Google and Meta hit with huge fines for violating privacy in Korea

Google and Meta Platforms have been fined a total of 100 billion won ($72 million) for violating a privacy law.

Google logo is shown at the company's Startup Campus in Gangnam District, southern Seoul, on Wednesday. The Personal Information Protection Commission imposed a record fine of 100 billion won ($72 million) in total on Google and Meta for illegally collecting user information. [YONHAP]

Google and Meta Platforms have been fined a total of 100 billion won ($72 million) for violating a privacy law.

Unhappy with the decision, the companies may take the case to the court.

The Personal Information Protection Commission (PIPC) on Wednesday decided in a general meeting that Google has to pay 69.2 billion won and Meta 30.8 billion won for illegally collecting user behavior information from services they don't own, such as apps from other providers, and utilizing the data in personalized advertising without permission.

This is the first time Korea has levied a fine for collecting user behavior information for use in personalized advertising. The fines are the highest ever for a privacy law violation. The previous record was the 6.7-billion-won fine imposed on then Facebook in 2020.

In addition to the fines, the privacy watchdog ordered the tech companies to clearly inform the users prior to obtaining and utilizing the behavior information.

Meta is considering a court challenge to PIPC's decision.

“While we respect the PIPC’s decision, we are confident that we work with our clients in a legally compliant way that meets the processes required by local regulations," said a Meta spokesperson. "As such, we do not agree with the PIPC’s decision, and will be open to all options including seeking a ruling from the court."

Google also said in a statement that "we express deep regret for the result of the PIPC's deliberation, and plan to closely review the decision."

Google and Meta have been collecting user behavior data — involving websites and applications they visited or used, shopping history and search logs — from external providers and using the data to present personalized advertisements, according to the PIPC.

Such information is collected automatically when the users sign in for Google and Meta’s services. Meta, the operator of Facebook and Instagram, did not get consent from the users and failed to clearly and fully disclose the details of its terms since 2018, while Google had made users agree to its terms through a default setting over at least the past six years.

As a result, more than 98 percent of local Meta service users and 82 percent of Google users have been letting the companies have access to their personal information, possibly without knowledge, said the commission.

Google provided a five-step manual personalization option for user consent in privacy-related settings in Europe.

“The illegal practices are a solemn breach of the privacy law as collecting behavior information by identifying each user and accumulating such data is likely to pose a serious threat to privacy protection,” said Yoon Jong-in, chairperson of the Personal Information Protection Commission in a statement.

“I hope this serves as an opportunity to rectify the illegal practices of platforms collecting and utilizing personal information without the users knowing in the name of free services.”

Yang Cheong-sam, head of the investigation team of the Personal Information Protection Commission, speaks during a press conference on Wednesday at the Central Government Complex in Jongno District, central Seoul, about imposing fines against Google and Meta for a privacy law violation. [YONHAP]

The PIPC started to look into the privacy law violation cases of major online advertisement services in February last year. The investigation will continue with related issues, especially in regard to Meta’s recent attempt at forcing its users to agree to its new privacy policy, said the commission.

Previously, Meta announced to Korean users that it would freeze the accounts of users who did not agree to the company’s updated privacy policy regarding behavior data collection and personalized advertisements, but withdrew the suspension plan on June 28 facing backlash from local users.

BY SHIN HA-NEE [shin.hanee@joongang.co.kr]