US sues TikTok for violating children’s privacy laws

The U.S. Department of Justice has filed a lawsuit against popular social media platform TikTok and its parent company ByteDance, accusing them of widespread violations of children’s privacy laws.

The lawsuit alleges that TikTok collected personal information from children under the age of 13 without parental consent, in violation of the Children’s Online Privacy Protection Act (COPPA).

Since 2019, TikTok has allowed children to create accounts outside of “Kids Mode” (the version of the app intended for children under 13), but has not implemented policies or processes to help identify and disable/delete accounts created by children.

The Justice Department says the practice exposes millions of young users to “extensive data collection” and privacy risks by allowing them to access adult content and interact with adult users.

The lawsuit, filed in the U.S. District Court for the District of Columbia, alleges that TikTok and ByteDance knew about these violations but continued to engage in illegal data collection practices.

Failure to delete collected data

The Justice Department investigation into TikTok’s data collection practices also found that the company failed to delete personal information upon parental request, a requirement under COPPA.

The complaint further alleged that TikTok misled parents and users about its data collection policy by failing to adequately inform them about what data was being collected and how it was used.

“For example, in a 2018 exchange, a senior employee of the defendants expressly admitted that the defendants had ‘actual knowledge’ of children on TikTok after receiving an initial parental request, yet failed to delete the children’s accounts after receiving the request. In the exchange, the former CEO of TikTok Inc. communicated about underage users on TikTok with the director of child safety in the United States,” the complaint reads (PDF).

“For years, defendants knowingly allowed children under the age of 13 to create and use TikTok accounts without their parents’ knowledge or consent, collected extensive data from those children, and failed to comply with parents’ requests to delete their children’s accounts and personal information.”

The Justice Department is now seeking civil penalties and an injunction against TikTok and ByteDance to prevent further infringement. TikTok’s Android app has over 1 billion downloads, while the iOS version has been reviewed 17.2 million times.

“The Department is deeply concerned that TikTok continues to collect and maintain personal information about children despite a court order prohibiting such conduct,” Acting Assistant Attorney General Benjamin C. Mizer said today. “Through this action, the Department seeks to ensure that TikTok is living up to its responsibility to protect children’s privacy rights and parents’ efforts to protect their children.”

TikTok proud of its ‘child protection efforts’

In response to the lawsuit, TikTok said it disagrees with the “allegations, many of which allege past events and practices that are factually inaccurate or have already been discussed.”

“We are proud of our efforts to protect children and will continue to update and improve the platform,” it added.

In September, the Irish Data Protection Commission (DPC) fined TikTok $368 million (€345 million) for violating the privacy of children aged 13 to 17 when processing their data, under multiple articles of the European Union’s General Data Protection Regulation (GDPR).

The DPC also found that the company used “cryptic patterns” when registering and posting videos, subtly tricking users into choosing options that violated their privacy.

In January 2023, TikTok was also fined $5.4 million (€5 million) by the French data protection authority (CNIL) for failing to adequately inform users about its use of cookies and making it difficult to opt out.