Meta Agrees to Disclose Subscriber Data in South African Child Protection Case

Meta, the parent company of WhatsApp, Facebook, and Instagram, has agreed to disclose subscriber information linked to accounts distributing explicit content involving South African schoolchildren. This decision follows a contentious legal battle that saw Meta initially facing contempt of court charges for non-compliance with a judicial order. The issue came to light when the Digital Law Company, a South African legal firm, pursued action against unidentified individuals using WhatsApp and Instagram to share illicit material and private details of schoolchildren. According to court documents, new accounts were being created “every few minutes” to solicit and distribute explicit content, creating an urgent need to identify the perpetrators.

Advocate Nikki Sadleir, representing the Digital Law Company, emphasised the urgency of the situation. “This is about protecting vulnerable children,” she said in a statement. “Full compliance with the court order is critical to identifying the perpetrators.” The Pretoria High Court issued an order directing Meta to provide subscriber data to aid in identifying the culprits. Initially, Meta and its local representative, Thabiso Makenete, failed to comply, prompting the Digital Law Company to file a contempt of court application. Sadleir argued that Meta’s lack of response suggested it had the capability to comply but chose not to, leaving authorities and victims in limbo.

Despite Meta’s initial refusal to act, the company has now agreed to hand over the requested data, a move that could set a precedent for how tech companies operate in South Africa. South Africa’s Protection of Personal Information Act (POPIA), enacted to safeguard user data, has been a focal point in disputes with tech giants. In September 2024, the country’s Information Regulator issued an enforcement notice against WhatsApp for non-compliance with POPIA. The regulator criticised WhatsApp’s privacy policy for lacking the specificity required under South African law and for sharing user data with Meta and third parties without clear consent. This case adds another layer, as it tests Meta’s willingness to balance privacy obligations with public safety demands.

The decision comes at a time when South Africa is grappling with rising cybercrime, including WhatsApp scams and the spread of illegal content. Meta’s initial hesitation to comply drew scrutiny. The company argued that the Digital Law Company had cited incorrect entities in its legal action, delaying the process. However, Sadleir countered that Meta failed to deny its capability to provide the data, suggesting it had the means but lacked the will. The eventual agreement to share subscriber information signals a shift, possibly driven by public pressure and the threat of legal consequences.

This is not Meta’s first clash with South African regulators. In 2021, the Information Regulator challenged WhatsApp’s data-sharing practices with Facebook, demanding alignment with POPIA. The ongoing general election probe involving Meta, Google, and X further highlights tensions, as these companies have resisted information requests under the Promotion of Access to Information Act (PAIA). Child protection advocates have hailed the decision as a victory. “This sends a strong message that tech companies cannot hide behind privacy policies when children’s safety is at stake,” said Thandi Mokoena, a spokesperson for a Johannesburg-based child welfare organisation.

However, digital rights groups express caution. “While protecting children is paramount, we must ensure that data disclosures do not set a precedent for unchecked surveillance,” warned a representative from the South African Digital Rights Forum. Legal experts also weigh in. Karl Blom, a senior associate at Webber Wentzel, noted that this case could redefine how tech companies navigate South Africa’s legal framework. “It’s a balancing act between user privacy and public interest,” Blom said. “Meta’s compliance shows that local courts can exert pressure, but it also raises questions about how far this precedent will extend.”

This ruling could have ripple effects beyond South Africa. As countries across Africa strengthen data protection laws, tech companies face increasing scrutiny. Nigeria and Kenya, for instance, have seen similar debates over data privacy and platform accountability. The case may push Meta and others to revise their global policies, particularly in regions with stringent regulations like POPIA or Europe’s GDPR. For South African users, the decision is a double-edged sword. While it addresses immediate concerns about illegal content, it raises questions about data privacy. WhatsApp’s end-to-end encryption, often touted as a security feature, does not prevent Meta from accessing subscriber metadata, which can reveal user identities. This could erode trust among users wary of corporate or governmental overreach.

Meta’s agreement to comply is a step toward accountability, but the case is far from over. The Digital Law Company awaits the data to pursue the perpetrators, and the courts will monitor Meta’s follow-through. Meanwhile, South Africa’s Information Regulator continues to push for broader compliance with POPIA, signalling that tech giants will face continuous scrutiny.