Today, Ireland’s Data Protection Commission (DPC) announced a fine of €345 million (around $367 million) on TikTok for the way the company processes children’s data. The fine arises after an investigation by the DPC announced in 2021 which analyzed TikTok’s compliance with Europe’s General Data Protection Regulation (GDPR) laws. political reported in August that the DPC was preparing to issue its sanction.
The investigation focused on some features of TikTok: default account settings; “Family Pairing” settings; and age verification. After consulting with the European Data Protection Board, the DPC found that TikTok set children’s accounts to public by default when they registered on the platform. That meant that kids’ videos were publicly viewable by default and that comments, duets, and Stitch features were also enabled by default.
Family pairing, a feature inserted of TikTok in 2020, allows you to link children’s accounts with a separate adult account, in theory to manage the app’s settings, such as limiting screen time and restricting direct messages and content that may not be appropriate. The DPC found that children’s TikTok accounts could be linked to profiles that the company had not verified belonged to a parent or guardian. Once linked, the adult user could make the child’s profile settings more flexible to allow direct messages.
One sticking point is whether TikTok did enough to keep children under 13 off the platform through age verification. Although the decision found that TikTok’s age verification methods did not violate GDPR laws, it determined that the company had not sufficiently protected the privacy of children under 13 years old who were able to register for an account.
In 2021, TikTok tightened privacy settings on the accounts of users ages 13 to 15, making them more private by default. TikTok will have three months to comply with its practices.
The DPC has fined other social media platforms for similar violations involving young users. Meta was fined more than $400 million in 2022 because it allowed teenage Instagram users to register for business profiles, making their contact information public, among other things.
