Campus Business (May 29, 2025) – Meta Platforms, the parent company of Facebook, Instagram, and WhatsApp, has been ranked the most fined social media firm under the European Union’s General Data Protection Regulation (GDPR), with a whopping €2.7 billion in penalties tied to user data violations — particularly involving minors.

According to a new report by cybersecurity firm Surfshark, Meta is part of a group of five social media giants — Facebook, Instagram, TikTok, LinkedIn, and X (formerly Twitter) — that together racked up €3.9 billion in GDPR fines. Instagram was fined €405 million in 2022 for making children’s business accounts public by default, while Facebook was fined €251 million in 2024 following a data breach that compromised minors’ personal information.

TikTok, LinkedIn Also Penalised

TikTok, another major player, has been fined a total of €890 million over three separate incidents, mostly related to the mishandling of children’s data, including inadequate privacy settings and allowing adults to register as guardians without verification.

LinkedIn received a single €310 million fine, and X was fined €450,000. Platforms like YouTube, Snapchat, Pinterest, Reddit, and Threads have not received any GDPR fines to date, though privacy experts caution that this doesn’t necessarily mean they are fully compliant.

“The current enforcement efforts by data protection authorities are rather reactive,” noted Felix Mikolasch, a lawyer at NOYB, a European privacy advocacy group.

Children’s Data the Biggest Red Flag

One-third of the total fines were linked to violations involving children’s data — underlining the growing concern of European regulators about how tech platforms handle the privacy of their youngest users.

Compared to Surfshark’s previous report in October 2023, the total value of GDPR fines against social media platforms has surged by nearly 30%, with four new penalties added — two to Meta, one each to LinkedIn and TikTok.

No Major Fines Yet in Nigeria

Despite these hefty fines in Europe, similar actions have not yet been seen in Nigeria. The National Commissioner of the Nigeria Data Protection Commission (NDPC), Dr. Vincent Olatunji, recently said that the Commission is adopting a less confrontational approach.

“When we investigate and find a breach, if they’re ready to comply with the law, what’s the point of making noise?” he explained. “It’s only when an organization is unwilling to comply that we impose sanctions.”

He also emphasized that the NDPC is cautious about enforcing fines that could affect foreign investment.