Meta Fined $102 Million by EU Over Facebook Password Security Lapse

Meta, the parent company of Facebook, has been hit with a significant fine of 91 million euros ($102 million) by the European Union’s privacy regulator for a security failure that exposed Facebook users' passwords. The Irish Data Protection Commission (DPC), which oversees Meta's compliance under the EU’s strict data protection laws, announced the penalty following a years-long investigation into the mishandling of user passwords.

The investigation began in 2019 after Meta reported that certain Facebook user passwords had been stored internally in plain text, meaning they were not encrypted. This could have potentially allowed company employees to access or search the passwords, a serious breach of security practices. Graham Doyle, Deputy Commissioner of the DPC, stated that it is "widely accepted" that user passwords should never be stored in plain text, given the risks this practice poses.

A look at Meta's response 

Meta acknowledged the issue, saying a "subset" of Facebook users’ passwords were temporarily logged in an unencrypted format. In response, the company said, "We took immediate action to fix this error, and there is no evidence that these passwords were abused or accessed improperly." Meta added that it had proactively reported the issue to the Irish regulator and had cooperated fully during the investigation.

Here is what you need to know

This latest fine adds to a growing list of penalties levied against Meta by European regulators. Previous fines include a massive 405 million euro penalty for Instagram’s mishandling of teen data, a 5.5 million euro fine for WhatsApp, and a record-breaking 1.2 billion euro fine for Meta’s transatlantic data transfers.

The DPC’s ruling highlights the ongoing scrutiny faced by global tech giants under the EU’s General Data Protection Regulation (GDPR), which enforces strict guidelines for how companies handle user data. Meta's repeated violations have raised concerns over the security of user data on its platforms and continue to draw attention to the company’s handling of privacy matters.