Meta Platforms Ireland Limited

DPC (Ireland) case IN-21-4-2, decided 2022-11-25. EUR 265,000,000.

What the regulator decided

Facebook Search, the Messenger Contact Importer and the Instagram Contact Importer, as deployed between May 2018 and September 2019, failed to implement appropriate technical and organisational measures to ensure data protection by design and by default, breaching Articles 25(1) and 25(2) GDPR; the design enabled unauthenticated enumeration of personal data tied to phone numbers and email addresses, a "data scraping" pattern Meta had not designed-out.

Primary source

Regulator-owned URL. Quote this in legal briefs and academic citations.

https://www.dataprotection.ie/sites/default/files/uploads/2022-12/Final%20Decision_IN-21-4-2_Redacted.pdf

ConsentMark interpretation

Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.

Cite when the scanner narrative covers a feature that exposes more data per-request than the minimum needed to render its UI - the Article 25 by-design and by-default obligations bite even if no individual access is itself "unauthorised". Companion finding to the earlier April-2021 Facebook data leak coverage.

Verification trail

Verified by: donal
Verified at: 2026-05-27
Review due: 2026-11-27

Cite this case

Pick the format that matches where you are pasting. The methodology version is preserved in every variant so the citation stays verifiable after future methodology changes.

BibTeX

@misc{consentmark-precedent-dpc-in-21-4-2,
  author       = {{ConsentMark}},
  year         = {2022},
  title        = {DPC (Ireland) IN-21-4-2 - Meta Platforms Ireland Limited},
  howpublished = {\url{https://www.consentmark.com/precedent/dpc-in-21-4-2}},
  note         = {ConsentMark methodology v1.3}
}

APA

ConsentMark. (2022, November 25). DPC (Ireland) IN-21-4-2 - Meta Platforms Ireland Limited. Methodology v1.3. https://www.consentmark.com/precedent/dpc-in-21-4-2

Markdown

[DPC (Ireland) IN-21-4-2 - Meta Platforms Ireland Limited - ConsentMark](https://www.consentmark.com/precedent/dpc-in-21-4-2)

Plain text

DPC (Ireland) IN-21-4-2 - Meta Platforms Ireland Limited - ConsentMark, 2022-11-25, methodology v1.3, https://www.consentmark.com/precedent/dpc-in-21-4-2