Meta Platforms Ireland Limited

DPC (Ireland) case IN-20-7-4, decided 2nd September 2022. EUR 405M.

ContextAppeal status not checked

We have not checked whether this decision was appealed. This is not a statement that no appeal exists.

No ConsentMark grade rests on this decision. It is published here because it is relevant enforcement, not because it bears on what a browser does before consent.

What the regulator decided

Instagram child users (aged 13-17) who operated business accounts had their phone numbers and email addresses exposed publicly, and child personal accounts defaulted to public visibility, breaching Articles 5(1)(a), 5(1)(c), 6(1), 12(1), 24(1), 25(1), 25(2) and 35(1) GDPR; the DPC issued a reprimand and ordered remedial action alongside the fine.

Primary source

Regulator-owned URL. Quote this in legal briefs and academic citations.

https://www.dataprotection.ie/sites/default/files/uploads/2022-09/02.09.22%20Decision%20IN%2009-09-22%20Instagram.pdf

Archived snapshot

Wayback Machine snapshot of the primary source. Use this when the regulator URL might be refactored or expire.

https://web.archive.org/web/20260316112924/https://www.dataprotection.ie/sites/default/files/uploads/2022-09/02.09.22%20Decision%20IN%2009-09-22%20Instagram.pdf

ConsentMark interpretation

Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.

The DPC's filename embeds an internal date (09-09-22) that does not match the formal case reference (IN-20-7-4); the decisions index page is the authoritative source for the case ref. Cite when the scan involves a platform with public-by-default settings for users under 18.

Verification trail

Checked against the primary source on 26th May 2026. Next review 26th November 2026.

Cite this case

BibTeX

@misc{consentmark-precedent-dpc-in-20-7-4,
  author       = {{ConsentMark}},
  year         = {2022},
  title        = {DPC (Ireland) IN-20-7-4 - Meta Platforms Ireland Limited},
  howpublished = {\url{https://www.consentmark.com/precedent/dpc-in-20-7-4}},
  note         = {ConsentMark methodology v7.8.1}
}

APA

ConsentMark. (2022, September 2). DPC (Ireland) IN-20-7-4 - Meta Platforms Ireland Limited. Methodology v7.8.1. https://www.consentmark.com/precedent/dpc-in-20-7-4

Markdown

[DPC (Ireland) IN-20-7-4 - Meta Platforms Ireland Limited - ConsentMark](https://www.consentmark.com/precedent/dpc-in-20-7-4)

Plain text

DPC (Ireland) IN-20-7-4 - Meta Platforms Ireland Limited - ConsentMark, 2022-09-02, methodology v7.8.1, https://www.consentmark.com/precedent/dpc-in-20-7-4