Meta fined 7.4 billion KRW for unauthorized use of user purchase and search records

Meta, which was fined a record 30.8 billion KRW for violating the Personal Information Protection Act, has been hit with an additional fine. This came after it was revealed that Meta freely used information about users' activities on other websites or applications for advertising without proper consent.

The Personal Information Protection Commission announced on the 27th that it imposed fines of 6.517 billion KRW and 886 million KRW on Meta Island and Instagram, respectively, for collecting users' third-party behavioral information without proper consent and using it for personalized advertising. Third-party behavioral information refers to online activity data that can identify and analyze users' interests, preferences, and tendencies, such as visit and usage history of other businesses' websites and apps, purchase and search history.

Last September, the Commission imposed a fine of 30.8 billion KRW and corrective orders on Meta for collecting and using users' third-party behavioral information without proper consent, and decided to conduct additional investigations on Meta Island and Instagram. Before July 2018, the domestic service personal information processors were Meta Island and Instagram, but after July, they were changed to Meta.

The investigation confirmed that Meta Island and Instagram, which provided Facebook and Instagram services to Korean users before July 2018, did not obtain proper consent from users while collecting third-party behavioral information and generating revenue through personalized advertising.

The Commission judged that Meta Island showed the full 'Data Policy' through a small scrollable screen when creating a Facebook account, but users could not be considered to have clearly recognized and consented to the collection of third-party behavioral information. Instagram considered users to have agreed to the terms and privacy policy when creating an Instagram account without a separate consent procedure, but the 'third-party behavioral information-related content' was not included.

This constitutes a violation of Article 22, Paragraph 1 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, etc., which is subject to fines.

Chairman Koh Hak-su of the Personal Information Protection Commission is presiding over the 13th plenary meeting of the Personal Information Protection Commission held on the afternoon of July 26 at the Government Seoul Office in Jongno-gu, Seoul. (Photo by Personal Information Protection Commission)

Meanwhile, it was confirmed that when Meta installs 'Facebook Login' to provide a simple login function on websites and apps it operates, tools for collecting third-party behavioral information unrelated to the function are installed together, allowing Meta to transmit and collect behavioral information within those websites or apps.

The Commission reviewed whether to file charges, considering that Meta acquired personal information through fraudulent means by making it impossible for both businesses and users to know that such information was transmitted and collected via 'Facebook Login.' During this process, Meta submitted an official opinion stating it would voluntarily correct the behavior within three months.

Since Meta expressed its intention to voluntarily correct, the Commission decided to temporarily withhold the legal violation judgment against Meta and grant an opportunity for voluntary correction.

A Commission official stated, "We hope this action will serve as an opportunity for domestic and international platform companies to collect only necessary information during the process of collecting and using personal information and to strive to transparently inform users about the processing procedures."

This content was produced with the assistance of AI translation services.