The Microsoft Corp.-owned professional networking platform LinkedIn has been ordered to pay €310 million ($334 million) by the European Union’s privacy regulator over targeted advertising practices, one the biggest fines to hit American big tech under the General Data Protection Regulation.
The fine was imposed by the Irish Data Protection Commission, the bloc’s privacy watchdog for U.S. big tech given the number of operations run out of Ireland. The regulator said LinkedIn had violated the GDPR by not obtaining consent from its users over how their data was used and processed by itself and third parties.
“The lawfulness of processing is a fundamental aspect of data protection law and the processing of personal data without an appropriate legal basis is a clear and serious violation of a data subject’s fundamental right to data protection,” said the DPC.
This decision goes back to a complaint in 2018 made by the French nonprofit organization La Quadrature Du Net. The French Data Protection Authority then provided information to the DPC, the supervisory authority for LinkedIn.
“Today the Irish Data Protection Commission reached a final decision on claims from 2018 about some of our digital advertising efforts in the EU,” LinkedIn said in response. “While we believe we have been in compliance with the General Data Protection Regulation, we are working to ensure our ad practices meet this decision by the IDPC’s deadline.”
The mammoth fine is now the fifth-largest issued by the DPC under GDPR and the sixth-largest by any EU regulator since the rules were introduced in 2018. The regime left companies scrambling to meet compliance standards, fearing massive fines of up to 2% of a company’s global turnover.
So far Meta Platforms Inc. has been the hardest-hit out of all U.S. tech behemoths, ordered to pay an historic €1.2 billion in 2023 after the third-largest EU fine of €405 million in 2022. Amazon.com Inc., the subject of the second-largest fine, was ordered to pay almost double that amount in 2021.