FTC Sues TikTok for Violating US Children’s Privacy Law (COPPA)

On 2 August 2024, the Federal Trade Commission (FTC) filed a lawsuit against TikTok and its parent company ByteDance in the U.S. District Court for the Central District of California. This legal action stems from allegations that TikTok violated the Children’s Online Privacy Protection Act (COPPA) and an existing 2019 FTC consent order. The lawsuit contends that TikTok knowingly collected and used personal data from millions of children under 13 without obtaining the required parental consent, posing significant risks to children’s privacy and safety.

Key Allegations

The complaint outlines several critical allegations:

• Bypassing COPPA Requirements: TikTok is accused of enabling children to bypass age verification and create accounts without parental consent by using third-party credentials from services like Google and Instagram. These “age unknown” accounts, which grew to millions, allowed TikTok to continue collecting data from children under 13.
• Failure to Notify Parents: TikTok allegedly failed to inform parents about the personal data it collected from children, including extensive app activity data and persistent identifiers. This data was reportedly used to build profiles on children and shared with third parties like Facebook to “retarget” users.
• Inadequate Account Deletion Processes: The complaint asserts that TikTok made it difficult for parents to delete their children’s accounts. Even when parents successfully navigated the complex process, TikTok often did not comply with deletion requests, maintaining and using children’s data unlawfully.
• Internal Concerns Ignored: Despite internal warnings from employees, including concerns about potential COPPA violations, TikTok allegedly continued its practices. One compliance officer noted that TikTok could face legal repercussions, yet the company did not take adequate action to rectify the issues.
• Violations of 2019 FTC Order: The lawsuit also claims that TikTok violated the terms of a 2019 consent order, which had been established to resolve previous COPPA violations related to TikTok’s predecessor, Musical.ly.

Legal Actions and Consequences

The FTC seeks:

• Permanent Injunction: To prevent further COPPA violations by TikTok and ByteDance.
• Civil Penalties: Financial penalties for each violation of COPPA, which could reach up to $51,744 per violation, per day.
• Enforcement of COPPA Compliance: The lawsuit aims to ensure that TikTok adheres to federal regulations, safeguarding children’s privacy on digital platforms.

The press release and the complaint are available here.