The Federal Court of Australia has ordered two Meta subsidiaries, Facebook Israel and Onavo Protect VPN, to pay fines of $10 million each for their failure to disclose to Australian users that their personal data was being mined through a free VPN service.
Onavo Protect VPN was sharing anonymized and aggregated data with Meta, including users’ internet and app activity, such as records of every app accessed and the time spent using those apps.
Both companies admitted in joint court submissions that Onavo Protect’s app listings on platforms like Google and Apple App Store did not inform users that their data was being collected as a “business intelligence tool” or that it would be used to support Meta’s market research activities. Instead, the VPN was promoted as a means to “protect personal information” and “keep you and your data safe.”
The VPN service was available for download in Australia from February 2016 to February 2019 and was installed over 270,000 times before its discontinuation in May 2019.
Onavo and Onavo Mobile, both mobile analytics companies based in the US and Israel, respectively, were acquired by Facebook in October 2013, with Onavo Mobile becoming Facebook Israel after the acquisition.
Justice Wendy Abraham, in her judgment, stated that despite being marketed as a privacy protection tool, Onavo Protect was used to collect a wide range of data about users’ mobile device usage.
As a result of the legal proceedings filed by the Australian Competition and Consumer Commission (ACCC) in 2020, accusing both Meta subsidiaries of misleading conduct and breaching the Australian Consumer Law, the court ordered them to pay $10 million each to the Commonwealth of Australia and $400,000 towards the ACCC’s legal costs.
ACCC chair Gina Cass-Gottlieb expressed concerns that users seeking privacy through a virtual private network were not adequately informed about their data’s use for Meta’s commercial benefit.
In response, Meta clarified that the ACCC did not allege any malfunction in the app’s function as an online security tool and emphasized its commitment to data privacy and security. The company stated that they have been working on providing more transparency and control over users’ data, designing new products and features with privacy in mind.
