TikTok fined €345m for breaching children’s privacy in EU

The decision follows an investigation into TikTok’s compliance with EU data protection rules, also known as GDPR.

The Irish Data Protection Commission (DPC) launched its inquiry into TikTok’s default settings and the way they verify a user’s age during the registration process during the period from July to December 2020. For age verification processes, they also looked into how TikTok handles data of children aged under 13.

While no violation was found regarding the age verification processes, the final decision notes that TikTok did not consider the risks posed to children aged under 13 when their accounts are made public by default.

When children sign up for the TikTok app, their accounts are set to public by default, which also means comments are enabled publicly by default, the investigation found.

During the investigation, the data protection authorities in Berlin raised objections to the draft decision made by the Irish authority, seeking to include further infringements regarding ‘dark patterns’.

These dark patterns are considered design tricks used to make users buy, click, or sign up for things they do not intend to.

The European Data Protection Board backed Berlin’s call and urged Irish authorities to include a reference to the remedial work required by TikTok on this matter.

Irish data authorities also looked into TikTok’s transparency obligations, especially when it comes to informing young users about the default settings.

“We respectfully disagree with the decision, particularly the level of the fine imposed,” said a TikTok spokesperson. “The DPC’s criticisms are focused on features and settings that were in place three years ago, and that we made changes to well before the investigation even began, such as setting all under-16 accounts to private by default.”

Earlier this year, the UK data watchdog fined TikTok €14.5m over its misprocessing of 1.4 million children’s data without parental contest.