Meta Platforms Ireland Limited

DPC (Ireland) case IN-21-4-2, decided 25th November 2022. EUR 265M.

ContextAppeal status not checked

We have not checked whether this decision was appealed. This is not a statement that no appeal exists.

No ConsentMark grade rests on this decision. It is published here because it is relevant enforcement, not because it bears on what a browser does before consent.

What the regulator decided

Facebook Search, the Messenger Contact Importer and the Instagram Contact Importer, as deployed between May 2018 and September 2019, failed to implement appropriate technical and organisational measures to ensure data protection by design and by default, breaching Articles 25(1) and 25(2) GDPR; the design enabled unauthenticated enumeration of personal data tied to phone numbers and email addresses, a "data scraping" pattern Meta had not designed-out.

Primary source

Regulator-owned URL. Quote this in legal briefs and academic citations.

https://www.dataprotection.ie/sites/default/files/uploads/2022-12/Final%20Decision_IN-21-4-2_Redacted.pdf

ConsentMark interpretation

Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.

Cite when the scanner narrative covers a feature that exposes more data per-request than the minimum needed to render its UI - the Article 25 by-design and by-default obligations bite even if no individual access is itself "unauthorised". Companion finding to the earlier April-2021 Facebook data leak coverage.

Verification trail

Checked against the primary source on 27th May 2026. Next review 27th November 2026.

Cite this case

BibTeX

@misc{consentmark-precedent-dpc-in-21-4-2,
  author       = {{ConsentMark}},
  year         = {2022},
  title        = {DPC (Ireland) IN-21-4-2 - Meta Platforms Ireland Limited},
  howpublished = {\url{https://www.consentmark.com/precedent/dpc-in-21-4-2}},
  note         = {ConsentMark methodology v7.8.1}
}

APA

ConsentMark. (2022, November 25). DPC (Ireland) IN-21-4-2 - Meta Platforms Ireland Limited. Methodology v7.8.1. https://www.consentmark.com/precedent/dpc-in-21-4-2

Markdown

[DPC (Ireland) IN-21-4-2 - Meta Platforms Ireland Limited - ConsentMark](https://www.consentmark.com/precedent/dpc-in-21-4-2)

Plain text

DPC (Ireland) IN-21-4-2 - Meta Platforms Ireland Limited - ConsentMark, 2022-11-25, methodology v7.8.1, https://www.consentmark.com/precedent/dpc-in-21-4-2