It said the company shared the data with about 4,000 advertisers.

South Korea’s privacy law provides strict protection for information related to personal beliefs, political opinions and sexual behavior and prohibits companies from processing or using such data without the specific consent of the individual involved.

The commission said Meta gathered sensitive information by analyzing the pages Facebook users liked or the ads they clicked on.

The company classified the ads to identify users interested in topics such as specific religions, same-sex and transgender issues and issues related to North Korean defectors, said Lee Eun Jung, a director at the commission that led the Meta investigation.

“While Meta collected this sensitive information and used it for individualized services, they only made vague mentions of this use in their data policy and did not obtain specific consent,” Lee said.

Lee also said that Meta put the privacy of Facebook users at risk by failing to implement basic security measures, such as removing or blocking inactive pages. As a result, hackers were able to use inactive pages to spoof identities and request password resets for other Facebook users’ accounts. Meta approved those requests without proper verification, leading to data breaches that affected at least 10 Facebook users in South Korea, Lee said.

In September, European regulators hit Meta with more than $100 million in fines for a 2019 security breach in which users’ passwords were temporarily exposed in an unencrypted form.

Meta’s South Korea office said it would “carefully review” the commission’s decision, but did not immediately offer further comment.

In 2022, the commission fined Google and Meta $72 million for tracking consumers’ online behavior without their consent and using their data for targeted advertising, in the largest penalties ever imposed in South Korea for breach of privacy law.

The commission said then that the two companies did not clearly inform users and did not obtain their consent to collect data about them because they used other websites or services outside their own platforms. It ordered companies to provide an “easy and clear” consent process to give people more control over whether to share information about what they do online.

The commission also hit Meta with a $4.8 million fine in 2020 for providing personal information about its users to third parties without consent.