TikTok and children's data confidentiality
More than once, the world's largest social media platform TikTok has drawn the attention of regulators to its activities related to the processing of personal data. In particular, TikTok was fined by Dutch Data Protection Authority (2021) for 750,000 euros, Irish Data Protection Commission (2023) for 345 million euros and Information Commissioner's Office (2023) for £12.7 million for children's data misuse.
The latest TikTok case involves alleged violations of the Children's Online Privacy Protection Act (COPPA) and the Children's Online Privacy Protection Rule (COPPA Rule).
The US Department of Justice filed a lawsuit on August 2 against the interconnected companies that operate the online social media platform TikTok, against the illegal processing of children's personal data.
The charges brought by the US Department of Justice against TikTok are as follows:
- the platform allows children under 13 years of age to create and use accounts without notifying and obtaining verified parental consent for the processing of children’s personal data such as email addresses, phone numbers, location data, device identifiers. The specific age at which a user is considered a child may vary depending on applicable law. In the US this age is 13 years old, in the EU it is 16 years old.
- Parents’ demands to delete their children’s accounts and personal data are not implemented. In the lawsuit the US Department of Justice noted that TikTok offers the use of “Kids Mode” for users under 13 years old, but despite this company allows children under 13 to create accounts as normal without additional processing requirements.
Let us remind you that before processing children’s personal data in accordance with COPPA, COPPA Rule, the company must comply, in particular, with the following basic rules:
- Privacy Policy. Develop and post a Privacy Policy on a website or other online service with clear, understandable information about what data about children is collected and how it is used;
- Informing parents. Provide comprehensive information about the processing of children’s personal data to parents;
- Parental consent. Obtain verified consent to process children’s personal data from parents before the start of direct processing;
- Access to children's data. At the request of parents, provide access to the children’s personal data processed by the company;
- Deleting children's data. At the request of parents, ensure the right to delete children’s personal data.
You can study a more detailed information about the requirements and procedure for the processing of children’s personal data from REVERA lawyers following the link.
Follow the development of the TikTok case with us and comply with the requirements for the processing of children's personal data! :)
