TikTok Faces Lawsuit Over Children’s Privacy Violations (2024)

The US Department of Justice and Federal Trade Commission (FTC) filed a civil lawsuit against TikTok’s parent company Bytedance for violating the Children’s Online Privacy Protection Act (COPPA), on 2 August in the U.S. District Court for the Central District of California. The lawsuit alleged that TikTok knowingly collected and retained large amounts of personal information from children without consent and failed to take down their accounts. It accused TikTok of complicating the deletion process for parents and selling children’s data to third-party services.

COPPA mandates that social media platforms acquire parental consent prior to collecting, using, or disclosing children’s personal information. The platform must also delete the data, at the parent’s request. Parents should also be able to easily navigate the data the platform collects.

The US Government previously won a lawsuit against TikTok (then Musically) and fined the social media platform a $5.7 million civil penalty, in 2019. The Court subsequently ordered it to destroy the personal information of users under the age of 13. The platform was also directed to remove accounts of users whose age could not be identified, by May 2019. The 2024 lawsuit also accused the company of misrepresenting its remedial conduct to the FTC and continuing to be inconsistent with COPPA. Tiktok has been facing scrutiny for its data collection practices and its alleged ties to China, after the US law banning it from app stores was signed in March this year.

What are the allegations against TikTok?

Allowed users to bypass agerestrictions

TikTok directs users to “Kids mode” if the birth year they enter indicates they are below 13. In Kids mode, a user can view videos but cannot create or upload videos, post information publicly, or message other users. TikTok does not notify parents or obtain parental consent for Kids Mode accounts and still collects and uses certain personal information from children in this mode.

However, it claimed that TikTok does not restrict the same underage user if they restart the account creation process and enter a birth year indicating they are 13 or older, allowing them to bypass the age-restricted version of TikTok.

Failed to comply with COPPA Even for Accounts in “Kids Mode”

TikTok collects and maintains a username, password, birthday and other unique identifiers including IP address and unique device identifiers in Kids Mode, without notifying parents or obtaining their consent. It also collected children’s email addresses for its “report” feature and failed to delete them when informed by parents, the lawsuit alleged.

Platforms can collect some identifiers of children under certain circ*mstances without first obtaining verifiable parental consent, under COPPA Rule. However, this is only applicable if it is necessary for a platform’s internal operations. The lawsuit said that this rule was not applicable to TikTok.

Failed to delete children’s accounts and data despite requests

In many cases TikTok did not respond to parents at all, the Government alleged. In cases where they did delete a child’s account and personal information at their parent’s request, they did nothing to prevent the same child from re-creating their account with the same device. It allegedly also retained children’s personal information long after they identified an account and deleted the information. The lawsuit also stated that it stored this information in various database locations, but kept no record of this.

Implemented a convoluted process for parents to navigate

The lawsuit also alleged that TikTok failed to create a simple process for parents to submit a deletion request. Parents were allegedly directed to submit their requests to delete their children’s accounts and personal information through email. TikTok’s policy would identify an underage account and delete it only if it had an explicit admission that the user was under 13. For example, the user must say, “I am in first grade” or “I am 9 years old.” The only appeal process users had was to sign a form, confirming their relation to the child and their request for deletion.

Sold children’s data to third-party advertisers

The US Government accused TikTok of collecting other types of information—including app activity data, device information, mobile carrier information, and app information, “to amass profiles on children.” They alleged that TikTok shared this information with Facebook and AppsFlyer, a marketing analytics firm, to encourage existing Kids Mode users whose use had declined to use TikTok more frequently. They called this process “retargeting less active users.” Parents were neither notified of this practice nor was their consent obtained.

Ignored own moderators

TikTok allegedly provided limited time resources to its human moderators to flag content and often did not take down the content they flagged. They also allowed moderators to only view reported videos, and no other videos on the account, further complicating the process.

Failed to Keep Records Required by the 2019 Permanent Injunction and misrepresented itself to the FTC

The 2019 Permanent Injunction required TikTok to create and maintain all records necessary to demonstrate full compliance with the injunction. However, the lawsuit alleged that it failed to record instances of COPAA violations even when internal staff informed them, citing internal communications between employees. Employees also used the “recall” feature to incorporate messaging and office collaboration platform Feishu, allowing them to potentially delete internal communications about said violations.

TikTok also told the FTC, in a hearing in June 2020, that it had deleted all the data required by the injunction on May 24, 2020. However, in a follow-up inquiry by the FTC, it admitted to having retained and been using data that it had previously claimed to have deleted.

After a follow-up inquiry by the FTC, TikTok Inc. acknowledged that its June 12, 2020, claims had been false. In fact, it had allegedly retained and used the data that it had previously claimed to have deleted and lost access to.

TikTok ban in the US

In March, the US passed the “Protecting Americans from Foreign Adversary Controlled Applications Act” thatpenalizes app stores in the country from listing TikTok or any other application developed or provided by TikTok’s parent company ByteDance.It applies to apps domiciled or subject to the directions/control of a foreign adversary country. The Act allows “qualified divestiture” of TikTok’s US business from China, as an alternative to the ban.

This bill followed US President Joe Biden’sexecutive orderto prevent large-scale transfers of Americans’ sensitive personal data to ‘certain countries of concern’, like China, Bytedance’s country of origin.

TikTok started routing American users’ data to US-based servers owned by Oracle to ease concerns around potential data sharing with Chinese authorities, in 2022. However, TikTok’s chief executive officer, Show Zi Chew, wasquestionedby lawmakers about the company’s data practicesin 2024. Chew claimed that the company had started a data deletion plan for US data. However, concerns were raised if this data was shared with Chinese intelligence services.

TikTok has since challenged the law in Court, arguing that it violates the Freedom of Speech of American users. It also claimed that the US did not take into account its presentations given to the Committee on Foreign Investment in the US (CFIUS), plans on how to mitigate concerns about US data being improperly accessed and a floor plan on creating a “transparency centre” in collaboration with Oracle.

For You

Have something to tell us? Leave an Anonymous Tip
Ask us to File an RTI
Sponsor a MediaNama Event