TikTok fined by EU for risking children’s data: APAC marketers react

Social media giant TikTok has incurred a substantial fine of €345 million ($394 million) for breaching EU data regulations concerning handling children's accounts, including the failure to safeguard underage users' content from public exposure. 

The Irish Data Protection Commission (DPC), the regulatory authority overseeing TikTok's operations throughout the European Union, identified multiple instances of non-compliance with GDPR (General Data Protection Regulation) rules by the Chinese-owned video-sharing platform.

The key findings include: 

• TikTok placed accounts of users aged 13 to 17 on a public setting by default. This setting allowed anyone to view the content posted by these users and comment on it without restriction. 
• The platform failed to provide transparent information to child users regarding their data privacy and protection, a significant violation of GDPR. 
• Through the "family pairing" setting, TikTok allowed adults to access a child's account and enable direct messaging, even for users over 16 years old. The DPC noted that this feature lacked appropriate safeguards. 
• TikTok did not adequately assess the risks posed to users under the age of 13, especially those placed on a public setting. This oversight had potentially serious consequences. 
• The "family pairing" scheme, which permits adults to control a child's account settings, did not sufficiently verify whether the adult was a parent or guardian. 
• For users under 17, TikTok enabled features like Duet and Stitch by default. However, the DPC found no GDPR infringement in verifying users' ages. 

TikTok addressed the findings, noting that it has set all existing and new TikTok accounts for 13- to 15-year-olds to private by default since 2021, thereby restricting content access to approved users. The company disagreed with the DPC's decision, particularly the size of the fine, emphasising that many of the criticised features and settings were altered well before the investigation began. 

The DPC acknowledged that it had been overruled by the European Data Protection Board on some aspects of its decision. This included a finding by the German regulator that TikTok's use of "dark patterns," deceptive website and app designs steering users into specific behaviors or choices, breached a GDPR provision regarding fair processing of personal data. 

APAC marketers respond

The issue is a real wake-up call from a brand marketing perspective; after all, brand safety is paramount to marketers who pour a good chunk of their budget into the rapidly expanding world of TikTok, where there's a massive audience.

The potential risk of advertisers getting their brand placement wrong and collecting data marketers should not be managing is a genuine cause for concern, says Chadwick Kinlay, the chief marketing officer, TrafficGuard. 

“Picture this: your ads end up reaching unintended kids on TikTok who might not fully understand what they're interacting with – quite a conundrum, right? And the kicker is that algorithms could start favouring this accidental audience, draining your ad budget and mixing up visitor data – it's a real eye-opener for us marketers,” Kinlay tells Campaign.

“Beyond all the rules and ethics, this whole situation throws a wrench into our transparency, focus, and the return we expect on our ad investments. It's a clear reminder of the importance of being responsible and vigilant in our advertising practices.” 

(L-R) Marcus Herrmann and Chadwick Kinlay

Marcus Herrmann, the chief safety officer at youth platform TotallyAwesome, points out TikTok has a long history of youth data privacy violations. 

For example, in 2019, TikTok was fined in the US for COPPA violation. In 2020 the platform was fined in South Korea for mishandling children’s personal data and most recently, TikTok was fined in the UK for illegally processing children’s personal data without parental consent. 

"The past fines were in the lower millions and didn’t make any difference in Bytedance’s financial results. However, This time, the penalty is large enough to dent the company’s bottom line," Herrmann tells Campaign.

“The EU fine is for non-compliance with the EU GDPR, specifically with regards to safety of young audiences. Teenagers’ accounts were set to public by default, putting these audiences at risk as anyone could see their content (remember, pictures, voice and video recordings are considered personal information)," he adds. 

Herrmann notes anyone could comment on the above content (remember, there’s a lot of hate, bullying and even incitement to suicide in public comments).  

Even worse, he adds, through the ‘family pairing’ function, anyone could pretend to be a teenager’s parent and link their accounts, thus being able to start private chats. TikTok did not verify that the adult is the actual parent or guardian.  

 “The long list of fines and continued privacy infractions could make us believe that TikTok is “Unsafe by Default,” says Herrmann. 

“TotallyAwesome welcomes this fine as it hopefully will provoke a change in mindset. Instead of paying fines, Bytedance has the opportunity now to put youth safety first and implement a privacy-by-design approach.”