Meta Platforms Ireland Limited

DPC (Ireland) case IN-20-7-4, decided 2022-09-02. EUR 405,000,000.

What the regulator decided

Instagram child users (aged 13-17) who operated business accounts had their phone numbers and email addresses exposed publicly, and child personal accounts defaulted to public visibility, breaching Articles 5(1)(a), 5(1)(c), 6(1), 12(1), 24(1), 25(1), 25(2) and 35(1) GDPR; the DPC issued a reprimand and ordered remedial action alongside the fine.

Primary source

Regulator-owned URL. Quote this in legal briefs and academic citations.

https://www.dataprotection.ie/sites/default/files/uploads/2022-09/02.09.22%20Decision%20IN%2009-09-22%20Instagram.pdf

Archived snapshot

Wayback Machine snapshot of the primary source. Use this when the regulator URL might be refactored or expire.

https://web.archive.org/web/20260316112924/https://www.dataprotection.ie/sites/default/files/uploads/2022-09/02.09.22%20Decision%20IN%2009-09-22%20Instagram.pdf

ConsentMark interpretation

Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.

The DPC's filename embeds an internal date (09-09-22) that does not match the formal case reference (IN-20-7-4); the decisions index page is the authoritative source for the case ref. Cite when the scan involves a platform with public-by-default settings for users under 18.

Verification trail

Verified by: donal
Verified at: 2026-05-26
Review due: 2026-11-26

Cite this case

Pick the format that matches where you are pasting. The methodology version is preserved in every variant so the citation stays verifiable after future methodology changes.

BibTeX

@misc{consentmark-precedent-dpc-in-20-7-4,
  author       = {{ConsentMark}},
  year         = {2022},
  title        = {DPC (Ireland) IN-20-7-4 - Meta Platforms Ireland Limited},
  howpublished = {\url{https://www.consentmark.com/precedent/dpc-in-20-7-4}},
  note         = {ConsentMark methodology v1.3}
}

APA

ConsentMark. (2022, September 2). DPC (Ireland) IN-20-7-4 - Meta Platforms Ireland Limited. Methodology v1.3. https://www.consentmark.com/precedent/dpc-in-20-7-4

Markdown

[DPC (Ireland) IN-20-7-4 - Meta Platforms Ireland Limited - ConsentMark](https://www.consentmark.com/precedent/dpc-in-20-7-4)

Plain text

DPC (Ireland) IN-20-7-4 - Meta Platforms Ireland Limited - ConsentMark, 2022-09-02, methodology v1.3, https://www.consentmark.com/precedent/dpc-in-20-7-4