Ireland’s data regulator has fined Instagram 405 million euro for violating the EU’s General Data Protection Regulation and failing to safeguard children’s information.

The fine from the Data Protection Commission followed a two-year investigation into the Meta-owned social media platform. The investigation covered complaints that Instagram defaulted the accounts of all users, including those under the age of 18, to public settings. It also related to how the contact information of children using business accounts on the platform was publicly available.

Instagram, which allows users over the age of 13, said the fine related to old settings that were updated more than a year ago. It said it had released features to keep teenagers’ information private, including automatically setting children’s accounts to private when they sign up since July last year.