Google and Meta hit with huge fines for violating privacy in Korea

Unhappy with the decision, the companies may take the case to the court.

The Personal Information Protection Commission (PIPC) on Wednesday decided in a general meeting that Google has to pay 69.2 billion won and Meta 30.8 billion won for illegally collecting user behavior information from services they don’t own, such as apps from other providers, and utilizing the data in personalized advertising without permission.

This is the first time Korea has levied a fine for collecting user behavior information for use in personalized advertising. The fines are the highest ever for a privacy law violation. The previous record was the 6.7-billion-won fine imposed on then Facebook in 2020.

In addition to the fines, the privacy watchdog ordered the tech companies to clearly inform the users prior to obtaining and utilizing the behavior information.

Meta is considering a court challenge to PIPC’s decision.

“While we respect the PIPC’s decision, we are confident that we work with our clients in a legally compliant way that meets the processes required by local regulations,” said a Meta spokesperson. “As such, we do not agree with the PIPC’s decision, and will be open to all options including seeking a ruling from the court.”

Google also said in a statement that “we express deep regret for the result of the PIPC’s deliberation, and plan to closely review the decision.”

Google and Meta have been collecting user behavior data — involving websites and applications they visited or used, shopping history and search logs — from external providers and using the data to present personalized advertisements, according to the PIPC.

Such information is collected automatically when the users sign in for Google and Meta’s services. Meta, the operator of Facebook and Instagram, did not get consent from the users and failed to clearly and fully disclose the details of its terms since 2018, while Google had made users agree to its terms through a default setting over at least the past six years.

As a result, more than 98 percent of local Meta service users and 82 percent of Google users have been letting the companies have access to their personal information, possibly without knowledge, said the commission.

Google provided a five-step manual personalization option for user consent in privacy-related settings in Europe.

“The illegal practices are a solemn breach of the privacy law as collecting behavior information by identifying each user and accumulating such data is likely to pose a serious threat to privacy protection,” said Yoon Jong-in, chairperson of the Personal Information Protection Commission in a statement.

“I hope this serves as an opportunity to rectify the illegal practices of platforms collecting and utilizing personal information without the users knowing in the name of free services.”