Meta Platforms, the parent company of Facebook, has been slapped with a hefty fine of 21.62 billion won ($15.67 million) by South Korea’s Personal Information Protection Commission (PIPC) after an investigation revealed the company collected sensitive user data without proper authorization.
The investigation found that Meta gathered personal information—including users’ religious beliefs, political opinions, and sexual orientation—from approximately 980,000 South Korean Facebook users. This data was shared with around 4,000 advertisers, who used it to target users more effectively with personalized ads. The commission’s findings suggest Meta did so without obtaining the necessary consent from the affected users.
Data Profiling and Privacy Violations
The PIPC’s report, released on Tuesday, revealed that Meta had been analyzing users’ behavior on Facebook—such as pages they liked and ads they clicked—to create detailed advertising profiles based on sensitive data. This included labeling users with characteristics like being North Korean defectors, members of particular religious groups, or identifying as transgender or gay.
In addition to the unauthorized data collection, the commission also criticized Meta for failing to meet users’ requests for access to their personal data. Furthermore, the company was cited for not preventing a data breach in which the personal information of 10 South Korean users was exposed to hackers.
Meta Korea has yet to comment on the ruling, which adds to the growing list of privacy concerns the company faces globally.
Global Privacy Concerns and Regulatory Scrutiny
The case in South Korea is part of a broader trend of increasing global scrutiny of tech companies’ handling of user data. In a related matter, the Irish Data Protection Commission (DPC) recently imposed a €310 million fine on LinkedIn for breaching the European Union’s General Data Protection Regulation (GDPR). The platform was found to have violated user privacy by using behavioral data for targeted advertising without adequate consent or transparency.
In addition to these European and Asian cases, Meta is facing significant legal challenges in other regions. In July 2024, Nigeria’s Federal Competition and Consumer Protection Commission (FCCPC) and the Nigeria Data Protection Commission (NDPC) jointly imposed a $220 million fine on Meta. The Nigerian authorities’ investigation highlighted Meta’s alleged unauthorized transfer of personal data, including cross-border storage violations, and discriminatory practices in its handling of Nigerian users’ data.
A Growing Focus on Data Privacy
These high-profile cases underscore the increasing global emphasis on safeguarding user data and holding tech giants accountable for privacy violations. Governments and regulatory bodies around the world are tightening data protection regulations, pushing companies like Meta to adapt their practices to ensure compliance with stricter privacy standards.
With fines and investigations continuing to mount, Meta, along with other tech firms, faces a growing challenge in maintaining user trust while navigating the complex and evolving landscape of global data privacy laws.