Data protection fine for TikTok

TikTok's breaches

The ICO found that TikTok did not make reasonable efforts to obtain consent from parents or carers for underage child users.

Under Article 8 UK GDPR data controllers are required to obtain consent from a parent or carer of a child under 13 and to make reasonable efforts to verify such consent has been provided or authorised. TikTok’s terms of service went one step further and explicitly prohibited children under 13 from creating an account. However, the ICO found TikTok’s own systems in place from 2018-2020 were not sufficient to enforce this.  This led to approximately 1.4 million UK children under 13 accessing TikTok, without the necessary consent or authorisation from their parents or carers.

The ICO also found that TikTok failed to ensure that information about TikTok’s processing was communicated effectively to and in an easily accessible way to enable children to be able to make informed choices about how they engage with TikTok. Article 13 UK GDPR information sets out the basic information requirements within privacy notices, and includes an obligation on the data controller (in this instance TikTok) to take appropriate measures to provide the information to data subjects in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular in relation to information addressed specifically to children.

As a result of these two failures, the ICO found that TikTok breached Article 5(1)(a) UK GDPR, as TikTok failed to ensure that the personal data of its UK users was processed lawfully, fairly and in a transparent manner.

Conclusion

The action taken by the ICO and the size of the final fine shows clear intent to ensure that children’s data is adequately protected. There is significant concern amongst both privacy and children’s safety campaigners that children are unaware how to protect or restrict use of their data for marketing and other targeted advertising – which can expose children to harmful or inappropriate content. One of the clear targets is lack of transparency in privacy notices – particularly those for services aimed at, or heavily used by, children. This investigation period pre-dates the introduction of the ICO’s Children’s “age appropriate design” Code (“The Code”) introduced in August 2020 to help protect children using digital services.

The Code isn’t legally binding but serves as useful guidance on how the UK GDPR applies to services engaging children. Where services are targeted at children, or where it is highly likely they will engage with them, Controllers must be aware of the additional protections afforded to children under 13 in the UK GDPR. Organisations must have stringent procedures in place to obtain consent from the parent or carer of children under 13 and should have regard to the Code to ensure compliance with the UK GDPR. Whilst each controller is required to take a proportional approach, the size of the fine shows that the measures taken by TikTok were not deemed sufficient in the circumstances, given the resources that it claim to have invested in online safety.

Our specialist data protection team at Blake Morgan can provide advice on any data protection queries you may have, please contact us here.