TikTok under EU scrutiny. The platform will pay a 345 million euro fine for violating GDPR.

The Irish Data Protection Commission (DPC), under the European Union's General Data Protection Regulation (GDPR), has imposed a fine of 345 million euros on TikTok for violating children's privacy. This is the largest fine that TikTok has received from regulatory authorities so far.

TikTok under EU scrutiny. The platform will pay a 345 million euro fine for violating GDPR.
00:00 00:00

Summary

  • The Data Protection Commission (DPC), an independent investigative body, conducted an investigation into TikTok's handling of children's data between July and December 2020.
  • The investigation revealed that TikTok's registration process for underage users defaulted their accounts to public, allowing unrestricted access to content and communication with minors.
  • TikTok was also found to have insufficient privacy protection for children under 13, who could create accounts without supervision.
  • The 'Family Pairing' feature, intended for parental supervision of minors' content, was flawed as anyone could pose as a parent without verification.
  • TikTok, owned by Chinese conglomerate ByteDance, corrected these issues in 2020 and made all accounts of users under 16 private by default in January 2021.
  • Despite these corrections, TikTok was penalized and disagrees with the investigation's findings and the imposed penalty.
  • TikTok has been given 3 months to align the profiles of underage users with EU GDPR regulations, in addition to the financial penalty.

Why was TikTok penalized?

DCP is an independent investigative body that monitors whether Big Tech companies based in Ireland comply with EU GDPR regulations. The investigation, which lasted from September 2021, covered allegations from 2020 regarding the way the app handled children's data between July 31 and December 31, 2020 - especially in terms of age verification and privacy settings.

The investigation showed that in the process of registering underage users, the system by default set their accounts between the ages of 13 and 17 as public, giving everyone access to content and commenting, and facilitating communication with minors. In addition, it was found that the company did not provide sufficient privacy protection for children under the age of 13, who could freely create an account without supervision during this time.

The important Family Pairing feature, designed for parents to manage settings and supervise the content of minors' publications, also failed. Here again, anyone could pose as a child's parent without any verification.

Who is the victim?

TikTok patched the errors back in 2020, and in January 2021, all accounts of users under the age of 16 were set by default as private. Despite this, it was severely punished. Therefore, the Chinese conglomerate ByteDance, the owner of the platform, disagrees with the results of the investigation and the imposed penalty.

- Most of the critical comments contained in the decision are no longer relevant due to the measures we introduced at the beginning of 2021 - a few months before the investigation began - wrote the head of TikTok's privacy in Europe in a blog post.

In addition to the financial penalty, TikTok has 3 months to adapt the current and future profiles of underage users to EU GDPR regulations.