Meta Platforms Ireland Limited was fined €91 million by Ireland’s Data Protection Commission (DPC) in September 2024 for GDPR violations tied to certain users’ passwords being inadvertently logged in plaintext on internal systems. The “$137 million” in the original headline is an approximate Canadian-dollar conversion reported by MobileSyrup—not US dollars. The DPC did not find that an outside attacker stole the passwords or that every Meta password was stored this way.
Why did Meta get fined for storing passwords in plaintext?
The DPC found that Meta Platforms Ireland Limited (MPIL) had stored certain users’ passwords in plaintext in internal systems. Plaintext means the passwords were not cryptographically protected in those logs. The regulator treated the passwords as personal data and found the incidents to be personal-data breaches under the GDPR.
The DPC’s findings covered two incidents, identified as occurring on 7 January and 31 January 2019. It found that MPIL failed to notify the DPC without undue delay about the breach discovered on 31 January, and failed to document both breaches. It also found infringements concerning data security and the integrity and confidentiality of personal data.
The findings concerned inadvertent plaintext logging, not a determination that all passwords MPIL stored were unprotected. The DPC’s case page says MPIL ordinarily used cryptographic and encryption techniques when storing passwords and did not store the individual characters that make up a password. The decision materials cited by the DPC do not establish that an external attacker obtained the logged passwords or that accounts were misused.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →#1 Best Overall
- ✅ PROTECT ONLINE ACCOUNTS – A password manager, two-factor security key, and secure communication token in one, OnlyKey can keep your accounts safe even if your computer or a website is compromised. OnlyKey is open source, verified, and trustworthy.
- ✅ UNIVERSALLY SUPPORTED – Works with all websites including Twitter, Facebook, GitHub, and Google. Onlykey supports multiple methods of two-factor authentication including FIDO2 / U2F, Yubico OTP, TOTP, Challenge-response.
- ✅ PORTABLE PROTECTION – Extremely durable, waterproof, and tamper resistant design allows you to take your OnlyKey with you everywhere.
- ✅ PIN PROTECTED – The PIN used to unlock OnlyKey is entered directly on it. This means that if this device is stolen, data remains secure, after 10 failed attempts to unlock all data is securely erased.
- ✅ EASY LOG IN –No need to remember multiple passwords because by plugging OnlyKey to your computer, it automatically inputs your username and password. It works with Windows, Mac OS, Linux, or Chromebook, just press a button to login securely!
How much was the fine, and what does “$137 million” mean?
The DPC imposed administrative fines totalling €91 million, along with a reprimand. MobileSyrup reported that amount as approximately $137 million in Canadian dollars. That conversion is not the fine’s euro amount and should not be read as US dollars.
The DPC’s September 2024 announcement quotes Deputy Commissioner Graham Doyle: “It is widely accepted that user passwords should not be stored in plaintext, considering the risks of abuse that arise from persons accessing such data.”
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What did the DPC require under the GDPR?
The decision found infringements of four provisions:
- Article 33(1): Failure to notify the DPC without undue delay of the breach discovered on 31 January 2019.
- Article 33(5): Failure to document the two personal-data breaches.
- Article 5(1)(f): Failure to ensure appropriate integrity and confidentiality of personal data.
- Article 32(1): Failure to implement appropriate technical and organisational security measures.
The DPC also said data controllers should assess processing risks and implement measures to mitigate them. This is the regulator’s explanation of its approach, not a separate court ruling.
Rank #3
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
What happened, and when?
| Date | Event |
|---|---|
| 7 and 31 January 2019 | Incidents later addressed in the DPC decision. |
| 21 March 2019 | MPIL informed the DPC that it had inadvertently stored certain users’ passwords in plaintext. |
| 24 April 2019 | The DPC began an inquiry on its own initiative. |
| June 2024 | The DPC submitted a draft decision to concerned EU/EEA supervisory authorities; it said no relevant and reasoned objections were raised. |
| 26 September 2024 | The DPC adopted its final decision and notified MPIL. |
| 27 September 2024 | The DPC publicly announced the reprimand and €91 million in fines. |
How many passwords were affected, and were they stolen?
The DPC’s decision summary describes a very large number of EU and EEA Facebook Lite users but does not give a precise count. Its cited announcement and case materials do not establish an exact total of affected passwords. They also do not establish that outsiders accessed the passwords or that the credentials were used to take over accounts. The documented issue is plaintext logging inside MPIL’s systems and the company’s security and breach-handling failures.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Did Meta appeal the decision?
The DPC’s 2024 annual report says Meta appealed. That report is a retrospective account, not a current court docket, so it does not establish the appeal’s present status. The cited materials do not provide a later procedural update.
The 2024 Irish DPC decision is separate from the US Federal Trade Commission’s 2019 Facebook settlement. The FTC matter concerned a separate order that included password-encryption and scanning requirements; it was not the basis for the Irish fine.
Quick Recap
Best Value
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
