Meta Fined $20 Million for Undisclosed User Data Collection

A pedestrian walks in front of a Meta sign at Facebook headquarters in Menlo Park, Calif., on Oct. 28, 2021. Justin Sullivan/Getty Images

Mark Zuckerberg’s Meta (formerly Facebook) and its subsidiary has been slapped with $20 million (US$13.54 million) in fines after an Australian court found it secretly harvested data from users.

Onavo Protect, which was acquired by Meta in 2013, is a free virtual private network service that promised to keep user data “safe online” and give customers “peace of mind” when browsing the internet.

However, in 2020, the Australian Competition and Consumer Commission (ACCC) filed a lawsuit against the company and Facebook Israel alleging that the app was secretly collecting “significant amounts“ of data for commercial purposes from February 2016 to October 2017.

The consumer watchdog said Onavo Protect was tracking online activity and even recording the number of seconds spent on the app, alongside IP addresses.

Further, if users had a Facebook account, Meta would combine the data to learn “nearly everything” they were doing on their mobile device.

“Meta and Facebook Israel’s internal documents state that Onavo Protect was ‘a business intelligence tool’ for Meta, which provided Meta with ‘a sample of users who we are able to know nearly everything they are doing on their mobile device,’” wrote Federal Court Justice Wendy Abraham in her judgement on July 26.

“Meta then used anonymised and aggregated data derived from sets of the Onavo Protect Data ... for a range of purposes, including in relation to its advertising and marketing activities, improving its products and services, and developing commercial strategies.”

It was recognised that the app did not strictly promise not to collect consumer data, with disclosures featured in the terms and conditions, yet Justice Abraham said it was “not sufficiently prominent or proximate” compared to marketing claims in the app store listing.

“We were concerned that consumers seeking to protect their privacy through a virtual private network were not clearly told that in downloading and using this app they were actually facilitating the use of their data for Meta’s commercial benefit,” said ACCC Chair Gina Cass-Gottlieb, in a statement.

“We took this case knowing that many consumers are concerned about how their data is captured, stored and used by digital platforms.”

Facebook Israel was fined $10 million and Onava another $10 million. The app is no longer available for download.

Facebook’s Other Lawsuit

The conclusion of the lawsuit comes as the Office of the Australian Information Commissioner continues its pursuit of Meta over the alleged privacy breach of 311,000 local users, part of the fallout from the Cambridge Analytica scandal.

Cambridge Analytica was a British consulting firm that gained access to the data of 87 million Facebook users to support political campaigns. The company filed for bankruptcy in 2018 following the data-sharing scandal.

Cambridge Analytica obtained the information after a researcher was allowed by Meta to deploy an app onto Facebook to harvest the data.

In December, Meta agreed to settle a class action lawsuit over the data harvesting for US$725 million (A$1.1 billion).

Lawyers for the plaintiffs said it was the largest ever settlement over a data privacy class action.

“This historic settlement will provide meaningful relief to the class in this complex and novel privacy case,” the lead lawyers for the plaintiffs, Derek Loeser and Lesley Weaver, said in a joint statement.

Meta did not admit wrongdoing and said the settlement was in “the best interest of our community and shareholders.”

“Over the last three years we revamped our approach to privacy and implemented a comprehensive privacy program,” Meta said.