Meta fined €251M over the 2018 "View As" token breach
€251M
≈ $264M at the time
Irish Data Protection Commission
Ireland / EU · 2024
Status: Under appeal
What happened
The Irish DPC found that a video upload feature, combined with Facebook's "View As" tool, generated access tokens that let attackers log in as other users. Between 14 and 28 September 2018 attackers exploited the flaw against about 29 million accounts worldwide, about 3 million of them in the EU and EEA. The DPC held that Meta had not built data protection into the design of its systems and had not fully notified or documented the breach.
How it affected users
Attackers could act as the account holder and read names, contact details, locations, dates of birth, religion, posts, group memberships and children's data. The DPC said these vulnerabilities created a grave risk of misuse of that data.
Status timeline
Dec 17, 2024
Two decisions announced: €11M for breach notification and documentation failures (Art. 33(3), 33(5)) and €240M for failing to build data protection into design and by default (Art. 25(1), 25(2)).
Sep 21, 2026
The DPC's fines register lists the fine as pending appeal; DPC fines are not payable until confirmed by a court.
Sources
- Irish DPC: Irish Data Protection Commission fines Meta €251 millionregulator
- Irish DPC fines register: status of each DPC fineregulator
Last verified 2026-10-15. Spotted an error? Report a correction.
Cite this entry
Deepak Gupta, "Meta fined €251M over the 2018 "View As" token breach," Tech Fines Directory, guptadeepak.com, 2024-12-17. https://guptadeepak.com/tech-fines/violation/meta-ireland-view-as-breach-2024/