A report by Surfshark has revealed that some of the most used social media platforms including Meta’s major apps, TikTok and X, formerly Twitter have been fined over €2.9 billion for breaching the European Union General Data Protection Regulation (GDPR) over the last 5 years.
The report, which is based on the GDPR Enforcement Tracker, indicated that out of the total fine, over €765 million was for mishandling of children’s data.
According to the report, Meta-owned social media products (Facebook, Instagram, WhatsApp) feature prominently and have received fines adding up to €2.6 billion.
This shows that Meta apps alone accounted for 86% of the total fines.
The breakdown shows that Facebook got the largest chunk of the fine, €1.7 billion, while Instagram came second with €585 million fine. TikTok received the third highest fine (€360 million), WhatsApp, €231 million, while X (formerly Twitter) received the lowest and only one fine in late 2020, totalling €450k.
According to the report, 5 other social media platforms tracked on the GDPR database had no record of fines to date. These include YouTube, Snapchat, Pinterest, Reddit, and LinkedIn.
Commenting on the report, the Lead Researcher at Surfshark, Agneska Sablovskaja, said:
Sablovskaja noted that cases that led to the fines include issues like unclear privacy policies, setting accounts to the public by default, and failing to enforce age restrictions, underscoring the importance of safeguarding children’s online privacy.
Meanwhile, the Nigeria Data Protection Commission (NDPC) is also investigating Meta for possible data breaches in the country.
According to the Commission, complaints against Meta in Nigeria touched on behavioural advertising without the explicit consent of data subjects.
The Commission noted that approximately 40 million Facebook accounts in Nigeria may have been affected by the data processing under investigation. It said this also has significant implications for the growth of Nigeria’s digital economy.
If found guilty, Meta risks forfeiting 2% of its gross revenue to the Commission as a penalty as stipulated by the Data Protection Act.