Precedent corpus / DPC (Ireland)
Meta Platforms Ireland Limited
DPC (Ireland) case IN-18-10-1, decided . EUR 251M.
We have not checked whether this decision was appealed. This is not a statement that no appeal exists.
No ConsentMark grade rests on this decision. It is published here because it is relevant enforcement, not because it bears on what a browser does before consent.
What the regulator decided
After the September 2018 incident in which user access tokens granted attackers entry to circa 29 million Facebook accounts, Meta omitted required information from its breach notification (Article 33(3)), failed to document the breach adequately (Article 33(5)), and failed to ensure data protection by design and by default (Articles 25(1) and 25(2)) - the tokens granted broader access than necessary, contrary to the minimisation-by-default obligation.
Primary source
Regulator-owned URL. Quote this in legal briefs and academic citations.
https://www.dataprotection.ie/sites/default/files/uploads/241212_IN-18-10-1_Redacted.pdfConsentMark interpretation
Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.
Companion decision IN-18-11-1 was issued the same day; the combined EUR 251M fine spans both inquiries. Cite when the scanner narrative needs to argue that an over-scoped credential or token is itself an Article 25 by-design breach, independent of whether attackers later exploited it.
Verification trail
Checked against the primary source on 27th May 2026. Next review 27th November 2026.
Cite this case
@misc{consentmark-precedent-dpc-in-18-10-1,
author = {{ConsentMark}},
year = {2024},
title = {DPC (Ireland) IN-18-10-1 - Meta Platforms Ireland Limited},
howpublished = {\url{https://www.consentmark.com/precedent/dpc-in-18-10-1}},
note = {ConsentMark methodology v7.8.1}
}ConsentMark. (2024, December 12). DPC (Ireland) IN-18-10-1 - Meta Platforms Ireland Limited. Methodology v7.8.1. https://www.consentmark.com/precedent/dpc-in-18-10-1[DPC (Ireland) IN-18-10-1 - Meta Platforms Ireland Limited - ConsentMark](https://www.consentmark.com/precedent/dpc-in-18-10-1)DPC (Ireland) IN-18-10-1 - Meta Platforms Ireland Limited - ConsentMark, 2024-12-12, methodology v7.8.1, https://www.consentmark.com/precedent/dpc-in-18-10-1