Failure on Children’s Privacy Leads TikTok to a Fine of £27M

The Information Commissioner’s Office in the UK discovered that the platform may have processed under-13s’ data without their parent’s consent. The violation occurred over two years, until July 2020, but remains inconclusive.

The video-sharing platform disagrees with the findings, calling them “provisional.” However, it’s worth noting that more than 100 million TikTok videos are watched per minute, and psychologists worry that TikTok is addictive. 

The ICO has issued a legal document that precedes a potential fine to TikTok Inc. and TikTok Information Technologies UK Limited. According to the notice, the platform breached UK data protection law between May 2018-July 2020.

The video-sharing platform has implemented safety and privacy features, such as allowing parents to link their kids’ accounts to theirs and disabling messaging for children under 16.

However, despite its policies prohibiting under-13s from using the platform, 44% of eight to 12-year-olds in the UK use TikTok.

John Edwards, the Information Commissioner, thinks businesses that provide digital services have a legal duty to establish protections. Still, their preliminary view is that the platform didn’t succeed.

The Children’s Code, which went into effect in September 2021, established new data protection codes for online services used by children based on existing data protection laws. In addition, there are financial penalties for serious violations.

The ICO investigation discovered that TikTok:

• Processed the data of children under-13 without parental consent; 
• Failure to provide appropriate information to its users transparently and concisely; 
• Processed special category data without legal reasons. 

The ICO stated that its findings are preliminary, and they couldn’t draw a conclusion that there had been a violation of data protection law. However, before making a final decision, they will carefully consider the platform’s representations.

TikTok respects the ICO’s role in protecting privacy in the UK, but they disagree with the provisional views expressed in the notice and plan to respond to the ICO when the time is right.