Meta Platforms (Instagram)

What happened

The DPC fined Instagram €405 million for violating children's privacy. The investigation found that Instagram's business account feature allowed children aged 13-17 to make their accounts public by default, exposing their email addresses and phone numbers. Instagram also relied on legitimate interest as a legal basis for processing children's data, which the DPC deemed inappropriate.

Articles violated

Lessons learned

Processing children's personal data requires explicit parental consent under Art. 8 GDPR. Default settings for minors must be privacy-protective (privacy by default). Companies cannot rely on legitimate interest as a legal basis when processing data of minors — consent is the appropriate basis.