Instagram Fined EUR 405 Million Over Children's Data
The Irish DPC fined Meta's Instagram EUR 405 million for violations related to the processing of children's personal data. The investigation focused on the public exposure of children's email addresses and phone numbers through Instagram's business account feature and the default public profile setting for minors. This was the second-largest GDPR fine at the time and the largest penalty specifically concerning children's data protection.
Key Analytics
Impact Analysis
This enforcement action underscored that regulators treat children's data processing failures with heightened severity, reflecting GDPR Recital 38's special protection for minors. Platforms and services accessible to children must implement privacy-by-design defaults that restrict data exposure, particularly for users under the age of digital consent. Organizations that allow minors to create accounts face elevated scrutiny on default privacy settings and age verification mechanisms.
Recommended Actions
- Implement privacy-by-default settings for all user accounts, with heightened restrictions for users identified or likely to be minors.
- Review age verification and age-gating mechanisms to ensure they meet the standard required by GDPR Article 8 and applicable member state laws.
- Conduct a specific DPIA for any feature or processing activity that involves or may involve children's personal data, documenting safeguards and risk mitigations.
Always verify requirements with official regulatory sources.
Estimated Remediation Effort
Indicative effort to address this development, broken down by your organization's current compliance posture. Select the posture that best matches where you are today.
A partial program exists: some policies and controls are in place, but coverage, evidence, and ownership have gaps.
- ›Default settings audit and hardening for minor accounts
- ›Age-gating remediation against Article 8 and member state law
- ›DPIA for features that may involve children's personal data
The Cost of Waiting
Readiness work is dramatically cheaper before a deadline than after one. The ranges below come from the same estimate: the difference is only how prepared you are when the work starts.
Roughly 75 to 165 hours avoided by preparing early
Effort ranges are indicative planning estimates, not quotes. Actual effort depends on organizational scope, environment complexity, and evidence maturity. Talk to us for a scoped assessment.