The Personal Information Protection Commission fines Meta: "Must be able to refuse providing behavioral information to other companies"

Last May, Meta faced controversy for attempting to change its consent method to restrict services if Korean Facebook and Instagram users did not agree to behavioral information collection. The photo shows the screen at that time.

[Asia Economy Reporter Seungjin Lee] The Personal Information Protection Commission has issued a corrective order and imposed a fine on Meta. This action was taken because Meta attempted to restrict service use if users refused to provide personal information for personalized advertising.

On the 8th, the Personal Information Protection Commission held its 2nd plenary meeting and decided to issue a corrective order to Meta, impose a fine of 6.6 million KRW, and take corrective measures such as public announcement.

The Commission clearly stated that Meta’s failure to provide users with the option to refuse the provision of third-party behavioral information before signing up for Facebook and Instagram services and collecting third-party behavioral information violated the law. Users must be able to continue using the service even if they refuse to provide third-party behavioral information.

Third-party behavioral information refers to visit and usage history of other businesses’ websites and apps, purchase and search history, etc. This information allows the identification and analysis of users’ interests, preferences, tastes, and tendencies based on their online activities. Platforms use this information for personalized advertising.

The Commission has continuously monitored the collection and use of behavioral information by major personalized advertising platforms. In September last year, Meta was fined 30.8 billion KRW for collecting and using users’ third-party behavioral information without proper consent.

This latest action was prompted by Meta’s attempt in May last year to change the consent method for Korean Facebook and Instagram users to restrict services if they did not agree to behavioral information collection, which sparked controversy and was subsequently withdrawn. Meta still operates in a way that does not allow users to refuse the provision of third-party behavioral information when signing up for Facebook and Instagram.

The Commission focused its investigation on whether third-party behavioral information, which is ‘online activity records’ of visiting and using other businesses’ websites and apps, constitutes the minimum necessary personal information for providing Facebook and Instagram services. The investigation concluded that third-party behavioral information is not the minimum necessary personal information for the service, and Meta’s act of making service subscription and use conditional on providing this information violates the Personal Information Protection Act.

Even if users set their preferences to refuse providing third-party behavioral information while using Meta services, they can use the services without issues, indicating that this information is not the minimum necessary personal information for service operation. The Commission also comprehensively considered that users find it difficult to anticipate Meta’s collection of third-party behavioral information based on real names, which can seriously infringe on privacy and freedom.

The Commission explained that this action does not mean a fundamental ban on personalized advertising itself or on platforms’ collection of behavioral information. Since third-party behavioral information is not the minimum necessary personal information for platform users, the intent is to provide users with the choice before collecting such information.

Ko Hak-su, Chairperson of the Personal Information Protection Commission, stated, “Recently, many countries overseas are strengthening data subjects’ control over the collection and processing of third-party behavioral information for big tech companies’ personalized advertising,” adding, “Through this investigation and action, we expect the excessive collection and processing practices of global platform operators to be corrected and the data subjects’ right to self-determination over personal information to be more fully guaranteed.”