Stacy Jo Dixon
Research expert covering social media usage worldwide
Social media regulations in Europe - statistics & facts
The European Union takes personal data mishandling and problematic content seriously, and no social media company is exempt from the rules and regulations adopted by European Parliament. Platforms are subject to hefty penalties if they fail to adhere to established principles, and the safety of minors is often in the spotlight.
The largest penalty issued to a social media company was a 1.2 billion euro fine that Meta received in May 2023. The Irish Data Protection Commission penalized Meta 1.2 billion euros for violating laws on digital privacy and putting the data of EU citizens at risk through Facebook's EU-U.S. data transfers, breaching GDPR rules. This massive penalty highlights the regulations that all social media networks must adhere to, even those based overseas. The most recent GDPR fine issued to a digital company was to TikTok Limited in September 2023 for a total of 345 million euros for reasons of non-compliance with general data processing principles. Overall, non-compliance with general data processing principles was the most common type of GDPR violation, as of September 2024.
The DSA classifies social media platforms Facebook, Instagram, LinkedIn, TikTok, Pinterest, Snapchat, and X (formerly Twitter) as Very Large Online Platforms (VLOP) as each of these social networks has more than 45 million users per month in the EU. Therefore, services are subject to specific obligations due to the risks they pose regarding the dissemination of harmful and illegal content.
Once the European Commission designates a platform as a VLOP, the online service has four months to comply with the DSA. The network must establish a point of contact for authorities, report criminal offenses, have user-friendly terms and conditions, and be transparent regarding advertising and content moderation decisions. The companies to which these platforms belong can face fines of up to six percent of their annual global revenue if they fail to comply with the requirements of the DSA.
In July 2024, the European Commission informed X (formerly Twitter) that it was in breach of the Digital Services Act. The Commission determined that X infringed the rules due to the platform's "verified" feature, alleging that it impacted users' ability to make free and informed decisions regarding the authenticity of accounts and content on the platform. Furthermore, lack of transparency in advertising and the failure to provide access to public data to researchers were also breaches of the DSA.
Meta says that parental supervision tools, 'take a break' notifications, and quiet mode are features in place to protect children and teens, yet, citing behavioral addiction as a concern, the Commission believes that the site's design and algorithms take advantage of young users. Additionally, the European Commission is looking to revise certain consumer protection legislation to guarantee a higher level of protection on online platforms. Other ongoing investigations include TikTok, X, and AliExpress.
The rules set out by the GDPR and DSA are there to protect social media users in the EU from personal data breaches and harmful online experiences. As numerous social networks boast hundreds of millions of monthly active users, the regulation of how large tech corporations conduct themselves is subject to scrutiny. The penalties issued to these firms demonstrate the seriousness of the EU when it comes to protecting the rights of social media users in the region.
General Data Protection Regulation (GDPR)
Enforcement of the General Data Protection Regulation (GDPR) began in 2016 and requires social media platforms to obtain consent from their users before accessing and using their personal information. Citizens of the European Union have the right to access, modify, and erase personal data, known as the 'right to be forgotten', and receive personal data collected by a company and have it transmitted to another company (data portability). Furthermore, the GDPR states that citizens must receive notification in the event of a personal data breach.The largest penalty issued to a social media company was a 1.2 billion euro fine that Meta received in May 2023. The Irish Data Protection Commission penalized Meta 1.2 billion euros for violating laws on digital privacy and putting the data of EU citizens at risk through Facebook's EU-U.S. data transfers, breaching GDPR rules. This massive penalty highlights the regulations that all social media networks must adhere to, even those based overseas. The most recent GDPR fine issued to a digital company was to TikTok Limited in September 2023 for a total of 345 million euros for reasons of non-compliance with general data processing principles. Overall, non-compliance with general data processing principles was the most common type of GDPR violation, as of September 2024.
Digital Services Act (DSA)
Fully implemented in Europe in February 2024, the Digital Services Act (DSA) is a set of EU-wide rules that aim to make online environments safer by establishing accountability and responsibilities for intermediary service providers, such as social media platforms and online marketplaces.The DSA classifies social media platforms Facebook, Instagram, LinkedIn, TikTok, Pinterest, Snapchat, and X (formerly Twitter) as Very Large Online Platforms (VLOP) as each of these social networks has more than 45 million users per month in the EU. Therefore, services are subject to specific obligations due to the risks they pose regarding the dissemination of harmful and illegal content.
Once the European Commission designates a platform as a VLOP, the online service has four months to comply with the DSA. The network must establish a point of contact for authorities, report criminal offenses, have user-friendly terms and conditions, and be transparent regarding advertising and content moderation decisions. The companies to which these platforms belong can face fines of up to six percent of their annual global revenue if they fail to comply with the requirements of the DSA.
In July 2024, the European Commission informed X (formerly Twitter) that it was in breach of the Digital Services Act. The Commission determined that X infringed the rules due to the platform's "verified" feature, alleging that it impacted users' ability to make free and informed decisions regarding the authenticity of accounts and content on the platform. Furthermore, lack of transparency in advertising and the failure to provide access to public data to researchers were also breaches of the DSA.
The EU investigates Meta
The European Commission has initiated an inquiry into Meta Platforms, with a particular focus on how Facebook and Instagram protect minors while using their services. The investigation focuses on concerns that these platforms may be exposing children and teens to harmful content and are in violation of the EU's digital safety regulations. Under scrutiny is the safeguarding of minors’ personal data in compliance with the GDPR, with the investigation assessing privacy settings and data processing practices.Meta says that parental supervision tools, 'take a break' notifications, and quiet mode are features in place to protect children and teens, yet, citing behavioral addiction as a concern, the Commission believes that the site's design and algorithms take advantage of young users. Additionally, the European Commission is looking to revise certain consumer protection legislation to guarantee a higher level of protection on online platforms. Other ongoing investigations include TikTok, X, and AliExpress.
The rules set out by the GDPR and DSA are there to protect social media users in the EU from personal data breaches and harmful online experiences. As numerous social networks boast hundreds of millions of monthly active users, the regulation of how large tech corporations conduct themselves is subject to scrutiny. The penalties issued to these firms demonstrate the seriousness of the EU when it comes to protecting the rights of social media users in the region.
