The Federal Trade Commission and Department of Justice are suing TikTok and its parent company, ByteDance, for violating the Children's Online Privacy Protection Act (COPPA), which requires digital platforms to provide parental notice and obtain consent before collecting and using personal data from children under the age of 13.
In a press release issued Friday, the FTC's Bureau of Consumer Protection said that TikTok and ByteDance “allegedly knew” about the need to comply with COPPA but knowingly allowed millions of children under the age of 13 on their platforms “for years.” The FTC alleges that TikTok did so even after it settled with the FTC for COPPA violations in 2019. As part of the settlement, TikTok agreed to pay $5.7 million and take steps to prevent children under the age of 13 from signing up.
“As of 2020, TikTok had a policy of maintaining accounts of children it knew to be under the age of 13 unless the child explicitly acknowledged their age and other strict conditions were met,” the FTC said in a press release. “TikTok's human reviewers allegedly spent an average of just five to seven seconds reviewing each account to determine whether it belonged to a child.”
According to the FTC, TikTok and ByteDance retained and used data from underage users, including that data for ad targeting, even after employees raised concerns and TikTok reportedly changed its policy to no longer require users to disclose their age. Even more reprehensible, TikTok continued to allow users to sign up with third-party accounts, such as Google or Instagram, without verifying that they were over the age of 13, the FTC added.
The FTC also found problems with TikTok's supposedly COPPA-compliant mobile experience, TikTok Kids Mode, which the FTC alleges collected “significantly more data” than it needed to, including information about users' in-app activity and identifiers that TikTok used to create profiles (and shared with third parties) to prevent abandonment.
The FTC said TikTok made it difficult for parents to request that their children's accounts be removed and often did not comply with the requests.
“TikTok has knowingly and repeatedly violated children's privacy and threatened the safety of millions of children across the country,” FTC Chairman Lina Khan said in a statement. “The FTC will continue to use the full range of its powers to protect kids online, especially as companies deploy increasingly sophisticated digital tools to spy on kids and profit from their data.”
TikTok told TechCrunch in an email: “We disagree with these allegations, many of which are factually incorrect or relate to past events or practices that we have already addressed. We are proud of our efforts to protect children and will continue to update and improve our platform. To that end, we have implemented rigorous safeguards to provide an age-appropriate experience, proactively remove suspected underage users, and voluntarily launched features like default screen time limits, family pairing, and additional privacy protections for minors.”
The FTC and Department of Justice are proposing to impose civil penalties of up to $51,744 per violation per day against TikTok and ByteDance, as well as permanent injunctions to prevent future COPPA violations.