The U.S. Federal Trade Commission and the Department of Justice have sued TikTok and its parent company ByteDance for allegedly violating the Children’s Online Privacy Protection Act (COPPA), which requires digital platforms to notify parents and obtain consent before collecting and using personal data from children under the age of 13.
In a press release issued Friday, the FTC’s Bureau of Consumer Protection said TikTok and ByteDance “allegedly knew” they needed to comply with COPPA, yet knowingly allowed millions of children under the age of 13 to sign up for their platforms for “years.” The FTC claims TikTok did so even after settling with the FTC in 2019 for violating COPPA. As part of that settlement, TikTok agreed to pay $5.7 million and take steps to prevent children under the age of 13 from signing up.
“As of 2020, TikTok had a policy of retaining accounts of children under the age of 13 unless the child explicitly acknowledged their age and met other strict criteria,” the FTC wrote in a press release. “TikTok human reviewers reportedly spent an average of five to seven seconds reviewing each account to determine whether the account belonged to a child.”
According to the FTC, TikTok and ByteDance retained and used underage user data, including data for ad targeting, even after employees raised concerns and TikTok changed its policy to no longer require explicit age verification. Even more egregiously, TikTok continued to allow users to sign up for third-party accounts, such as Google and Instagram, without verifying that they were at least 13 years old.
The FTC also took issue with TikTok’s more COPPA-compliant mobile experience, TikTok Kids Mode. The FTC claims Kids Mode collects “significantly more data” than necessary, including information about users’ in-app activity and identifiers that TikTok uses to build profiles (and share with third parties) in an effort to prevent churn.
When parents asked TikTok to delete their children's accounts, the FTC said TikTok made it difficult and often failed to comply with those requests.
“TikTok has knowingly and repeatedly violated children’s privacy, putting the safety of millions of children across the country at risk,” FTC Chairwoman Leana Khan said in a statement. “The FTC will continue to use the full scope of its authority to protect children online, especially as companies deploy increasingly sophisticated digital tools to monitor children and profit from their data.”
TikTok shared with TechCrunch in an email: “We disagree with these allegations, many of which are factually inaccurate or relate to past incidents and practices that have already been addressed. We take pride in our work to protect children, and we will continue to update and improve our platform. That includes providing an age-appropriate environment with rigorous safeguards, proactively removing users we suspect are minors, and voluntarily rolling out features like default screen time limits, family pairing, and additional privacy protections for minors.”
The FTC and DOJ are proposing civil penalties of up to $51,744 per violation per day against TikTok and ByteDance, as well as a permanent injunction to prevent future violations of COPPA.
