Historical November 2022 decision; subsequent appeal outcomes are not established by this summary.
What happened
The Irish DPC adopted a €265 million penalty decision against Meta Platforms Ireland in November 2022. The inquiry examined Facebook search and contact-importer tools, including an Instagram contact-importer tool, for processing between May 2018 and September 2019. It concerned data protection by design and default.
Source: Irish DPC — original source ↗
What it means for your website
If your website has member search, public profiles or a contact directory, think about what someone could collect at scale. Information that seems harmless on one profile can become more revealing when combined across many accounts. Review defaults, visibility settings and the amount of information returned by a search. Do not assume a privacy-policy paragraph compensates for an unnecessarily revealing feature. A practical design review should involve the person who understands the users and the developer who understands the interface. Public cookie testing will not settle whether your application’s data-access design is proportionate.
Three useful next steps
- Review default visibility for profiles and directories.
- Check what information searches and exports reveal.
- Include privacy questions before releasing new features.
Sources & context
Official sources consulted on 1 October 2026. A regulator’s announcement records its findings at that time; it is not proof of payment or the outcome of every later appeal.
Irish DPC — original sourceOur practical suggestions are GDPRFix commentary. A public website scan cannot establish your full legal position. For advice on a specific obligation or enforcement matter, use a suitably qualified adviser.