Google and Meta Face Largest Ever Fine
Using Personal Data for Online Targeted Ads
"Regret" ... Administrative Lawsuit Also Under Consideration
[Asia Economy Reporter Seungjin Lee] Google and Meta have been fined over 100 billion KRW for violating the Personal Information Protection Act. This was due to collecting personal information without user consent and utilizing it for online personalized advertising. Google and Meta immediately opposed the decision and hinted at the possibility of filing administrative lawsuits.
Largest Fines Imposed on Google and Meta
On the 14th, the Personal Information Protection Commission held its 15th plenary meeting and decided to impose fines of 69.2 billion KRW on Google and 30.8 billion KRW on Meta. The commission also issued corrective orders requiring both companies to notify users clearly and obtain consent so that users can easily and clearly recognize and freely exercise their decision rights when collecting and using users' third-party behavioral information.
This is the first time the Personal Information Protection Commission has sanctioned the collection and use of behavioral information on online personalized advertising platforms, and it is the largest fine imposed for violations of related laws. Prior to this, the largest fine for violating the Personal Information Protection Act was also imposed on Meta. In 2020, Meta (then Facebook) was fined 6.7 billion KRW for transferring personal information of at least 3.3 million people to other businesses without their consent over six years.
The commission pointed out that Google and Meta collected and analyzed users' behavioral information from other services for at least six and four years respectively, using it for advertising without clearly informing users or properly obtaining prior consent. A commission official stated, "Since third-party behavioral information is collected automatically, it is difficult to predict what information is collected, and there is a risk of generating sensitive information," adding, "More than 82% of Google users and over 98% of Meta users have settings that allow the collection of third-party behavioral information, which poses a significant risk of rights infringement."
Personal Information ‘Stripped’ for Personalized Advertising
The commission focused on the fact that users were not clearly informed in advance about the collection and analysis of third-party behavioral information for advertising purposes.
For example, Google set the default to 'consent' for collecting third-party behavioral information. This fact could only be confirmed by clicking the 'More' button. Meta only posted the consent content in the full data policy when creating an account but did not inform users of the specific legal notices or obtain consent. The full data policy contains 14,600 characters and 694 lines, but Meta only displayed five lines at a time.
According to Meta’s ‘Privacy Policy,’ Meta collects and utilizes most of the information about users’ activities within Facebook and Instagram. It also states that activities on third-party websites and applications unrelated to Meta are collected. For example, if a user searches for and purchases items on a shopping mall, ads related to that purchase may be displayed on Facebook or Instagram. Even when using Meta-related services without logging into an account, usage information is collected.
Recently, Meta attempted to update its services to restrict access if users did not consent to providing personal information but withdrew the plan following strong user backlash.
Google collects a significant amount of information as its services cover a wide range of user interactions, including search services, YouTube, and the Android operating system (OS). Google collects users’ search activities, watched videos, and activities on third-party sites and apps. When using Google services to make calls or send messages, it collects phone numbers as well as call and message timestamps and call durations. Essentially, it monitors users’ every move.
Google and Meta Fined Billions in Europe as Well
This is not the first time Google and Meta have been fined for collecting personal information without user consent.
Earlier this year, the French government fined the two companies 210 million euros (approximately 285 billion KRW) for using online personal information without properly obtaining user consent. The issue was related to the collection of ‘cookie’ information, which are temporary files automatically stored on internet users’ computers when visiting websites.
Google was fined 150 million euros (approximately 204 billion KRW), and Facebook was fined 60 million euros (approximately 81 billion KRW). The fine imposed on Google is the largest ever imposed by the French National Commission on Informatics and Liberty (CNIL).
Meanwhile, Google and Meta expressed regret over the commission’s decision and are expected to pursue administrative litigation. It is reported that both companies are reviewing litigation options with their legal representatives.
Google responded, "We deeply regret the results of the Personal Information Protection Commission’s review and will carefully examine the written decision." It added, "We have made our best efforts through continuous product updates to provide the best products and services to users while enhancing users’ control over their data and transparency. We will continue to cooperate with the commission to protect the privacy of Korean users."
Meta also stated, "We respect the commission’s decision, but we are confident that we comply with all relevant laws and collaborate with clients through lawful procedures. Therefore, we cannot agree with this decision and will thoroughly review the matter, keeping all options open, including judicial review."
© The Asia Business Daily(www.asiae.co.kr). All rights reserved.
