As reported by the Associated Press, the penalty from the Personal Information Protection Commission (PIPC) follows a four-year investigation that found Meta collected and shared personal information about nearly 980,000 users—including data on political views, religion, and sexual orientation—from July 2018 to March 2022.
The PIPC claims Meta harvested user data by tracking liked pages and ad clicks to deduce interests. These user profiles were then shared with about 4,000 advertisers, which reportedly allowed Meta to target audiences based on religion, political views, and even North Korean defector issues.
Under South Korea’s strict privacy laws, companies must obtain explicit user consent before using such sensitive information.
In addition to data collection issues, Meta reportedly failed to implement key security measures to protect user privacy. According to PIPC’s Lee Eun Jung, inactive Facebook pages that weren’t blocked or removed became tools for identity theft. Hackers used these pages to initiate unauthorized password resets, resulting in data breaches affecting at least ten users.
This fine is the latest in a series of penalties Meta has faced in South Korea, as authorities intensify scrutiny of its data practices. While Meta’s data policy broadly mentions personalized ad targeting, the PIPC claims it lacks the specificity required under South Korean law for handling sensitive data.
