FTC and DOJ sue TikTok for alleged violations of children’s privacy

US Federal Trade Commission and Department of Justice are suing TikTok and ByteDanceTikTok’s parent company, violating the Children’s Online Privacy Protection Act (COPPA). The law requires digital platforms to notify and obtain parental consent before collecting and using personal information from children under 13.

IN press release In a filing Friday, the FTC’s Bureau of Consumer Protection found that TikTok and ByteDance “allegedly knew” they’d to comply with COPPA but spent “years” knowingly allowing thousands and thousands of children under 13 to make use of their platform. TikTok did so, the FTC alleges, even after reaching a settlement with the FTC in 2019 over COPPA violations; as part of that settlement, TikTok agreed to pay $5.7 million and implement steps to forestall children under 13 from signing up for the platform.

“Since 2020, TikTok had a policy of keeping accounts of children it knew were under 13 years old alive unless the child had explicitly admitted their age and other strict conditions had been met,” the FTC wrote in a press release. “TikTok reviewers allegedly spent an average of five to seven seconds reviewing each account to determine whether it belonged to a child.”

TikTok and ByteDance maintained and used underage user data, including for ad targeting, even after employees raised concerns and TikTok reportedly modified its policy to not require explicit age disclosure, in accordance with the FTC. More devastatingly, TikTok continued to permit users to enroll for third-party accounts like Google and Instagram without verifying they were over 13, the FTC added.

The FTC also found an issue with TikTok Kids Mode, TikTok’s supposedly more COPPA-compliant mobile experience. The FTC alleges that Kids Mode collected “significantly more data” than was obligatory, including details about users’ activities on the app and identifiers that TikTok used to create profiles (and shared with third parties) to forestall user churn.

The FTC found that when parents asked to delete their child’s account, TikTok made it difficult for them to accomplish that and often didn’t comply with their requests.

“TikTok has knowingly and repeatedly violated children’s privacy, endangering the safety of millions of children across the country,” FTC Chairwoman Lina Khan said in a press release. “The FTC will continue to use the full scope of its authority to protect children online — especially as companies deploy increasingly sophisticated digital tools to surveil children and profit from their data.”

TikTok shared the next with TechCrunch in an email: “We disagree with these allegations, many of which relate to past events and practices that are untrue or have already been addressed. We pride ourselves on our efforts to protect children and will continue to update and improve the platform. To that end, we offer age-appropriate experiences with rigorous safeguards, proactively remove suspicious underage users, and have voluntarily launched features like default screen time limits, Family Pairing, and additional privacy protections for minors.”

The FTC and DOJ are proposing to impose civil fines on TikTok and ByteDance of as much as $51,744 per violation, per day, and to issue a everlasting injunction to forestall future violations of COPPA.