FTC and Justice Department sue TikTok over alleged violations of children’s privacy

The US Federal Trade Commission and the Department of Justice are suing TikTok and TikTok’s parent company ByteDance for violating the Children’s Online Privacy Protection Act (COPPA), which requires digital platforms to obtain parental consent before collecting and using personal data from children under the age of 13.

In a press release issued Friday, the FTC’s Bureau of Consumer Protection said that TikTok and ByteDance “reportedly knew” about the need to comply with COPPA, yet they spent “years” knowingly allowing millions of children under the age of 13 to access their platforms. The FTC alleges that TikTok did this even after it had reached a settlement with the FTC over COPPA violations in 2019; as part of that settlement, TikTok agreed to pay $5.7 million and take steps to prevent children under the age of 13 from signing up.

“Until 2020, TikTok had a policy of retaining accounts belonging to children it knew were under the age of 13 unless the child explicitly acknowledged his or her age and other stringent conditions were met,” the FTC wrote in a press release. “TikTok’s human reviewers reportedly spent an average of just five to seven seconds reviewing each account to determine whether or not the account belonged to a child.”

According to the FTC, TikTok and Bytedance retained and used underage users’ data, including data to target ads, even after employees raised concerns and TikTok reportedly changed its policy to not explicitly require age disclosure. Even more reprehensible, TikTok continued to allow users to sign up with third-party accounts, such as Google and Instagram, without verifying that they were over the age of 13, the FTC said.

The FTC also found problems with TikTok Kids Mode, TikTok’s purportedly COPPA-compliant mobile experience. The FTC alleges that Kids Mode collected excessive data, including information about users’ in-app activities and identifiers, which TikTok used to build profiles (and share with third parties) to prevent attrition.

The FTC said that when parents requested that their children’s accounts be deleted, TikTok made it difficult and often failed to comply with those requests.

“TikTok has knowingly and repeatedly violated children’s privacy, threatening the safety of millions of children across the country,” FTC Chairwoman Lina Khan said in a statement. “The FTC will continue to use the full extent of its authority to protect children online — especially as companies use increasingly sophisticated digital tools to monitor children and profit from their data.”

TikTok told TechCrunch this via email: “We disagree with these allegations, many of which relate to past incidents and practices that are factually inaccurate or have been addressed. We’re proud of our efforts to protect children, and we’ll continue to update and improve the platform. To that end, we provide an age-appropriate experience with strict security measures, proactively remove suspected underage users, and have voluntarily launched features like default screen time limits, Family Pairing, and additional privacy protections for minors.”

The FTC and Justice Department have proposed imposing civil penalties of up to $51,744 per day per violation on TikTok and ByteDance and a permanent injunction to prevent future COPPA violations.