Popular children’s app TikTok has been issued the largest ever fine in the USA for the illegal collection of children’s personal data.
The US Federal Trade Commission confirmed TikTok will pay $5.7m (£4.3m) to settle allegations that it illegitimately amassed the personal information of children under the age of thirteen including their location and email addresses.
In response the company has committed to implementing new measures to prevent the such collections again.
The app, formerly known as Musical.ly, allows users to create “Real Short Videos”, set them to music and share these videos with their followers.
The FTC alleged that it “uncovered disturbing practices, including collecting and exposing the location” of children under thirteen and that despite receiving thousands of complaints from parents demanding the deletion of their children’s data, the company either failed to delete the data or kept it for longer than necessary.
It also claimed that TikTok hosted content that was published by users who were known to be underage. Joe Simons, the chairman of the FTC, said: “the operators of Musical.ly – now known as TikTok – knew many children were using the app but they still failed to seek parental consent before collecting names, email addresses and other personal information from users under the age of 13”.
Following the allegations, Bytedance, a Chinese data company which owns TikTok, has admitted to collecting data improperly and has agreed to delete the data complained of.
The company also explained the changes it would be making as a result of the case. Users will now have to verify their age prior to using the app, whereas previously users were trusted to provide their own age.
Those users who are under 13 will be kept in “age appropriate TikTok environments” and will not have access to other content that it not considered age-appropriate. TikTok also said in their statement that they have “been committed to creating measures to further protect our user community – including tools for parents to protect their teens and for users to enable additional privacy settings”.
Limitations to Reform
TikTok will only be implementing these changes in the US, whilst users in the UK and other countries will not be required to verify their age.
Since TikTok has more than 200 million members across the world, the changes could have little effect on the significant percentage of those users that were under 13. Whilst US users and their parents will benefit from the enhanced protective measures, children in other countries could still have their data collected by TikTok in the same way as before.
On the surface, collecting data without consent would breach Article 8 of the General Data Protection Regulation which requires consent from children at least 16 years old.
Where the data of children below the age of 16 is collected “processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child”.
The decision by the US court could also have an impact on other social networking sites.
Most websites require users to enter their age when creating an account, but they simply trust users to be honest rather than requiring any verification. This allows children to lie about their age to gain access to the site. The TikTok decision may encourage companies to evaluate this, and perhaps implement similar changes.