Ireland investigates Instagram on making children’s data public

You are a child under the age of 18. Ideally, no one should be able see your email id and phone number on Instagram. This is also a requirement under European law.

But, there is a loophole. It is possible for a child to mark their account as a business account. When that happens, anyone can see their email id and phone number.

The issue was first highlighted in 2019 by David Stier, a US based data scientist. He also found that the webpage of Instagram contains this information. This means that anyone who copies the source code of the page can get this information.

Since then, Instagram has stopped publishing this data in their page source code. They have also made it possible for businesses to not provide contact information.

Why is this important to Ireland? 

Many American tech giants have their European headquarters in Ireland. Ireland’s Data Protection Commissioner (DPC) is, therefore, the leading European Union regulator to check whether the companies are following European rules.

Europe follows something called the EU General Data Protection Regulation (GDPR). DPC is also checking if Instagram is following these rules.

Instagram is a company owned by Facebook. The company has said that they do not agree with the charges but are cooperating with the authorities.

DPC can issue heavy fines if it finds that there has been a violation of rules or data leakage.

Not the First Time

This is not the first time that a social media platform is being checked for using children’s data in an incorrect way.

In May 2020, South Korea fined Tiktok 186m won (£123,000). The regulator of Korea said that the app collected the data of children without the consent of the legal guardian. The watchdog also said that the app did not inform users that their data was being sent overseas (outside the country).

In 2019,  Musical.ly app was fined 5.7 million dollars by US authorities for not protecting the data of children.

In 2019, Google’s Youtube was also fined $136 million for the same thing – collecting the data of children without the consent of their parents.