Social media app Instagram is being investigated by the EU for allegedly failing to protect the privacy of children's data.
Instagram's alleged data mishandling allowed the email addresses and phone numbers of children aged under 18 to become visible to other users of the platform. Facebook, which owns the social media app, has denied breaking any privacy laws.
The investigation into the app is being led by Ireland's Data Protection Commissioner (DPC), the lead European Union regulator for social media companies under the EU's General Data Protection Regulation (GDPR), which came into force in 2018.
A key role of the Irish regulator is to defend an individual's right to online privacy. The DPC can fine violators of this right large sums of money.
During the investigation, the DCP will determine whether Facebook has a legal basis for processing children's personal data. It will also probe the protections and restrictions put in place for children on Instagram to assuage if they are adequate.
Instagram requires users to be at least 13 years old before they can create an account. In some jurisdictions, the minimum age requirement is higher.
The DCP is also looking at Facebook to check that the company has adhered with GDPR requirements regarding Instagram's profile and account settings. In this separate investigation, the commissioner will seek to determine whether Facebook is adequately safeguarding the data protection rights of children as vulnerable people.
Facebook has said it is cooperating fully with the DCP.
"Instagram is a social media platform which is used widely by children in Ireland and across Europe," said DPC deputy commissioner Graham Doyle.
"The DPC has been actively monitoring complaints received from individuals in this area and has identified potential concerns in relation to the processing of children's personal data on Instagram which require further examination."
Research completed by US-based data scientist David Stier prompted the DCP to investigate Instagram. In 2019, Stier analyzed profiles of almost 200,000 Instagram users across the world and estimated that at least 60 million users under the age of 18 were offered the option to switch their personal profiles into business accounts.
Instagram users with business accounts are required to display their phone numbers and email addresses to other users of the platform.