South Korea Fines Meta $15.6 Million for Sharing Sensitive User Data with Advertisers

South Korean authorities have imposed a fine of 21.6 billion won (approximately $15.6 million) on Meta for allegedly sharing sensitive information from 980,000 Facebook users with advertisers without proper consent. The country’s Personal Information Protection Commission (PIPC) revealed that Meta had compiled “advertising topics” from users’ activity and profiles, which were then provided to around 4,000 advertisers.

The data in question included sensitive details such as religious beliefs, sexual orientation, marital status, and even whether users were North Korean defectors. Such information, classified as sensitive under South Korea’s Personal Information Protection Act (PIPA), requires explicit consent for collection and analysis. The PIPC found Meta had failed to obtain this consent, thus violating the country’s privacy laws.

The regulator stressed that sensitive data must only be processed in exceptional cases, such as when users have clearly agreed to it. Meta’s vague data policy and lack of separate consent measures were cited as key issues, with the company accused of failing to protect users’ privacy adequately.

In response to the investigation, Meta ceased collecting sensitive data and deleted the advertising profiles created from it. However, the PIPC also highlighted concerns over Meta’s failure to remove unused account recovery pages, which led to hackers exploiting fake identities to access users’ accounts. This resulted in a leak of personal data from ten individuals.

This is not the first time Meta has been fined in South Korea; in 2022, the company was penalised 30.8 billion won ($22 million) for similarly mishandling user data. The PIPC’s latest fine serves as a stern reminder to foreign firms about adhering to South Korea’s stringent data protection laws.