Who was sanctioned, and for what?

In its flight booking flow, Agoda Company Pte. Ltd. did not show clearly whether a ticket was refundable and which cancellation or change fees applied – the information could only be reached via a link to baggage rules – and, for accommodation paid later, displayed a price without the possible surcharge of up to 5%, partly in a foreign currency. The authority regarded this as a breach of the duty to explain key terms under the Telecommunications Business Act (전기통신사업법), imposed a fine of 2,424,000,000 KRW and ordered Agoda to show conditions, fees and final prices early and clearly, to check screen flows internally in advance and to have Korean translations reviewed by professionals.

Authority / court

Korea Media and Communications Commission (KMCC, 방송미디어통신위원회)

Area of law

Consumer protection and online retail · Information duties in online retail

Legal basis

Telecommunications Business Act (전기통신사업법) Art. 50(1) Nr. 5-2, Art. 52, Art. 53; Enforcement Decree Art. 42 i. V. m. Anhang 4

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Repeat case

no

Mitigating circumstances

Reduction of 10% because the authority had not imposed a fine in the preceding three years; partial voluntary corrections made after the investigation began were not accepted as a mitigating factor.

Published

6 Jul 2026

Original amount 2,424,000,000 KRW, converted at the ECB reference rate of 6 Jul 2026.

Checked against the official source on 4 Oct 2026 · Direct link

In January 2025 attackers infected the work computer of an employee of the online job portal Incruit with malware, took over the employee’s database access and, until February 2025, extracted data on all 7,275,843 members and 54,475 stored CVs, cover letters and copies of certificates (438 GB in total). Despite conspicuous database access outside business hours, the company only noticed the leak through an extortion message; it had already been sanctioned in July 2023 for inadequate access controls. The authority imposed a penalty surcharge of 463,000,000 KRW and ordered the appointment of a qualified chief privacy officer and a plan to prevent further incidents and support those affected.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Information Protection Act (개인정보 보호법) Art. 29; Sanktion nach Art. 64-2(1) Nr. 9

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Repeat case

yes

Mitigating circumstances

Reduction of 55% because no benefit was derived and the company is a medium-sized enterprise under the Korean Framework Act on Small and Medium Enterprises, and a further 20% for cooperation, remediation and self-regulation; increase of 65% because the infringement lasted more than two years and because of the July 2023 sanction.

Liability of senior managers

The company was ordered to appoint a new, qualified chief privacy officer (CPO) and to define the CPO’s responsibility clearly.

Published

23 Oct 2025

Original amount 463,000,000 KRW, converted at the ECB reference rate of 22 Oct 2025.

Checked against the official source on 4 Oct 2026 · Direct link

The two leading accommodation booking platforms sold small and medium-sized lodging businesses advertising packages whose price included discount coupons for guests, and let unused coupons expire without compensation (Yanolja at the end of the contract period, Yeogi Eottae through a validity of only one day). The KFTC (Korea Fair Trade Commission, Korea's competition authority) treated this as an abuse of a superior bargaining position, issued corrective and notification orders and imposed fines totalling KRW 1,540 million: KRW 540 million on Nol Universe (Yanolja) and KRW 1,000 million, the statutory maximum fixed-amount fine, on Yeogi Eottae.

Authority / court

Korea Fair Trade Commission (KFTC)

Area of law

Competition law · Abuse of market power

Legal basis

Art. 45 Abs. 1 Nr. 6 MRFTA i. V. m. Art. 52 und Anhang 2 Nr. 6 lit. d Durchführungsverordnung (Monopoly Regulation and Fair Trade Act)

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Published

12 Aug 2025

Original amount 1,540,000,000 KRW, converted at the ECB reference rate of 12 Aug 2025.

Checked against the official source on 4 Oct 2026 · Direct link

After a login outage of around 75 minutes on Instagram on 22 March 2024 that affected some 3.35 million users in Korea, Meta Platforms reported the incident only 24 hours and 19 minutes after it began, despite three requests from the Ministry. A report within 10 minutes and a written report within two hours are required; the Ministry imposed an administrative fine of 5,000,000 KRW under the Framework Act on Broadcasting and Communications Development (방송통신발전 기본법). The amount and the facts have not been confirmed against the primary source.

Authority / court

Ministry of Science and ICT (MSIT, 과학기술정보통신부)

Area of law

Information security and cyber · Incident reporting obligations

Legal basis

Framework Act on Broadcasting and Communications Development (방송통신발전 기본법) Art. 38; Basisplan zum Management von Kommunikationsstörungen 2024

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

28 Nov 2024

Original amount 5,000,000 KRW, converted at the ECB reference rate of 28 Nov 2024.

Checked against the official source on 4 Oct 2026 · Direct link

Through Facebook profiles and usage behaviour, Meta Platforms, Inc. collected sensitive characteristics of around 980,000 users in Korea – such as religion, political views or same-sex marriage – and made advertising topics built on them available to around 4,000 advertisers without obtaining separate consent. Meta also refused access requests without a legitimate reason and left an unused account-recovery page online through which passwords were reset with forged ID documents and data on ten users was obtained. The authority imposed a penalty surcharge of 21,613,000,000 KRW and an administrative fine of 10,200,000 KRW (21,623,200,000 KRW in total) together with corrective orders.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Marketing and consent

Legal basis

Personal Information Protection Act (개인정보 보호법, frühere Fassung) Art. 23(1), Art. 29, Art. 35(3)

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

5 Nov 2024

Original amount 21,623,200,000 KRW, converted at the ECB reference rate of 4 Nov 2024.

Checked against the official source on 4 Oct 2026 · Direct link

According to the KFTC (Korea Fair Trade Commission, Korea's competition authority), from June 2016 to April 2018 the group made benefits for game developers, such as prominent placement (featuring) in its app store and support for overseas expansion, conditional on their not releasing their games on a rival Korean app market. The KFTC treated this as an abuse of a dominant position and as unfair exclusive dealing, prohibited the practice, required an internal monitoring system with a reporting obligation and provisionally set a fine of KRW 42.1 billion against the parent company and its Korean and Asia-Pacific subsidiaries.

Authority / court

Korea Fair Trade Commission (KFTC)

Area of law

Competition law · Abuse of market power

Legal basis

Art. 3-2 Abs. 1 Nr. 5 und Art. 23 Abs. 1 Nr. 5 MRFTA a. F. (Monopoly Regulation and Fair Trade Act)

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

11 Apr 2023

Original amount 42,100,000,000 KRW, converted at the ECB reference rate of 11 Apr 2023.

Checked against the official source on 8 Oct 2026 · Company name anonymised since 11 Apr 2025 · Direct link

The group recorded what signed-in users in Korea did on third-party websites and apps and used this behavioural data for personalised advertising without explaining this clearly at account creation; the relevant settings sat behind “More options” and were pre-set to consent. The authority imposed a penalty surcharge of 69,241,000,000 KRW and ordered the group to obtain informed and freely given consent in future. According to the authority’s press release of 23 January 2025, the Seoul Administrative Court dismissed the group’s action against the decision.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Cookies and tracking

Legal basis

Personal Information Protection Act (개인정보 보호법, Fassung 2020) Art. 39-3(1); Sanktion nach Art. 39-15

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Repeat case

no

Mitigating circumstances

Reduction of 50% because no penalty had been imposed in the preceding three years; at the same time an increase of 50% because the infringement lasted more than two years (since June 2016).

Published

14 Sep 2022

Original amount 69,241,000,000 KRW, converted at the ECB reference rate of 14 Sep 2022.

Checked against the official source on 8 Oct 2026 · Company name anonymised since 14 Sep 2024 · Direct link