Facts
The Personal Information Protection Commission (PIPC) opened the case after learning of the issue during a separate Facebook matter decided in November 2020. Meta collected, through Facebook profiles, sensitive information on about 980,000 Korean users, including religious and political views and whether they were married to a person of the same sex; according to the PIPC, the period concerned ran from July 2018 until corrective steps were completed in March 2022. By analysing behavioural data such as pages users had liked and ads they had clicked, it created sensitive ad topics, among them specific religions, homosexuality, transgender people and North Korean defectors; some 4,000 advertisers used them. During the investigation Meta stopped collecting sensitive data through profiles in August 2021 and deleted those topics in March 2022.
Question
The main question was whether a platform breached Article 23(1) of the Personal Information Protection Act (PIPA), in its pre-amendment form, by using sensitive data on beliefs and political views, taken from profiles and from analysis of behavioural data, for ad targeting when its data policy mentioned this only vaguely and no separate consent was obtained. The PIPC also examined whether Meta had a legitimate reason to refuse access requests about retention periods, disclosures to third parties through Facebook Login and the legal basis for collecting off-Facebook activity. It further assessed, under the security obligations, Meta's failure to take down an unused account recovery page through which passwords were reset with forged identity documents.
Decision
At its 18th plenary meeting on 4 November 2024 the PIPC held that Meta had processed sensitive data without a lawful basis. The Act allows such processing only in exceptional cases such as separate consent; Meta had relied on a vague statement in its data policy, with no separate consent or additional safeguards. The refusal of access was unjustified because Article 41(1)(iii)-(v) of the Enforcement Decree makes those items accessible. The disused recovery page led to a leak affecting 10 Korean users. Under Articles 23(1), 29 and 35(3) of the former PIPA, the PIPC imposed a penalty surcharge of KRW 21,613,000,000 and an administrative fine of KRW 10,200,000, and issued corrective orders with an implementation plan due within 90 days.
Why it matters
The decision treats ad topics that are built by analysing user behaviour and tied to traits such as religion or sexual orientation as part of the processing of sensitive data. According to the PIPC, it was the first sanction against Meta concerning sensitive data. The decision applied the Act's pre-amendment provisions. The decision also stresses that foreign platforms serving Korean users must uphold data subjects' rights, including the right of access. Whether Meta challenged the decision in court could not be verified for this entry.
Related stages
Actions brought by Google and Meta against the PIPC's September 2022 decision on collecting behavioural data from other websites and apps for targeted advertising without consent (KRW 69.2 billion and KRW 30.8 billion) were dismissed by the Seoul Administrative Court's 2nd Administrative Division on 23 January 2025. Meta appealed on 3 February and Google on 4 February 2025; as of September 2026 both appeals were pending before the Seoul High Court (Meta: 2025누6020; Google: 2025누5923).