TikTok set to pay $379million EU fees for infringements on children's privacy

In a significant ruling, the Irish Data Protection Commission (DPC) ordered TikTok, a well-known video-sharing platform, to pay a fine of €345 million, or roughly $379 million, for violating the General Data Protection Regulation (GDPR) of the European Union in relation to the handling of children’s data. The decision also mandates that TikTok change its data processing procedures to conform to GDPR requirements within the following three months.

According to the DPC’s investigation, TikTok had violated eight articles of the GDPR, including those pertaining to data minimization, data security, controller responsibility, data protection by design and default, and the rights of data subjects, including minors, to receive clear information about data processing and disclosures of their personal data. Additional violations related to controller responsibility and data protection by design and default were also found.

The inspection did not turn up any violations of TikTok’s methodology for determining users’ ages, which had previously been a point of contention with several regional regulators. However, the DPC’s ruling reveals a violation of Article 24(1) of the GDPR as a result of TikTok’s failure to put in place sufficient organizational and technical safeguards to address particular risks posed by users under the age of 13 who used the platform. Notably, these underage users’ content could be viewed by everyone on TikTok and outside of it according to the default account settings.

The settings on TikTok at the time allowed young users to proceed through the registration procedure in a way that instantly made their accounts public. As a result, content like movies, comments, and tools like “Duet” and “Stitch” were by default available to the general public. Additionally, TikTok’s “Family Pairing” function allowed child accounts to be “paired” with unverified non-child users without verifying if the user was in fact the child’s parent or legal guardian.

According to the DPC’s findings, this feature also made it possible for non-child users to enable direct messaging for child users who were 16 years old or older. This lessened the child user’s level of protection.

This sizeable fine and judgment serve as a stark reminder to social media platforms and tech businesses of their duties to safeguard the privacy and security of all users’ data in accordance with GDPR requirements.

TikTok responds.

A TikTok representative responded to the news by telling TechCrunch that the firm is considering its next moves, which may include submitting a legal appeal in Ireland.

On the business website, Elaine Fox, Head of Privacy for TikTok in Europe, offered a more thorough statement. She emphasized TikTok’s proactive efforts, which included switching user profiles aged 13 to 15 to private by default, to address safety concerns before the DPC’s inquiry got underway.

She also emphasized that TikTok became the first big platform to publicly report the amount of suspected underage accounts it eliminated in 2021, and it still is the only one to do so. She said that TikTok deleted approximately 17 million such accounts globally in the first quarter of 2023.

“We publish this in our quarterly Community Guideline Enforcement Reports, and during the first three months of 2023, we removed nearly 17 million such accounts globally,” she said in a statement.

Elaine Fox noted that maintaining age verification is a challenge for the entire industry and reaffirmed TikTok’s commitment to working with authorities and experts to find creative solutions that will strengthen their efforts to stop minors from using the platform.

The statement claims that the video-sharing website has over 134 million active monthly users across the European Union.

The Irish Data Protection Commission and TikTok

The processing of children’s data by TikTok was the subject of an investigation by the Irish Data Protection Commission (DPC) for a five-month period, from July 31, 2020, to December 31, 2020. The commission looked into how TikTok was handling default settings and the “Family Pairing” function in relation to processing kid users’ personal data in accordance with GDPR requirements. The manner in which default setting information was conveyed to child users was examined under the transparency obligations.

Initial DPC investigations suggested fewer GDPR violations than the final ruling affirmed. The European Data Protection Board (EDPB), however, was forced to make a binding judgment after receiving complaints from two other authorities (the Berlin authority and Italy’s DPA), which authorized a violation of the GDPR’s fairness principle. On September 1, 2023, the DPC’s final judgment was adopted, giving TikTok until the beginning of December to comply with GDPR regulations or face additional penalties.

The platform asserts that the majority of the problems that led to the sanctions have already been resolved, but it strongly disagrees with the fine amount.

Notably, TikTok was previously fined $15.7 million by the UK’s Information Commissioner’s Office (ICO) for improperly processing children’s data. Additionally, a hefty GDPR fine of €405 million was levied against Meta-owned Instagram in the EU the year before for mishandling underage users’ data.

European privacy regulators continue to impose severe fines for violations of child protection laws, but they are still far less severe than the biggest GDPR punishment as record, a €1.2 billion fine against Meta for unauthorized data transfers.

The EU is looking into TikTok’s data exports, and by the end of the year, a draught judgment is anticipated to be submitted for review by other regional data protection authorities. If there are any issues with Ireland’s preliminary conclusions, a final decision might be made in 2024.

Larger fines and more extensive findings of breaches have resulted from the European Data Protection Board’s (EDPB) increased involvement in rendering legally binding judgments on GDPR investigations headed by Ireland.

Investigations into TikTok data handling put the Irish regulator under close scrutiny.

Concerns expressed by other EU data protection agencies and consumer protection organizations prompted the Irish Data Protection Commission (DPC) to launch investigations into the data transfers and management of children’s data by the video-sharing platform two years ago. Due to concerns about child safety, Italy’s data protection authority has previously taken immediate action against TikTok, which resulted in a considerable user age verification process.

Concerns about privacy and child safety were also expressed by EU consumer protection agencies. The European Parliament criticized Commissioner Helen Dixon as a result of the Irish regulator’s perceived poor response time. The delay made it unclear if the agency would be able to make large digital platforms adhere to GDPR requirements.

Commissioner Dixon defended the DPC’s “busy GDPR enforcement” initiatives, particularly in relation to TikTok, and cited the huge volume of information under examination as a factor in the timing of the investigations.

Author

Samson Ayodeji

I am literally obsessed with technology. I love writing about the latest news in technology in different markets, segments and sectors across the world.

View all posts

Author

TikTok set to pay $379million EU fees for infringements on children’s privacy

Eight articles of the GDPR had been violated by TikTok, including those that dealt with the fairness, lawfulness, and transparency of data processing,

Author

TeaTalk Podcast just launched on TikTok, offering a peek into the lives of Nigerian celebrities