Korea's Consumer Dispute Settlement Commission, part of the Korea Consumer Agency, ruled that Coupang must compensate affected users ₩100,000 in cash or Coupang Cash for emotional distress caused by a personal data breach — the first time damages liability has been recognized for such a breach in Korea.
A former employee exposed personal data covering 34 million people, including names, email addresses, physical addresses, building entrance codes and order histories. Investigators later confirmed that a hacker exfiltrated data between April and November and misused some of it, which weighed on the severity finding.
Fifty consumers filed for collective dispute settlement on Dec. 8 last year. The commission opened proceedings on April 6 and held sessions on July 10 and 22. The Personal Information Protection Commission had already imposed an administrative fine on Coupang.
Coupang must notify whether it accepts the decision within 15 days of receipt. Settlement decisions are not enforceable without the parties' consent, so what follows — acceptance or litigation — will determine the practical impact more than the ruling itself.
First, a floor now exists for breach costs. Regulatory fines used to be effectively the only line item; per-user damages are now a precedent. The larger the user base, the more directly exposure scale converts into cost.
Second, note the overlap with marketing data. Order history and address are exactly what personalization and delivery optimization run on. The more useful the data, the stronger the incentive to accumulate it — and the worse a breach becomes. That is a concrete reason to revisit retention periods and data minimization.
Third, the vector was an insider. Controls built around external intrusion are not sufficient without access governance and log auditing.
For the broader regulatory trend around platforms, see Korea Bill Would Make Pre-Approval Mandatory for Lending Ads.
The commission ruled Coupang should pay ₩100,000 in cash or Coupang Cash per affected consumer — the first recognition of damages liability for a personal data breach in Korea.
Names, emails, addresses, building entrance codes and order histories, covering about 34 million people.
No. Coupang must respond within 15 days of receiving the decision, and settlement carries no force without the parties' agreement.
To apply what you just read to your own site, start with a free audit of where things are now.
A strategist replies within 24 hours on business days.
Reddit Ads Manager is adding a campaign planner that forecasts reach and cost, a 0–100% optimization score and automatic budget shifting. Advertisers scoring 80%+ saw 19.6% lower blended CPA.
Netflix lowered its 2026 ad revenue forecast from $3B to about $2.7B even as ads grow 80%+. Here’s why it missed, plus what the new Netflix Pixel and The Trade Desk audiences mean for advertisers.
Meta’s new Terms of Service, effective Oct. 30, appeared to let it crawl businesses’ domains. After backlash, Meta clarified the scope. Here’s what changed and what advertisers should check.