Meta’s Facebook subsidiaries have been smacked with $20 million in fines for misleading users over a free VPN that was harvesting data

The Court declared that the two companies engaged in conduct liable to mislead the public in promotions by failing to adequately disclose that users’ data would be used for purposes other than providing Onavo Protect, including Meta’s commercial purposes.

Onavo and Facebook Israel shared the personal activity data from users collected by the app in anonymised and aggregated form with parent company Meta (then Facebook Inc) for commercial benefit.

The data shared with Meta included details on a user’s internet and app activity, such as records of every app they accessed and time spent using those apps, which was used in Meta’s market research.

ACCC chair Gina Cass-Gottlieb said the regulator took took on the case because consumers are concerned about how their data is captured, stored and used by digital platforms.

“We believe Australian consumers should be able to make an informed choice about what happens to their data based on clear information that is not misleading,” she said.

“In the case of the Onavo Protect app, we were concerned that consumers seeking to protect their privacy through a virtual private network were not clearly told that in downloading and using this app they were actually facilitating the use of their data for Meta’s commercial benefit.”

In joint submissions to the Court, Facebook Israel and Onavo agreed the App Store listings did not mention that data collected by the VPN was also used for other purposes, including as a ‘business intelligence tool’.

A statement issued by Meta said: “The ACCC acknowledged in the joint filing that the Onavo Protect listings were not deliberately misleading and disclosures were made in the app’s Terms of Service and Privacy Policy. Furthermore, all user data was anonymised and aggregated before it was used by Meta.”

Facebook Israel and Onavo were also ordered to pay a contribution to the ACCC’s costs and consented to the declarations and costs order, and made joint submissions with the ACCC in relation to penalties.