Facebook Data Scraping Case: The €265 Million DPC Fine

Ireland’s regulator found Meta’s contact-importer and search tools lacked data protection by design and default.

By Siddharth ShankarUpdated October 23, 2026

This case is a useful reminder that a “leak” is not always a hack. Sometimes personal data is collected in bulk through features that were built to be convenient, and then ends up in one place on the internet. Ireland’s Data Protection Commission, or DPC, looked at exactly that question for Facebook.

What the regulator decided

The DPC announced its decision in what it called the Facebook “Data Scraping” inquiry on 28 November 2022. The decision itself was adopted on 25 November 2022. It imposed administrative fines totalling €265 million on Meta Platforms Ireland Limited, which was formerly Facebook Ireland Limited. It also issued a reprimand and ordered the company to bring its processing into compliance by taking specified remedial actions within a set timeframe.

Why the inquiry started

The DPC opened the inquiry on 14 April 2021. The trigger was media reporting about a collated dataset of Facebook personal data that had been made available on the internet. The inquiry did not look at one single mistake. It looked at how three tools worked and whether they protected people’s data by design.

Which tools were examined

The inquiry covered the Facebook Search tool, the Facebook Messenger Contact Importer and the Instagram Contact Importer. It looked at processing that took place between 25 May 2018 and September 2019. Contact importers let a person upload their phone contacts so the service can match them to existing accounts. Search tools let people look up others by details such as a phone number. Both are useful, and both can be abused at scale if they are not limited.

What the DPC found

The DPC found that Meta Platforms Ireland had infringed Articles 25(1) and 25(2) of the GDPR. These articles require data protection by design and by default. In plain terms, a service has to build in protections from the start, and its default settings should not expose more personal data than needed. Other EU data protection authorities took part through the GDPR’s cooperation process, and they agreed with the decision.

What the DPC page does not say

It is worth being precise here. The DPC’s decision page and press release do not state how many people were in the dataset, and they do not list which data fields it contained. We therefore do not repeat figures that the regulator did not publish. If you read a number elsewhere, check what source it comes from.

Why this matters for your phone number

The tools examined are built around matching people by contact details. That is why a phone number you have shared with a social network can be more identifying than it looks. Even if you never post it, a company that holds it can use it to connect you to an account. Learn more in how to check if your phone number is public and what an exposed phone number means.

What you can do

1. Review who can find you by phone number or email in the privacy settings of each social network you use, and choose the narrowest option you are comfortable with.
2. Remove details you do not use. If an old phone number or email is attached to an account, delete it.
3. Be careful with contact upload. When an app asks to sync your contacts, you are also sharing other people’s numbers. Turn it off if you do not need it.
4. Expect more scam texts and calls if your number is out there, and treat unexpected messages with caution. Our guide on how scammers get your number explains the usual routes.
5. Use your legal rights. If you are in the EU or UK you can ask a company what it holds and ask it to delete data. See how to ask a company to delete your data.

How this differs from a breach

In a classic breach, an attacker gets into a company’s systems. Here, the regulator examined whether the design of features allowed large-scale collection. The result for the user can feel the same: information you shared for one purpose becomes searchable or listed elsewhere. Our explainer on what a data breach is covers the difference, and the LinkedIn scrape is another example.

Fines and what they change

A fine does not remove data that has already spread. What it can do is force a company to change its design so the same collection is harder next time. For context on how large penalties compare, see our data protection fines statistics.