Meta Platforms Ireland Limited

DPC (Ireland) case IN-18-10-1, decided 2024-12-12. EUR 251,000,000.

What the regulator decided

After the September 2018 incident in which user access tokens granted attackers entry to circa 29 million Facebook accounts, Meta omitted required information from its breach notification (Article 33(3)), failed to document the breach adequately (Article 33(5)), and failed to ensure data protection by design and by default (Articles 25(1) and 25(2)) - the tokens granted broader access than necessary, contrary to the minimisation-by-default obligation.

Primary source

Regulator-owned URL. Quote this in legal briefs and academic citations.

https://www.dataprotection.ie/sites/default/files/uploads/241212_IN-18-10-1_Redacted.pdf

ConsentMark interpretation

Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.

Companion decision IN-18-11-1 was issued the same day; the combined EUR 251M fine spans both inquiries. Cite when the scanner narrative needs to argue that an over-scoped credential or token is itself an Article 25 by-design breach, independent of whether attackers later exploited it.

Verification trail

Verified by: donal
Verified at: 2026-05-27
Review due: 2026-11-27

Cite this case

Pick the format that matches where you are pasting. The methodology version is preserved in every variant so the citation stays verifiable after future methodology changes.

BibTeX

@misc{consentmark-precedent-dpc-in-18-10-1,
  author       = {{ConsentMark}},
  year         = {2024},
  title        = {DPC (Ireland) IN-18-10-1 - Meta Platforms Ireland Limited},
  howpublished = {\url{https://www.consentmark.com/precedent/dpc-in-18-10-1}},
  note         = {ConsentMark methodology v1.3}
}

APA

ConsentMark. (2024, December 12). DPC (Ireland) IN-18-10-1 - Meta Platforms Ireland Limited. Methodology v1.3. https://www.consentmark.com/precedent/dpc-in-18-10-1

Markdown

[DPC (Ireland) IN-18-10-1 - Meta Platforms Ireland Limited - ConsentMark](https://www.consentmark.com/precedent/dpc-in-18-10-1)

Plain text

DPC (Ireland) IN-18-10-1 - Meta Platforms Ireland Limited - ConsentMark, 2024-12-12, methodology v1.3, https://www.consentmark.com/precedent/dpc-in-18-10-1