TikTok is facing a hefty fine of 345 million euros (£296 million) due to its mishandling of children’s data. The Irish data regulator pointed out that the app’s design automatically made children’s accounts public and failed to provide sufficient protection against receiving messages from adults. This represents the latest case where Ireland’s regulatory bodies have imposed substantial fines on major tech companies for how they handle user information.
TikTok Technology Limited (TTL) received a fine from the Data Protection Commission (DPC) following an investigation into the platform’s adherence to the European Union’s General Data Protection Regulation with respect to certain privacy settings and features.
The DPC’s inquiry focused on age verification during registration and the handling of children’s personal data by the video-sharing platform, which a Chinese company owns. The investigation covered the period from July 31 to December 31, 2020.
TikTok Disagrees with DPC’s Ruling and Fine, Citing Timely Feature Changes
TikTok disagreed with the fine’s severity, stating that it related to features and settings they had implemented three years ago. The DPC completed its investigation of TikTok and released its final verdict on September 1.
The decision outlined how young users went through TikTok’s sign-up process, resulting in the platform automatically setting their accounts to public. This configuration meant that any videos they posted were automatically made public, and public comments were enabled.
The Data Protection Commission (DPC) investigated TTL’s transparency responsibilities, specifically focusing on how much information TTL provided to young users regarding default settings. They found that in the Family Pairing feature, TTL allowed a child user’s account to be “paired” with an unverified non-child. The DPC noted that the non-child user could authorize direct messages for child users aged 16 and above, thereby relaxing the restrictions for the child user.
As a result of their findings, the DPC has given TTL a formal reprimand. Additionally, they have mandated that TTL align its data processing practices with the regulations by undertaking specific actions within three months. The DPC has also imposed administrative fines amounting to a total of 345 million euros.
A spokesperson for TikTok said: “We respectfully disagree with the decision, particularly the level of the fine imposed. The DPC’s criticisms are focused on features and settings that were in place three years ago, and that we made changes to well before the investigation even began, such as setting all under 16 accounts to private by default.”
Regulatory Actions Against Social Media Corporations in Ireland and the UK
The latest instance of fines levied by the DPC in Ireland targeted major social media corporations.
Earlier this year, Meta Ireland, the parent company of the social media giant Facebook, found itself in hot water as it was levied a substantial fine amounting to a staggering 390 million euros. The fine resulted from the company’s violation of crucial European Union data privacy regulations, sparking a wave of punitive actions by the Data Protection Commission (DPC) against Meta.
In a separate but notable incident that transpired in January, WhatsApp, another subsidiary under the Meta umbrella, faced its own legal ramifications in the form of a substantial fine exceeding five million euros. This penalty was imposed due to significant breaches in data protection protocols, underscoring the growing importance and scrutiny surrounding data privacy issues.
Notably, the troubles for Meta did not end there. In the preceding year, Instagram, another prominent platform owned by Meta, received a hefty fine totalling a substantial 405 million euros. The core reason behind this significant penalty was the mishandling of personal data, particularly concerning teenagers, shedding light on the critical need for stringent measures to safeguard the privacy of vulnerable user groups.
Shifting our focus to the United Kingdom, TikTok’s popular short-video platform was at the centre of regulatory attention. The Information Commissioner’s Office (ICO) in the UK imposed a notable fine amounting to £12.7 million on TikTok earlier in the same year. The primary grounds for this penalty were TikTok’s inadequate efforts in preventing underage children from accessing the platform and ensuring the appropriate use and handling of their data, reinforcing the global call for more stringent regulation and oversight in the realm of data protection.
