EU investigates Instagram over handling of children's data - BBC News

Instagram is being investigated by Ireland's Data Protection Commissioner (DPC) over its handling of children's personal data on the platform.

The investigations stem from complaints that Instagram made contact information on business accounts publicly visible to anyone accessing the app.

The Irish regulator is investigating whether Facebook has a legal basis for processing children's personal data and if it employs adequate protections and restrictions on Instagram for children.

"The DPC has been actively monitoring complaints received from individuals in this area and has identified potential concerns in relation to the processing of children's personal data on Instagram which require further examination.".

In February 2019, data scientist David Stier analysed profiles of almost 200,000 Instagram users across the world.

He estimated that for over a year, at least 60 million users under the age of 18 were given the option to easily change their profiles into business accounts.

Instagram business accounts require users to display their phone numbers and email addresses publicly, meaning that personal data belonging to many users is visible to other Instagram users.

The same personal information was also contained in the HTML source code of web pages accessed when using Instagram on a computer, meaning that it could be "scraped" by hackers.

Mr Stier reported his findings to Facebook, but he wrote in a Medium blog that Instagram had refused to mask the email addresses and phone numbers for business accounts.

However, Facebook did decide to remove the contact information from the source code of Instagram pages.

Despite this, Mr Stier believes that hackers might have succeeded in stealing the personal information from Instagram's website, after it was revealed in May 2019 that contact details relating to 49 million users were stored online in an unguarded database owned by a firm in India.