In 2021, an investigation was launched to evaluate TikTok’s compliance with Europe’s General Data Protection Regulation (GDPR) laws. The Irish data watchdog, which oversees the app across the EU, has found that TikTok has committed multiple GDPR violations.
The Irish Data Protection Commission found that TikTok violated GDPR by setting children’s accounts to public by default, allowing adults to enable direct messaging for over-16s, and not properly considering the risks to under-13s on the platform.
Children between the ages of 13 and 17 were led through the sign-up process in a way that resulted in their accounts being set to public by default, reveal the findings. This means that anyone can view the content of the account or comment on it.
Additionally, the “family pairing” feature, which allows an adult to manage a child’s account settings, did not verify if the adult was actually the parent or guardian of the child user. TikTok’s “Family Pairing” links children’s accounts to an adult’s account to manage app settings. The DPC found that unverified adult profiles could be linked, allowing for direct messages to be sent.
The DPC has raised concerns about both of these issues.
TikTok’s efforts to keep children under 13 off the platform are in question. Although age verification methods were GDPR compliant, the privacy of underage users was inadequately protected.
The DPC criticised their previous default public-setting process which allowed anyone to view underage users’ content. Features such as Duet and Stitch were automatically enabled for users under 17. TikTok has three months to comply with new regulations. No violation of GDPR was found in the methods used to verify user ages.
Previous fines on TikTok
TikTok was fined GBP 12.7 million in April by the UK data regulator for illegally processing the data of 1.4 million children under 13 who used its platform without parental consent.
“We respectfully disagree with the decision, particularly the level of the fine imposed. The DPC’s criticisms are focused on features and settings that were in place three years ago, and that we made changes to well before the investigation even began, such as setting all under-16 accounts to private by default,” said TikTok
Since 2021, all existing and new TikTok accounts for 13- to 15-year-olds have been set to private by default, meaning only people approved by the user can view their content. These changes were made to address the problems raised by the inquiry.
