The UK’s privacy watchdog fined TikTok a multimillion-dollar effective on Tuesday for misusing children’s data and violating other protections for young users’ personal information.
The data commissioner’s office said it had fined £12.7m ($15.9m) on a brief video sharing app that’s hugely popular with young people.
That is the latest example of the tighter scrutiny TikTok and its parent, Chinese tech firm ByteDance, are facing in the West, where governments are increasingly concerned about the threats the app poses to data privacy and cyber security.
The UK watchdog, which investigated data breaches between May 2018 and July 2020, said TikTok allowed as many as 1.4 million UK children under 13 to make use of the app in 2020, despite the platform’s own rules prohibiting such young children establishing accounts .
TikTok did not properly discover and take away children under 13 from the platform, the watchdog said.
And while it knew younger children were using the app, TikTok had not obtained parental consent to process their data as required by UK data protection laws, the agency said.
“There are laws in place to make sure our youngsters are as protected in the digital world as they’re in the physical world. TikTok didn’t respect these laws,” Information Commissioner John Edwards said in a press release.
He said TikTok collected and used the personal information of kids who were improperly granted access to the app.
“This implies their data might have been used to trace and profile them, potentially delivering harmful, inappropriate content on the next scroll,” Edwards said.
The corporate said it disagreed with the regulator’s decision.
“We invest heavily to assist keep people under 13 away from the platform, and our 40,000-strong security team works around the clock to maintain the platform protected for our community,” TikTok said in a press release. “We are going to proceed to review the decision and consider next steps.”
TikTok says it has improved its registration system since the breaches, not allowing users to easily declare they’re sufficiently old and look for other signs that the account is getting used by someone under 13.