S. Korea fines Meta $15M for illegally collecting information on Facebook users

SEOUL, South Korea — South Korea’s privacy watchdog on Tuesday fined social media business Meta 21.6 billion won ($15 million) for illegally collecting sensitive personal information from Facebook users, including data about their political views and sexual orientation, and sharing it with thousands of advertisers.

It was the latest in a series of penalties against Meta by South Korean authorities in recent years as they boost their scrutiny of how the business, which also owns Instagram and WhatsApp, handles private information.

Following a four-year investigation, South Korea’s Personal Information Protection fee concluded that Meta unlawfully collected sensitive information about around 980,000 Facebook users, including their religion, political views and whether they were in same-sex unions, from July 2018 to March 2022.

It said the business shared the data with around 4,000 advertisers.

South Korea’s privacy law provides strict protection for information related to personal beliefs, political views and sexual behavior, and bars companies from processing or using such data without the specific consent of the person involved.

The fee said Meta amassed sensitive information by analyzing the pages the Facebook users liked or the advertisements they clicked on.

The business categorized ads to identify users interested in themes such as specific religions, same-sex and transgender issues, and issues related to North Korean escapees, said Lee Eun Jung, a director at the fee who led the investigation on Meta.

“While Meta collected this sensitive information and used it for individualized services, they made only vague mentions of this use in their data policy and did not obtain specific consent,” Lee said.

Lee also said Meta put the privacy of Facebook users at uncertainty by failing to implement basic safety measures such as removing or blocking inactive pages. As a outcome, hackers were able to use inactive pages to forge identities and request password resets for the accounts of other Facebook users. Meta approved these requests without proper verification, which resulted in data breaches affecting at least 10 South Korean Facebook users, Lee said.

In September, European regulators hit Meta with over $100 million in fines for a 2019 safety lapse in which user passwords were temporarily exposed in an un-encrypted form.

Meta’s South Korean office said it would “carefully review” the fee’s selection, but didn’t immediately provide more comment.

In 2022, the fee fined Google and Meta a combined 100 billion won ($72 million) for tracking consumers’ online behavior without their consent and using their data for targeted advertisements, in the biggest penalties ever imposed in South Korea for privacy law violations.

The fee said then that the two companies didn’t clearly inform users or obtain their consent to collect data about them as they used other websites or services outside their own platforms. It ordered the companies to provide an “straightforward and obvious” consent procedure to provide people more control over whether to distribute information about what they do online.

The fee also hit Meta with a 6.7 billion won ($4.8 million) fine in 2020 for providing personal information about itsx users to third parties without consent.