Last Wednesday, a coalition of leading U.S. child advocacy, consumer, and privacy groups, including the Campaign for a Commercial-Free Childhood and the Center for Digital Democracy, filed a Complaint against the renowned company TikTok for illegally collecting personal information from children, despite the company's past commitment to stop this action.

Last year the Federal Trade Commission (FTC) sentenced Musical.ly, now TikTok, to pay a $5.7 million fine for violating the privacy rights of children. 

In particular, Musical.ly has been accused of illegally gathering children’s sensitive personal data, such as email addresses, names, pictures, and locations without parental permission through its app, and refusing parent requests to have their children’s data deleted.

“The truth is, TikTok profits so much from the presence of kids on their platform that last year’s $5.7 million fine is meaningless – like YouTube and Facebook before them, they can write off that kind of penalty as a cost of doing business. That’s why we’re calling on the FTC not only to sanction TikTok and hold its executives accountable, but to enact the maximum penalties allowed by law — $42,530 per violation, which could amount to billions of dollars. And until TikTok can adopt an effective age verification policy and actually be COPPA-compliant, we’re urging the FTC to prevent TikTok from registering any new users in the US”, explains Melissa Campbell in the blog of The Campaign for a commercial-free childhood.

The plaintiffs argued in their Complaint (attached) that TikTok has failed to comply with the terms of the Consent Decree maintained with the FTC and has violated the Children's Online Privacy Protection Act (COPPA) for the following reasons:

A. Failing to provide notice on their website or online service of the information they collect online from children, how they use such information, and their disclosure practices, among other required content, in violation of Section 312.4(d) of the Rule, 16 C.F.R. § 312.4(d); 

B. Failing to provide direct notice to parents of the information they collect online from children, how they use such information, and their disclosure practices for such information, among other required content, in violation of Section 312.4(b) of the Rule, 16 C.F.R. § 312.4(b); 

C. Failing to obtain consent from parents before any collection or use of personal information from children, in violation of Section 312.5(a)(1) of the Rule, 16 C.F.R. § 312.5(a)(1); 

D. Failing to delete personal information collected from children at the request of parents, in violation of Section 312.6(a)(2) of the Rule, 16 C.F.R. § 312.6(a)(2); 

E. Retaining personal information collected online from children for longer than reasonably necessary to fulfill the purpose for which the information was collected, in violation of Section 312.10 of the Rule, 16 C.F.R. §312.10.39.

“We found that TikTok currently has many regular account holders who are under age 13, and many of them still have videos of themselves that were uploaded as far back as 2016, years prior to the consent decree,” they explain in their complaint. 

These associations have shown their concern by observing the existence of many TikTok accounts operated by minors, where they publish their videos. These videos may end up being used by third parties for commercial purposes.

“TikTok continues to be one of the most popular apps in the world, and it is widely used by children and teens in the United States, so it is especially important that the FTC promptly and thoroughly investigate TikTok’s practices and take effective enforcement action,” the groups said in their complaint.

Josh Golin, Executive Director of Campaign for a Commercial-Free Childhood, said “For years, TikTok has ignored COPPA, thereby ensnaring perhaps millions of underage children in its marketing apparatus, and putting children at risk of sexual predation. Now, even after being caught red-handed by the FTC, TikTok continues to flout the law. We urge the Commission to take swift action and sanction TikTok again – this time with a fine and injunctive relief commensurate with the seriousness of TikTok’s serial violations.”

On the other hand, Jeff Chester, Executive Director of the Center for Digital Democracy explain that  “the failure of the FTC to ensure that TikTok protects the privacy of millions of children, including through its use of predictive AI applications, is another reason why there are questions whether the agency can be trusted to effectively oversee the kids’ data law”.

One of the violations that TikTok has committed, according to the complaint, is the failure to include parental consent for the creation of the accounts of minors:

“TikTok has not obtained parental consent for these accounts. Contrary to the terms of the consent decree, TikTok fails to make reasonable efforts to ensure that a parent of a child receives direct notice of its practices regarding the collection, use, or disclosure of personal information. Indeed, TikTok does not at any point contact the child’s parents to give them notice and does not even ask for contact information for the child’s parents. Thus, TikTok has no means of obtaining verifiable parental consent before any collection, use, or disclosure of children’s personal information as required by the consent decree and COPPA Rule”.

The plaintiffs consider that TikTok violated the terms of the Consent Decree and thus state this in the complaint:

“The consent decree specifically requires that TikTok either destroy all personal information of all existing users, or destroy all personal information collected from users under age 13. The purpose of both alternatives was to require TikTok to destroy any personal information that it had collected from someone under 13 in the past, and to prohibit any new collection of personal information from a child prior to giving notice and obtaining parental consent. The consent decree also required TikTok to remedy specific COPPA violations, i.e., failing to post a prominent and clearly labelled link to its privacy policy, failing to provide direct notice to parents of their practices regarding the collection and use of children’s data, failing to obtain verifiable, parental consent before collecting information from children, failing to provide parents with the right to delete data collected from a child, and retaining children’s personal information longer than necessary. It also required TikTok to comply with all provisions of the COPPA Rule. Our review of TikTok, however, indicates that it continues to violate the COPPA rule in multiple ways”.