Personal Information Protection Commission

Press Release

The PIPC Wins Lawsuits against Google and Meta for Collection and Use of Behavioral Data without Consent from Users 

- The Seoul Administrative Court dismissed the claims made by Google and Meta

January 23, 2025

(This is an unofficial translation of a press release, originally prepared in Korean.)

The Seoul Administrative Court upheld the Personal Information Protection Commission (PIPC)'s sanction against Google LLC (Google) and Meta Platforms, Inc. (Meta) in separate rulings on January 22, 2025.

The PIPC started launching investigations into Google and Meta's processing of personal data associated with targeted advertising and imposed KRW 69.2 billion (USD 48 million) on Google and KRW 30.8 billion (USD 21 million) on Meta for collecting the users' online behavioral data for targeted advertising purposes without obtaining proper consent, along with correction orders, in September 2022.

The behavioral data was gleaned from the websites the users visited, the records of application installations and usage, etc. To gain consent from users for the collection and usage of online behavioral data, among others, Google hid "View More Options" from the default setting, and Meta displayed only a fraction of the content concerning its collection practice for targeted advertising. As a result of the investigations, the PIPC fined the two businesses for their unlawful practices. 

Google and Meta, respectively, filed lawsuits in February 2023, arguing that the businesses operating websites or applications should take responsibility for obtaining users' content as a data processor. They also claimed that they gained valid consent from users by informing their data collection practices in their privacy policies.

However, the PIPC argued that the two sanctioned businesses kept track of and collected behavioral data of the users who joined the services, such as Google, Facebook, Instagram, etc. for targeted advertising. In this sense, the PIPC strongly maintained its stance that Google and Meta should have gained consent from their users and mentioned that other data protection authorities imposed similar sanctions in various jurisdictions, including the EU, and the U.S

The PIPC said that the ruling holds significance in that the court upheld its sanctions against their failure to obtain valid user consent for targeted advertising. The milestone also clarifies the legal requirements to comply with the Personal Information Protection Act (PIPA) of large platform business operators. The PIPC stated that it will strengthen its oversight role to respect the people's right to self-determination as Al technologies continue to advance and proliferate.

* A PDF file, formatted for better readability, is attached.