Meta Platforms (South Korea)

What happened

South Korea's PIPC fined Meta Platforms ₩30.8 billion (approximately $22 million USD) for collecting sensitive personal information about Facebook users' religious views, political opinions, and sexual orientation without obtaining specific consent as required by PIPA. The PIPC found that Meta analyzed users' behavior on Facebook — including pages liked, ads clicked, and groups joined — to infer sensitive attributes such as political leanings, religious beliefs, and whether users were in same-sex relationships. This inferred sensitive data was then used to create behavioral advertising profiles and serve targeted ads. Under PIPA, processing sensitive information requires separate, specific consent beyond general terms of service acceptance. The decision was announced alongside the Google location tracking fine.

Articles violated

Lessons learned

Inferring sensitive personal information (religion, politics, sexuality) from behavioral data is itself a form of sensitive data processing requiring explicit consent. South Korean law treats inferred data the same as directly collected data when it reveals sensitive attributes. Behavioral profiling for advertising that produces sensitive insights must obtain specific, separate consent. Companies should audit their profiling algorithms to understand what sensitive inferences they generate and ensure appropriate consent mechanisms exist for each category of sensitive data.