TikTok – Privacy Enforcement in the U.S. and Canada is a Struggle

Children’s Privacy is at Stake 

THE PRIVACY REGULATORS 

The FTC recently announced that it is referring its investigation into TikTok to the Justice Department, with allegations that the social media app is violating children’s privacy regulations. 

In February 2019, the FTC announced that TikTok (then known as Musical.ly) agreed to pay $5.7 million to settle alleged violations of the Children’s Online Privacy Protection Act (COPPA). The commission was examining claims that TikTok and Beijing-based parent company ByteDance misled users by falsely claiming that individuals in China did not have access to U.S. user data. Referring a complaint to the DOJ civil division is the first step for the FTC to seek civil penalties against a company via lawsuit or settlement. Thus, the FTC remains concerned about TikTok’s  privacy and data practices. The Justice Department must now decide if it wishes to take the case on the FTC’s behalf or allow the FTC to handle the complaint. 

Meanwhile, in February of 2023, the Office of the Privacy Commissioner of Canada, along with along with the privacy protection authorities for Quebec, British Columbia, and Alberta, have been conducting a joint investigation into TikTok. We hope to see the report from that investigation very soon. The Canadian investigation will examine whether valid and meaningful consent is being obtained for the collection, use, and disclosure of personal information by TikTok, and whether TikTok’s practices associated with personal information of children and youth are appropriate. We can certainly predict the verdict. 

North America is not alone in concerns about the unacceptable burden put on children to make decisions about their privacy. In 2023 Irish Data Protection Commission has fined TikTok €345 million, and the UK’s Information Commissioner’s Office fined TikTok £12.7 million. Both regulators stated that it is also not realistic to expect adults to understand and be accountable for complex privacy consent forms. The DPA of France issued a fine against TikTok for breaking rules on cookie consent, and in 2020, South Korea’s telecommunications regulator also issued a fine for violations related to children’s privacy and overseas data transfer. 

CLASS ACTION LAWSUITS 

Privacy concerns are clearly significant and bountiful. TikTok makes child profiles public by default; does not provide users with easy to understand information about privacy; and does not obtain verifiable parent/guardian consent. In addition to regulator investigations, Tik Tok also has class actions to wrestle. In the US, several federal lawsuits against TikTok were consolidated into a class action before the US District Court for the Northern District of Illinois in 2020. The lawsuit had a nation-wide class and an Illinois state subclass. The nation-wide class alleged that without users’ consent, TikTok collected personal information (e.g. biometric data), disclosed video-related personal information to Facebook and Google and violated consumer protection laws. The Illinois subclass’s allegations included that TikTok harvested users’ biometric information without consent and sold it to third parties. A settlement was approved in March 2022, with TikTok agreeing to, among other things, pay $92 million USD to class members. 

In Canada, two class action lawsuits against TikTok were certified together for settlement purposes by the Supreme Court of British Columbia. The class members were TikTok users in Canada, with a subclass of minor users. The class members’ allegations included that TikTok collected, used, and sold to third parties, users’ personal information without their consent. The subclass also alleged that TikTok did not obtain parental consent for minors. A settlement was approved in February 2022, with TikTok agreeing to pay $2 million CDN in donations to a BC legal foundation and children’s charities. But this settlement did not cause a blink of an eye for the popular video sharing app.  

Regardless, TikTok did not admit to any wrongdoing in either settlement agreement. So now what? In the U.S., Congress can’t outright ban TikTok or any social media platform unless it can prove that it poses legitimate and serious privacy and national security concerns that can’t be addressed by any other means. President Biden did in fact sign a bill in April to force a sale of the video app or ban it. Now the law faces court challenges, a shortage of qualified buyers and an uproar from TikTok’s loyal audience. Trying times of children’s privacy in the on-line space, and regulators/data protection laws can only go so far. The TikTok privacy story is a perfect example of how international privacy work and government/regulator coordination are so desperately needed.