Security and privacy
TikTok under EU scrutiny. The platform will pay a 345 million euro fine for violating GDPR.
The Irish Data Protection Commission (DPC), under the European Union's General Data Protection Regulation (GDPR), has imposed a fine of 345 million euros on TikTok for violating children's privacy. This is the largest fine that TikTok has received from regulatory authorities so far.
Why was TikTok penalized?
DCP is an independent investigative body that monitors whether Big Tech companies based in Ireland comply with EU GDPR regulations. The investigation, which lasted from September 2021, covered allegations from 2020 regarding the way the app handled children's data between July 31 and December 31, 2020 - especially in terms of age verification and privacy settings.
The investigation showed that in the process of registering underage users, the system by default set their accounts between the ages of 13 and 17 as public, giving everyone access to content and commenting, and facilitating communication with minors. In addition, it was found that the company did not provide sufficient privacy protection for children under the age of 13, who could freely create an account without supervision during this time.
The important Family Pairing feature, designed for parents to manage settings and supervise the content of minors' publications, also failed. Here again, anyone could pose as a child's parent without any verification.
Who is the victim?
TikTok patched the errors back in 2020, and in January 2021, all accounts of users under the age of 16 were set by default as private. Despite this, it was severely punished. Therefore, the Chinese conglomerate ByteDance, the owner of the platform, disagrees with the results of the investigation and the imposed penalty.
- Most of the critical comments contained in the decision are no longer relevant due to the measures we introduced at the beginning of 2021 - a few months before the investigation began - wrote the head of TikTok's privacy in Europe in a blog post.
In addition to the financial penalty, TikTok has 3 months to adapt the current and future profiles of underage users to EU GDPR regulations.