Ireland's Data Protection Commission fines social platform €91 million for child data breaches

Ireland's Data Protection Commission imposed a fine of 91 million euros on a social media platform on 1 October 2024 for violations of the General Data Protection Regulation related to the handling of children's personal data, including failures to implement appropriate safeguards for minors' privacy and inadequate transparency about data processing practices. The regulator found that the platform stored passwords in plain text and did not conduct adequate data protection impact assessments for services likely to be accessed by children, breaches that persisted over several years.

Data-protection obligations and real-time harm-prevention are complementary but distinct operational requirements. Where GDPR enforcement addresses the storage, processing and transparency of personal data, Guardii operates at the point of contact to intercept exploitation before harm occurs, analysing direct-message conversations for grooming, sextortion, child sexual abuse material and cyberbullying patterns without creating a persistent record of message content. The platform's architecture surfaces the shape and seriousness of a threat to parents, schools and authorities in real time, enabling immediate intervention where a child is at acute risk. This pattern-detection model addresses the safeguarding gap that data-protection regulation alone cannot close, intercepting predatory behaviour at the conversation layer while minimising the volume of personal data retained.