The European Union’s data watchdog has issued a substantial €345 million penalty against the popular Chinese video-sharing app TikTok on September 15th. The fine is a consequence of TikTok’s improper handling of children’s personal data within the EU.
In addition to the substantial fine, TikTok has been instructed to rectify its procedures for managing the data of users aged between 13 and 17 within the next three months to align with European Union regulations.
This ruling stems from an investigation into TikTok’s compliance with EU data protection laws, commonly referred to as GDPR. The Irish Data Protection Commission (DPC) initiated this inquiry, focusing on TikTok’s default settings and the process for verifying a user’s age during registration, conducted from July to December 2020. The investigation also delved into how TikTok manages the data of children below the age of 13 during the age verification process.
While the investigation didn’t uncover any issues with the age verification process, it did find that TikTok failed to consider the potential risks posed to children under 13 when their accounts were automatically set to public. This default setting also meant that comments were publicly enabled by default.
During the investigation, data protection authorities in Berlin raised concerns about the draft decision made by the Irish authority, urging the inclusion of further violations related to “dark patterns.” These dark patterns involve design strategies aimed at persuading users to make unintended purchases, clicks, or sign-ups.
The European Data Protection Board supported Berlin’s position and urged Irish authorities to incorporate references to the necessary corrective actions TikTok must take in this regard.
Irish data protection authorities also assessed TikTok’s transparency obligations, especially concerning the communication of default settings to young users.
In response to the ruling, a TikTok spokesperson expressed disagreement with the decision, particularly emphasizing the fine’s magnitude. They argued that the criticisms from the DPC pertained to features and settings in place three years ago, which TikTok had already modified well before the investigation began. One such change was setting all accounts of users under 16 to private by default.
Earlier this year, the UK’s data watchdog imposed a €14.5 million fine on TikTok for mishandling the data of 1.4 million children without parental consent.
