Australian officials have slapped a pair of hefty $10 million (AUD) penalties on Meta — the company behind and formerly named Facebook — for using its free Onavo Protect VPN to harvest user data for business purposes.
“The Federal Court has ordered two subsidiaries of social media giant Meta, Facebook Israel and Onavo Inc, to each pay $10 million [AUD] for engaging in conduct liable to mislead in breach of the Australian Consumer Law, in an action brought by the ACCC,” the Australian Competition and Consumer Commission stated in a Wednesday press release.
The $20m AUD sum is equal to about $13.5 million USD.
The Onavo Protect VPN app was installed over 270,000 times by Australian users between February 2016 and October 2017, was shut down in May 2019, and has since been removed from the Apple App Store and Google Play Store, according to the press release.
Australian privacy watchdogs have been hard at work in recent memory. In other privacy-related cases, Australian courts fined Google $42.7 million for unlawfully collecting users’ personal Android location data, while the privacy regulators scrutinized ClearviewAI for violating Australian privacy laws.
Meta Misleads Consumers: ACCC
Those concerned with cybersecurity and personal privacy use premium VPNs for many reasons. Legitimate VPNs allow users to connect to an anonymous IP address in a country of their choice, which immediately hides their real location from potential online snoops — like their internet service provider, company trackers, hackers, and other cybercriminals.
Advanced encryption protocols also scramble any browsing or downloading history or other online traffic. VPNs with proven no-log policies keep no data on their user activity — other than information necessary for creating subscriptions and accounts.
According to Aussie authorities, the Onavo Protect app listings did not mention user data was also used for Meta’s market research purposes.
“Anonymised and aggregated data shared with Meta included data about users’ internet and app activity, such as records of every app they accessed and time they spent using those apps. This was used to support Meta’s market research activities,” the ACCC said.
For example, Onavo data reportedly helped Meta recognize the popularity of WhatsApp, which it later acquired.
What Was the Onavo Protect Mobile App?
The app, called Onavo Protect, was promoted on app stores as a way to “keep your data safe when you browse and share information on the web.” However, according to Australian authorities, the app also collected and shared users’ internet and app activity with Meta for market research purposes, without adequately disclosing this to consumers.
According to the ACCC, the app was used by Meta as a “business intelligence tool” to gain insights into its competitors and potential acquisitions.
“US-based Onavo, Inc. and Onavo Mobile Ltd, based in Israel, were mobile analytics companies that were acquired by Facebook in October 2013. After the acquisition Onavo Mobile became Facebook Israel Ltd.,” the ACCC said.
Facebook Israel and Onavo acknowledged in joint submissions to the Court that the app store listings conveyed user data would only be used to provide the VPN service, not other purposes. The companies also consented to the penalty declarations.
The ACCC launched legal proceedings against the two Meta subsidiaries — Facebook Israel and Onavo Inc. — in 2020, alleging that they breached the Australian Consumer Law by engaging in misleading or deceptive conduct and making false or misleading representations.
This is not the first time Meta has run into legal trouble. The tech giant was ordered to pay $725 million to resolve the colossal data privacy class-action lawsuit filed in 2022 related to the 2018 Cambridge Analytica scandal.
Follow us on Twitter, Threads, and Mastodon for more news!
