Ireland has fined TikTok €345 million for breaches of EU law.
The Irish Data Protection Commission concluded the social media platform failed to adequately protect the data of children using the platform.
Ireland’s data authority scrutinised the social media app for a six month period from July to December 2020.
It found that children may have signed up to TikTok without realising they needed to actively turn on privacy settings.
“Their accounts were set to public by default and [this created] risks associated with such data processing for child users”, the data commission concluded.
TikTok describes itself as “the leading destination for short-form mobile video. Our mission is to inspire creativity and bring joy.”
The platform is hugely popular with hundreds of millions of users around the world. Its fast-paced short video content makes it particularly popular amongst younger people.
Although the commission did not find TikTok’s age verification system to be in breach, there were also concerns about the possible use of the app by children under the age of 13.
“TikTok did not properly take into account the risks posed to those under 13s who gained access to the TikTok platform by the default account setting which allowed anyone (on or off TikTok) to view social media content posted by those users…because of this, TikTok did not implement appropriate technical and organisational measures to ensure and to be able to demonstrate that the foregoing processing was performed in accordance with the GDPR.”
In its conclusions, the Irish Data Protection Commission says TikTok was in “infringement of Articles 5(1)(c), 5(1)(f), 24(1), 25(1), 25(2), 12(1), 13(1)(e) and 5(1)(a)” of the EU’s GDPR regulation.
The General Data Protection Regulation (GDPR) sets Europe-wide rules on “personal data and on the free movement of such data”, according to the EU.
Along with the multi-million Euro fine, Irish Data Protection Commission says it has issued TikTok with a formal reprimand and ordered the company to “bring its processing into compliance by taking the action specified within a period of three months”.
In a statement, TikTok responded this afternoon saying:
“We respectfully disagree with the decision, particularly the level of the fine imposed.
The DPC’s criticisms are focused on features and settings that were in place three years ago, and that we made changes to well before the investigation even began, such as setting all under 16 accounts to private by default.”