RegSol Blog


Data Protection Commissioner TikTok Fine

September 2023

On 15th September 2023, the Data Protection Commissioner (“DPC”} published its final decision regarding its inquiry into TikTok’s data processing practices involving children’s data. The social media platform was fined €345 million for shortcomings in adequately protecting children and their personal data, while using the platform.

The EDPB adopted a binding decision on the matter on August 2, 2023 (in accordance with the Article 65 GDPR dispute resolution mechanism) after consulting with its supervisory counterparts in other EU Member States following an investigation into the platform between July 31, 2020, and December 31, 2020. The DPC adopted its final conclusion in response to this EDPB ruling, stating its major findings of non-compliance with several GDPR rules as follows:

· profile settings for child user accounts on the TikTok platform were set to ‘public’ by default, meaning anyone (on or off the platform) could view the content posted by the child user;

· the ‘Family Pairing’ setting allowed an adult user (who could not be verified as the parent or guardian of the child) to pair their account to a child’s account. This allowed the adult user to enable direct messages for children above the age of 16, which posed several possible risks to child users;

· the ‘public by default’ setting on children’s accounts posed several significant risks to children aged under 13 who gained access to the platform;

· TikTok failed to provide sufficient transparency information to children who use the platform; and

· TikTok implemented ‘dark patterns’ by nudging users towards choosing more privacy-intrusive options during the registration process, and when posting videos.

In addition to the administrative fine, the DPC has issued a reprimand and an order requiring TikTok to bring its processing into compliance within a period of three months from 1st September 2023. TikTok has disagreed with aspects of the decision, mentioning that the settings and features of the platform condemned by the DPC in its decision had been updated to enhance protection of child users, even before the DPC’s investigation commenced.

The full press release can be read HERE.