Irish regulator fines Meta €91 million for storing child user passwords in plain text

Ireland's Data Protection Commission has fined Meta €91 million for storing hundreds of millions of user passwords, including those of children, in plain text on internal servers, violating GDPR requirements for data security. The breach, which Meta disclosed in 2019 but which continued for years prior, exposed passwords to internal employees and created risk of unauthorised access. The DPC found that Meta failed to implement appropriate technical and organisational measures to protect children's data and delayed notifying the regulator of the breach.

Authentication failures expose children to account takeover; contact-layer threats require a different defence. Grooming and sextortion occur in the direct-message environment after a child has logged in, through conversations that appear legitimate at the outset and escalate over hours or days. Guardii's detection system monitors these exchanges in real time on Instagram, Snapchat, Discord and Roblox, identifying coercion, isolation and sexual solicitation as patterns develop, blocking hostile contact before it reaches the child and alerting parents or safeguarding teams when a conversation meets risk thresholds. For platforms under regulatory scrutiny for failures to protect child users, deploying effective harm-detection infrastructure demonstrates a credible commitment to safety that goes beyond perimeter security, addressing the exploitation that occurs inside the platform itself.