A Personal Account Is Not a Lesser Case

Most published commentary on platform enforcement, including our own earlier case notes concerning a creator account and a Meta advertising account, is framed around commercial loss.

That framing is appropriate for those cases. It may, however, obscure the position of the much larger group of users whose Instagram or Facebook accounts generate no revenue at all.

A personal account that has existed for a decade may contain years of private correspondence, photographs that exist nowhere else and the practical means by which a person remains in contact with family and friends abroad.

Its permanent loss is not a lesser injury merely because no invoice can be produced.

Neither the Digital Services Act nor the General Data Protection Regulation makes its protections dependent upon commercial use. In one important respect, considered below, a private user may in fact occupy a stronger legal position than a business.

We recently acted in a matter of exactly this kind.

A Cyprus resident’s Instagram account was disabled, and his linked Facebook account was disabled with it. The stated ground was Meta’s Community Standards concerning child sexual exploitation, abuse and nudity.

Nothing on the account bore any relation to that description.

The accounts were reinstated following formal service of a pre-action letter on Meta Platforms Ireland Limited.

When the Reason Given Is Worse Than the Conduct Alleged

A Composite Policy Label Is Not a Specific Reason

Several of Meta’s Community Standards are composite instruments.

The Standard invoked in this matter covers, under a single heading, both questions concerning what images may be published and the sexual approach of children by an adult.

Those are not equivalent allegations.

The first concerns content moderation. The second amounts to an accusation of conduct of an entirely different and potentially criminal nature.

The notice served on our client named the Standard and nothing further.

It identified no post, photograph, message or date.

The explanatory panel displayed alongside it, however, referred to the second limb, stating that the platform does not allow users to interact or attempt to interact with children in a sexual manner and illustrating that prohibition through examples of predatory conduct.

The consequence was that the user was told, in writing, that he had been found to have committed conduct of the gravest kind while being given no information whatsoever about what he was alleged to have done.

He could not answer an allegation he could not identify.

That is precisely the type of situation addressed by Article 17 of the Digital Services Act.

Article 17(3) requires the statement of reasons provided to the recipient to include information concerning the facts and circumstances relied upon, whether automated means were used, and the legal or contractual ground relied upon together with an explanation of why the relevant information was considered incompatible with it.

Merely reciting the title of a Community Standard does not necessarily provide that explanation.

A Report Filed Under One Category, an Outcome Imposed Under Another

The review in this matter began with a report submitted by a person known to our client concerning a message exchanged in a private conversation between two adults.

The reporting user's own account recorded that the report had been submitted under the harassment and bullying category.

She subsequently confirmed in writing that the report was false, had been submitted as a joke and that she had attempted, unsuccessfully, to withdraw it.

Harassment and child-safety violations sit within separate policy categories and involve fundamentally different allegations.

Where the platform's own record demonstrates that a report was submitted under one category but enforcement was ultimately imposed under another, an obvious question arises: how did the first lead to the second?

In our experience, asking the platform to explain that precise sequence can be significantly more effective than simply asserting that its final decision was wrong.

Anyone whose Instagram or Facebook account has been disabled following a report by another user should therefore consider obtaining, as early as possible, a screenshot from the reporting user's own account showing the category under which the report was submitted.

That record is generated by the platform itself, exists independently of the disabled user's account and can become important evidence in challenging the subsequent decision.

“You Cannot Request Another Review of This Decision”

Our client appealed through Meta's in-app review process.

The interface provided no field in which he could explain what had happened and no mechanism for uploading the reporting user's written retraction.

Approximately one hour later, he received notice that the account had been permanently disabled.

The notice also stated that he could not request another review of the decision.

Article 20(1) of the Digital Services Act requires providers of online platforms to provide recipients of the service with access to an effective internal complaint-handling system for at least six months following certain moderation decisions, including decisions to suspend or terminate the provision of the service.

A message stating that no further review is available immediately after the decision therefore raises an obvious issue as to the effectiveness and availability of that complaint mechanism.

Article 20(6) further provides that decisions under the internal complaint-handling system must be taken under the supervision of appropriately qualified staff and not solely on the basis of automated means.

A permanent disablement issued approximately one hour after an appeal lodged through an interface that permitted no factual explanation gives rise to legitimate questions as to how that requirement was satisfied.

The practical point for an affected user is important:

a message saying that Meta will not review the decision again is a statement about Meta's internal procedure. It is not a statement of the user's legal position.

The exhaustion of an internal platform appeal does not extinguish remedies that may exist under European Union or national law.

The Threat of Permanent Deletion and How to Stop It

This is one of the most important practical issues in any permanent Instagram or Facebook disablement.

Notices of permanent disablement may state that the user's information will eventually be permanently deleted, without identifying a specific date.

A user who spends weeks repeatedly contacting support may therefore discover that material relevant to proving the case has disappeared while the dispute remains unresolved.

Article 18(1)(a) of the General Data Protection Regulation gives a data subject who contests the accuracy of personal data the right, in the circumstances specified by that provision, to obtain restriction of processing for a period enabling the controller to verify the accuracy of the data.

Erasure constitutes processing for GDPR purposes.

Where a user formally contests the accuracy of a classification recorded against him or her, Article 18 may therefore become an important mechanism for seeking preservation of the relevant personal data while that dispute is examined.

Article 18(3) also provides that a data subject who has obtained restriction must be informed before that restriction is lifted.

For that reason, a written notification asserting the right to restriction of processing should be considered at an early stage and sent in a manner that provides reliable evidence of receipt.

In an account-reinstatement dispute, preservation of the underlying data can be as important as the challenge to the disablement itself.

Proportionality Where There Is No Prior Enforcement History

Article 14(4) of the Digital Services Act requires providers to act in a diligent, objective and proportionate manner when applying and enforcing restrictions under their terms and conditions, with due regard to the rights and legitimate interests of all parties and to the fundamental rights protected by the Charter.

Permanent disablement is among the most serious measures an online platform can impose on a user.

Where that sanction is imposed:

• without any prior warning;

• without a previous strike or enforcement history;

• without identification of the allegedly offending content;

• following an appeal that offered no meaningful opportunity to explain the circumstances; and

• together with the disablement of a linked account against which no separate allegation has been identified,

the proportionality of the measure may properly be questioned.

The automatic loss of a linked Facebook or Instagram account can be particularly important where no independent reason has been provided for enforcement against that second account.

Automated Decisions Taken About a Private Individual

Article 22(1) of the GDPR provides, subject to the exceptions contained in the Regulation, for a right not to be subject to a decision based solely on automated processing which produces legal effects concerning the data subject or similarly significantly affects him or her.

In Case C-634/21, SCHUFA Holding, judgment of 7 December 2023, the Court of Justice considered the circumstances in which an automated determination capable of determining a subsequent outcome may itself constitute a decision for these purposes.

The significance of an automated decision is not confined to financial or commercial consequences.

Permanent loss of years of private correspondence, photographs and personal contacts, combined with the recording against an individual of an exceptionally serious policy classification, may plainly have consequences extending far beyond the loss of access to a social-media profile.

The extent to which automated systems contributed to a particular Meta enforcement decision is therefore a matter that may require examination.

Where a Personal User May Bring Proceedings

Here, the private individual may be better placed than a business user.

Under Articles 17 to 19 of Regulation (EU) 1215/2012, a consumer may, subject to the requirements of those provisions, bring proceedings against the other party to the consumer contract in the courts of the Member State in which the consumer is domiciled.

The protective jurisdiction afforded to consumers cannot simply be excluded in advance by a contractual jurisdiction clause.

Accordingly, a Cyprus resident using Instagram or Facebook for personal, non-commercial purposes may be able to bring proceedings in Cyprus.

A company using the same platform commercially does not benefit from the same consumer-jurisdiction regime.

That distinction can materially affect the practical dynamics of correspondence and potential proceedings against a platform operator.

False Reports Submitted by Other Users

Article 23(2) of the Digital Services Act requires online platforms, after issuing a prior warning, to suspend for a reasonable period the processing of notices and complaints submitted through the relevant mechanisms by persons or entities that frequently submit notices or complaints that are manifestly unfounded.

Where another user has admitted that a report was false, it may therefore be appropriate to ask the platform what action, if any, was taken in response to that information.

There is, however, an important evidential point.

A person who confirms in writing that he or she deliberately submitted a false report may potentially expose themselves to consequences of their own.

Anyone asked to provide such evidence should understand that before signing a statement or other document.

Nevertheless, where available, evidence from the reporting user can be among the strongest material in an account-disablement case—particularly where it demonstrates that the original report concerned a completely different policy category from the eventual enforcement decision.

What to Do If Your Instagram or Facebook Account Has Been Disabled

Preserve Everything Immediately

Take dated screenshots of:

• the disablement notice;

• every explanatory screen behind it;

• the appeal interface;

• every Meta support communication;

• emails received from Meta; and

• any remaining account information accessible to you.

Where access remains available, use the platform's data-download facility.

Obtain the Reporting User's Record

If you know who reported the account, consider asking that person for a screenshot showing the category under which the report was submitted.

Preserve any messages in which that person admits the report was false or attempts to retract it.

Consider Restriction of Processing

If the accuracy of the information or classification underlying the enforcement decision is disputed, consider asserting the right to restriction of processing under Article 18 GDPR in writing.

This should be done promptly and in a manner capable of proving receipt.

Use the Internal Appeal

There is value in being able to demonstrate that Meta's internal remedy was attempted.

If the platform has issued a final decision stating that no further review is available, repeatedly submitting identical requests through the same route is unlikely to address the underlying legal issue.

Do Not Automatically Create Replacement Accounts

Creating another account while a platform enforcement decision remains in force may potentially be treated as circumvention of that decision.

That can complicate the original dispute and may place connected accounts at further risk.

Consider Out-of-Court Dispute Settlement

Article 21 of the Digital Services Act provides access to certified out-of-court dispute settlement bodies for disputes relating to certain platform decisions.

Those procedures are generally intended to provide a comparatively accessible alternative to court proceedings.

Their decisions are not equivalent to judgments of a court, and using the procedure does not necessarily prevent subsequent litigation.

The documentary record generated through the process can nevertheless be useful.

Take Advice When the Internal Process Has Failed

The point at which legal advice becomes particularly relevant is usually when:

• Meta states that no further review is available;

• the account is said to be permanently disabled;

• important data is threatened with deletion;

• a linked Instagram or Facebook account has also been disabled;

• the reason given does not correspond with the material actually posted; or

• weeks have passed without a substantive response.

Frequently Asked Questions

My Instagram account was personal and made no money. Do I still have legal rights?

Yes.

The protections provided by the Digital Services Act and GDPR are not restricted to commercial accounts.

The legal issues may concern procedural fairness, the reasons given for the platform's decision, the use of automated systems, proportionality and the processing of the user's personal data rather than simply financial loss.

Meta says I cannot request another review. Is that the end of the matter?

No.

A statement that no further internal review is available describes Meta's own appeal process.

It does not determine whether remedies remain available under the Digital Services Act, GDPR, contract law or other applicable law.

Article 20 of the Digital Services Act separately regulates internal complaint-handling systems operated by online platforms.

Meta says my information will be permanently deleted. Can I stop it?

Potentially.

Where the accuracy of personal data underlying the decision is disputed, Article 18(1)(a) GDPR may provide a right to restriction of processing while its accuracy is verified.

Any such request should be made promptly, in writing and in a manner capable of proving receipt.

A friend reported my Instagram account as a joke. Does that help?

It can be extremely important evidence.

This is particularly so where the platform's own record shows that the report was submitted under one policy category while the eventual account disablement was imposed under an entirely different category.

Preserve the reporting user's screenshot and any written admission or attempted retraction.

Can I sue Meta in Cyprus?

Potentially, yes.

A consumer domiciled in Cyprus whose use of the platform is personal and non-commercial may be able to rely on the consumer-jurisdiction provisions contained in Articles 17 to 19 of Regulation (EU) 1215/2012.

The position is different for business and commercial accounts and requires consideration of the particular circumstances.

How long does Instagram or Facebook account reinstatement take?

There is no standard period.

In the matter discussed in this article, reinstatement followed within weeks of formal service of a pre-action letter on Meta Platforms Ireland Limited.

That followed an internal appeal process in which permanent disablement had been confirmed within approximately one hour and the user had expressly been told that no further review was available.

Closing Observation

Platform-enforcement systems operate at extraordinary scale, and automation inevitably forms part of that process.

But scale does not remove the legal obligations governing the decision.

In this matter, the internal appeal interface did not allow our client to explain the circumstances that had led to the report, provide the reporting user's retraction or challenge the extraordinary policy classification that had been applied to his account.

The solution was therefore not simply another attempt at the same appeal.

It was correspondence formally served on the correct legal entity which identified the specific deficiencies in the decision-making process and the legal obligations engaged by them.

The imbalance between an individual user and a multinational technology platform is obvious.

Increasingly, however, disputes of this kind turn not simply on the platform's conclusion, but on how that conclusion was reached, what information was provided to the user, what evidence was considered and whether the procedure complied with the legal framework governing online platforms in the European Union.

The matter was handled by our Director, Alexandros A. Papantoniou, advising on disputes at the intersection of technology, reputation and platform governance.

Personal and Business Account Restrictions

Papantoniou & Papantoniou LLC advises individuals and businesses on Technology Law matters involving online platforms and digital services and on related disputes.

Our previous case notes also examine:

• the recovery of a disabled Instagram creator account; and

• the reinstatement of a company's restricted Meta advertising account.

If your personal or business Instagram or Facebook account has been disabled, suspended or restricted, our team can review the decision, the evidence available to you and the remedies that may apply.

Papantoniou & Papantoniou LLC
8 Katsoni Street
Ayioi Omologites
1082 Nicosia, Cyprus

T: +357 22 817711
E: info@paplaw.com.cy

This article is provided for general information purposes only. It does not constitute legal advice and does not create an advocate-client relationship. The circumstances of every platform restriction are different and specific legal advice should be obtained where appropriate. The matter referred to in this article is described in anonymised form.