Meta fined €91M for storing passwords in plaintext
€91M
≈ $102M at the time
Irish Data Protection Commission
Ireland / EU · 2024
Status: Under appeal
What happened
The Irish DPC found that Meta stored some users' social media passwords in plaintext on its internal systems, without encryption, and that it failed to notify and document the breach properly after reporting it in March 2019. The decision found infringements of Articles 5(1)(f), 32(1), 33(1) and 33(5) of the GDPR.
How it affected users
Passwords that would give access to people's accounts were readable by anyone with access to the internal systems. The DPC said the passwords were not made available to external parties.
Status timeline
Sep 26, 2024
Decision notified to Meta Platforms Ireland: a €91M fine and a reprimand, after no objections from other EU authorities to the June 2024 draft.
Sep 21, 2026
The DPC's fines register lists the fine as pending appeal; DPC fines are not payable until confirmed by a court.
Sources
- Irish DPC: Irish Data Protection Commission fines Meta Ireland €91 millionregulator
- Irish DPC fines register: status of each DPC fineregulator
Last verified 2026-10-15. Spotted an error? Report a correction.
Cite this entry
Deepak Gupta, "Meta fined €91M for storing passwords in plaintext," Tech Fines Directory, guptadeepak.com, 2024-09-27. https://guptadeepak.com/tech-fines/violation/meta-ireland-passwords-2024/