Irish Data Protection Commission fines TikTok €345 million
The Irish Data Protection Commission has announced it is fining video hosting giant TikTok €345 million for breaches of its obligations in relation to the processing of data belonging to children.
An inquiry was carried out for the period between 31 July 2020 and 31 December 2020 into whether TikTok Technology Limited (TTL) complied with its obligations under General Data Protection Regulation (GDPR) in relation to its processing of personal data relating to child users of the TikTok platform in the context of:
- Certain TikTok platform settings, including public-by-default settings as well as the settings associated with the ‘Family Pairing’ feature; and
- Age verification as part of the registration process.
Some objections were raised when the DPC forwarded a draft decision on its findings to its European data protection counterparts and were ultimately forwarded to the European Data Protection Board. The Board adopted its binding decision on the subject matter of the objections on 2 August 2023 with the following infringements identified:
- The profile settings for child user accounts were set to public by default meaning anyone (on or off TikTok) could view the content posted by the child user.
- The ‘family pairing’ setting allowed a non-child user (who could not be verified as the parent or guardian) to pair their account to a child user’s account. This allowed the non-child user to enable direct messages for child users above the age of 16, which posed severe possible risks to child users.
- The fact that profile settings for child users were set to public by default also posed several possible risks to children under the age of 13 who gained access to the platform.
- TikTok failed to provide sufficient transparency information to child users.
- TikTok implemented ‘dark patterns’ by nudging users towards choosing more privacy-intrusive options during the registration process, and when posting videos.
The DPC’s decision was adopted on 1 September 2023. The decision exercises the following corrective powers:
- A reprimand;
- An order requiring TTL to bring its processing into compliance by taking the action specified within a period of three months from the date on which the DPC’s decision is notified to TTL; and
- Administrative fines totalling €345 million.
Speaking to RTE news, the Irish Data Protection Commissioner, Helen Dixon said she was pleased to have concluded the investigation and that ‘alone the fine of €345m is a headline sanction to impose but reflects the extent to which the DPC identified child users were exposed to risk in particular arising from TikTok’s decision at the time to default child user accounts to public settings on registration.’
Image by Solen Feyissa/Via UnSplash/https://unsplash.com/license
