meta captured facial-recognition data of millions of Texans through photo tag suggestions without consent, in violation of Texas biometric law. It was the largest single-state privacy settlement at the time.

The Irish DPC fined Meta for continuing to transfer EU users' personal data to US servers after the Schrems II ruling, exposing that data to potential US surveillance without adequate safeguards. It is the largest GDPR fine ever issued.

Texas reached its own settlement with Meta over the safety of children on its platforms, separate from the 51 attorneys general deal announced the same day. The Attorney General's release says Meta will pay over $1 billion to the state and adopt new safeguards for young users.

New Mexico became the first US state to beat a major technology company at trial over harm to young people. A Santa Fe jury found that Meta made false or misleading statements about platform safety and engaged in unconscionable trade practices that exploited the inexperience of children, and the court then added a $567M remedial award on top of the $375M in civil penalties.

The European Commission found that Meta tied Facebook Marketplace to its social network and imposed unfair conditions on rival online-classifieds services.

A class-action settlement resolved claims that Facebook's tag-suggestion faceprinting violated Illinois' Biometric Information Privacy Act. Roughly 1.6 million Illinois users received payouts.

The DPC found that Instagram business accounts publicly exposed children's phone numbers and email addresses by default.

The DPC found that Facebook (€210M) and Instagram (€180M) relied on a terms-of-service contract, rather than valid consent, to justify personalised advertising. The decision forced a change in how Meta seeks a legal basis for ads.

The DPC found that design failures allowed the scraping of roughly 533 million users' phone numbers and personal details, which were later leaked online.

The Irish DPC found that a video upload feature, combined with Facebook's "View As" tool, generated access tokens that let attackers log in as other users. Between 14 and 28 September 2018 attackers exploited the flaw against about 29 million accounts worldwide, about 3 million of them in the EU and EEA. The DPC held that Meta had not built data protection into the design of its systems and had not fully notified or documented the breach.

The DPC found that WhatsApp failed to properly explain to users and non-users how their data was processed and shared with other Meta companies.

In one of the first Digital Markets Act fines, the Commission found that Meta's pay-or-consent model forced Facebook and Instagram users to either pay a subscription or accept full data combination for personalised ads, without a genuine less-data alternative. Meta adjusted the model after the decision.

The Irish DPC found that Meta stored some users' social media passwords in plaintext on its internal systems, without encryption, and that it failed to notify and document the breach properly after reporting it in March 2019. The decision found infringements of Articles 5(1)(f), 32(1), 33(1) and 33(5) of the GDPR.

The DPC fined Meta over a series of twelve data breaches in 2018, finding it had failed to have appropriate technical and organisational measures in place.

South Korea's PIPC fined Meta for collecting sensitive data, including religion, political views, and sexual orientation, on roughly 980,000 users for advertising without consent.