The EU is investigating whether Instagram illegally exposed the personal details of millions of underage users. Instagram’s parent company Facebook could face a fine of up to 5% of its revenue.

The investigation is being carried out by Ireland’s Data Protection Commission (DPC), as Facebook’s European headquarters are in Dublin. The investigation comes after a complaint made from US data scientist, David Stier.

Stier analysed almost 200,000 profiles within a year and estimated that at least 60 million users under the age of 18 had their contact information exposed. Anyone can change their Instagram account into a business account, which until very recently used to require phone numbers and email addresses to be shown.

Stier also highlighted that the same contact details were contained in the HTML source code of web pages accessed, which were easily accessible if inspected. Facebook has since removed contact information from the source code of Instagram pages.

The DPC has called for two investigations into Facebook. The first will examine how data is processed, the legal framework Facebook uses to process children’s data on Instagram. The second investigation will delve into Instagram’s profile and account settings, and if they are appropriate and user-friendly enough for child users.

A spokesperson for Facebook has stated that users are clearly informed that their contact information will be displayed publicly, arguing this is different to “exposing” personal information. Since the allegation, several updates to business accounts have been made and people can now opt out of including their contact information entirely.