Ireland's Data Protection Commission, on behalf of the EU, fines WhatsApp €225M for privacy violations, the second-largest under GDPR; WhatsApp will appeal
Regulators say chat-service unit failed to disclose fully how it collected and shared data about its users Source: Data Protection Commission .
Wall Street JournalSam Schechner
Context & Ripple Effects
WhatsApp had already been ordered by France's privacy authority to halt user-data sharing with Facebook, while Ireland's DPC had opened cross-border investigations heavily concentrated on Facebook, WhatsApp, and Instagram. The €225M case turns that scrutiny into one of GDPR's largest penalties and tests Meta's disclosure practices at a core service.
The DPC's later penalties involving Instagram and Meta show that the WhatsApp case belongs to a wider enforcement record against Meta-owned services, rather than an isolated complaint.
First-order effects
WhatsApp faces a €225M GDPR penalty over incomplete disclosures about data collection and sharing, while its appeal puts the case into a longer legal process.
Meta's Facebook and Instagram units face greater pressure to examine how they explain data collection and sharing, since the same Irish regulator oversees multiple investigations involving the group.
The fine raises the cost of opaque privacy notices for other services subject to cross-border GDPR oversight, giving regulators a prominent penalty benchmark in disputes over transparency.
Third-order effects
If repeated DPC actions across Meta-owned services hold up, GDPR enforcement shifts from investigating individual practices toward sustained oversight of how large platform groups disclose and govern user data.
Appeals will help determine how quickly large GDPR fines translate into operational changes, but the enforcement pattern makes privacy transparency a group-level regulatory exposure rather than a product-specific issue.
The trend: EU privacy enforcement is increasingly treating data-disclosure failures at major platform groups as a cross-service compliance risk.
Finally (!!!) @DPCIreland issued a first fine more than 3 years after the #GDPR applied, in light of tenthousands of complaints per year and after the @EU_EDPB forced them to have make the fine 4.5-fold.. Facebook/WhatsApp will now use the Irish legal.. https://www.rte.ie/...
Here's what happened. Europe's other #privacy regulators said Ireland hadn't done a good enough job. They added additional reasons about @whatsapp falling foul of Europe's #privacy rules and — importantly — they added this in terms of size of fine. https://twitter.com/...
Reminder: Ireland originally asked for 50m euro fine. Other watchdogs overruled them and quadrupled the fine. I'm no lawyer, but that's either a hit to the one-stop-shop mechanism or a win for EU-wide #privacy rules https://www.politico.eu/...
BREAKING: The Irish Data Protection Commission has imposed a €225m fine on WhatsApp for infringing data protection rules. It's the second largest fine ever imposed in the EU under the GDPR and the largest ever imposed by the DPC.
Breaking: @DPCIreland fines WhatsApp €225 million under the GDPR — the second-largest fine under the law so far. It's a sign (along with the Amazon fine from July) of stepped up GDPR enforcement. https://www.wsj.com/...
While it sound big, the fine is a pittance for Facebook and of course, the company is going to appeal, meaning this will be dragged through the courts for years.... https://twitter.com/...
The fine is for failing to sufficiently inform users and nonusers about what it does with their data. Now WhatsApp will have to update its privacy policies and how it informs users about its use of their information.
OK, so we now know who objected to Ireland's provisional settlement: the Germans, the French, the Italians, the Polish, the Portuguese, the Hungarians and the Dutch. That makes for an awkward conversation
The Irish DPC initially planned a fine as low as $150,000 on WhatsApp. Other enforcers rightly objected, and an EDPB binding decision has forced the DPC to increase that fine to €225 million. https://www.dataprotection.ie/ ... https://twitter.com/... https://twitter.com/...
WhatsApp says it will appeal. “We disagree with the decision today regarding the transparency we provided to people in 2018 and the penalties are entirely disproportionate,” a spokesman said.
@dpcireland Data Protection Commission Ireland on x
DPC announces decision in WhatsApp inquiry https://www.dataprotection.ie/ ... https://twitter.com/...
For me, this is most important part: Europe's network of privacy regulators ordered Ireland to reassess and increase its proposed fine after objections to the original penalty from eight other EU regulators.