TikTok has agreed to pay a penalty of $5.7 million in order to settle allegations that it illegally collected children's personal data.
The penalty effectively settles a complaint submitted by the U.S. Federal Trade Commission against TikTok alleging that the video social networking app had previously violated the Children’s Online Privacy Protection Act (COPPA). This legislation says that websites and online services can't automatically collect the personal data of children who are younger than 13 years old. They must first obtain parental consent.
According to the independent government agency, that's not what happened. The FTC asserts that TikTok, formerly known as Musical.ly, failed to inform parents of children younger than 13 about the app's data collection policies and failed to obtain their consent before it collected their children's email addresses, phone numbers, first and last names, biographies, usernames and profile pictures when they created an account. Much of this data was publicly viewable, thereby undermining these young users' privacy. In fact, the FTC learned of instances where adults tried to contact children via the Musical.ly app.
Additionally, TikTok reportedly failed to delete children's personal data which it had previously collected when parents requested that it do so.
FTC Chairman Joe Simons feels these abuses justify the $5.7 million fine, which is the largest civil penalty ever obtained by the FTC in a children's privacy case. As he explains in a statement:
The operators of Musical.ly—now known as TikTok—knew many children were using the app but they still failed to seek parental consent before collecting names, email addresses, and other personal information from users under the age of 13. This record penalty should be a reminder to all online services and websites that target children: We take enforcement of COPPA very seriously, and we will not tolerate companies that flagrantly ignore the law.
In addition to paying the monetary fee, TikTok has agreed to abide by COPPA going forward and to take down any videos created by any users who are younger than 13.
News of this penalty comes a little over a year after VTech Electronics Limited agreed to pay $650,000 as part of a settlement agreement with the Federal Trade Commission (FTC) for a 2015 breach that exposed millions of parents’ and children’s data.
