Over the last five years of GDPR, the most popular social media platforms (Facebook, Instagram, TikTok, Whatsapp, and X, formerly Twitter) were fined over €2.9B ($3.1 billion U.S.) for GDPR breaches, out of which €765M ($819. 4 million U.S.) was for inadequate protection of children’s data, a study from Surfshark shows.
“Half of the most popular social media platforms examined have received GDPR fines from European data protection authorities, with a third of these fines linked to privacy issues concerning children,” says Agneska Sablovskaja, Lead Researcher at Surfshark. “Such penalties demonstrate the imperative to hold major social media players accountable for their data handling practices, ensuring that the privacy and safety of all users, especially children, is given the utmost consideration and care.”
Key insights:
- Out of the top 10 investigated social media platforms, half were fined by European data protection authorities. In total, there have been 13 fines levied on these platforms, totaling €2.9B.
- Meta-owned social media products (Facebook, Instagram, Whatsapp) feature prominently amongst platforms that have received fines under GDPR, adding up to €2.6B. TikTok received the third highest amount in fines (€360M), while X (formerly Twitter) received the lowest and only one fine in late 2020, totaling €450k.
- A third of all fines handed out to social media platforms are related to mishandling children’s data. Three of these were given to TikTok (€360M), and one was received by Instagram (€405M).
- These cases include issues like unclear privacy policies, setting accounts to public by default, and failing to enforce age restrictions, underscoring the importance of safeguarding children’s online privacy.
Methodology: This study used information provided by the GDPR Enforcement Tracker. We identified the 10 most popular social media platforms and checked them for fines on the Tracker. Data relating to the date, fine amount, issuing country, and links to relevant legal documents were recorded. The relevant legal documents were looked into to identify whether the fines were related to the handling of children’s data.