Dive Brief:

• The popular short-video platform TikTok knowingly allowed children under 13 to open regular accounts, giving them access to age-restricted content and exposing their personal information to the company and its advertisers in violation of a federal privacy law meant to protect children, the Department of Justice alleges in a lawsuit filed in federal court Aug. 2.
• “With this action, the Department seeks to ensure that TikTok honors its obligation to protect children’s privacy rights and parents’ efforts to protect their children,” says Benjamin Mizer, DOJ acting associate attorney general.
• The company says it disagrees with the allegations and that much of what is detailed in the complaint is past practice. “We offer age-appropriate experiences with stringent safeguards [and] proactively remove suspected underage users,” the company says in a statement it posted on X.

Dive Insight:

The Children’s Online Privacy Protection Act was passed in 1998 and is one of the few comprehensive federal data privacy laws on the books. 

DOJ accuses the company and its parent, ByteDance, along with affiliates, of violating COPPA by allowing children under 13 to skirt age restrictions to open regular accounts and using their data in ways prohibited by the law. The company has also made it hard for parents to get childrens’ accounts deleted, the complaint says.  

“Defendants have violated COPPA and the COPPA Rule …  by (1) knowingly creating accounts for children and collecting data from those children without first notifying their parents and obtaining verifiable parental consent; (2) failing to honor parents’ requests to delete their children’s accounts and information; and (3) failing to delete the accounts and information of users they know are children,” the complaint says.  

The complaint highlights an internal communication last year from the company’s top child safety executive that the company was treading on risky ground by requiring parents to respond to a request that they submit a form by email to get their child’s account deleted, even though to first get that email request they had to submit all of the same information to the company in another online form.

Under this process, if a parent verifies in an online form that their child is under 13 but doesn’t take the second step of submitting the same information in an email, the company risks leaving the account in place despite having information confirming the account holder is under 13. 

“Why [do] we reply with this template everytime [sic] when we already have all the info that’s needed?” the child safety executive said in the communication, according to the complaint. “[I]n this case, we already have the username, the name of the reporter, and the age, yet we still reply with the template.” 

This leaves the company exposed to a COPPA violation if the parent doesn’t follow up with an email. 

“If the person reporting the account ‘doesn’t reply then we have actual knowledge of underage user and took no action!’” the complaint reports the executive saying. 

TikTok has about 170 million users in the United States, and a large portion of them are children. The complaint estimates that millions of children under 13 have regular accounts. They were able to open them by saying they’re older than 13, even if they were previously rejected for saying they were under 13, or by opening an account through Google or Instagram.  

In addition to exposing them to age-restricted content and making their personal data available, the regular accounts mean other account holders can engage them in chat. 

Even in the way it handles the data of children under 13 who have appropriate age-restricted accounts the company violates COPPA, the complaint says, because of the way it collects and combines data with other sources. 

The company is also accused of violating a 2019 court order under which the company was supposed to align its processes to COPPA requirements.

“This action is necessary to prevent the defendants, who are repeat offenders and operate on a massive scale, from collecting and using young children’s private information without any parental consent or control,” Brian Boynton, DOJ’s principal deputy assistant attorney general, said in a statement.