TikTok to face the music for possible children’s data breach

A 12-year-old British girl is planning legal action against video-sharing giant TikTok, in a case which could have major repercussions for social media companies and their tens of millions of UK users.

The girl claims the platform, which has seen a large rise in popularity during lockdown, is using children's data unlawfully. Her action is being supported by Anne Longfield, the Children's Commissioner For England. 

Ms Longfield believes TikTok are in breach of UK and EU data protection laws and hopes the case will lead to greater protective measures for under-16s who use TikTok in England and possibly beyond.

Specifically the case is set to focus on how the app collects and processes children's data to power its video recommendation algorithm, to capture viewers' attention and generate advertising revenue. And it is also likely to scrutinise how much effort the company makes to check the age of those signing up to join. 

David Sant, a data protection expert at Harper James Solicitors, had this to say on what could now emerge as a landmark legal case:

'If TikTok loses this case, it will reinforce that social media companies operating in the UK are not able simply to rely on age restrictions in their terms and conditions to protect them from the obligations to process children’s data lawfully, fairly and transparently.

Under the UK’s data protection laws, TikTok needs to establish a lawful basis for collecting and processing personal data. When it comes to children, the options are more limited than for adults. For example, children under the age of 13 can’t consent to data processing (an adult must consent on their behalf). And the other lawful bases (such as performing a contract or relying on legitimate interests) might not be available for young children.

TikTok claims that they don’t allow under-13s to join their platform. But this case will test whether TikTok goes far enough to verify the age of children and whether it needs to take steps to obtain an adult’s consent. In 2019, the US Federal Trade Commission fined TikTok $5.7m for breaches of similar obligations.

If the claimant is successful, the case could have serious implications for the kinds of checks that social media platforms and other websites must put in place before they grant access to children. And that could create significant barriers to some online platforms growing their popularity amongst children.

The Information Commissioner’s Office (ICO) has recently published an Age Appropriate Design Code (also called the Children’s Code) which sets out standards that websites and online services will need to meet. Organisations have until 2 September 2021 to comply. For example, website operators must ensure that privacy settings default to high privacy.

If companies don’t comply with the code, the ICO says that they will risk regulatory action and could find that organisations are in breach of data protection and marketing laws.'

Have you got data protection on your mind? Find out more about how our privacy and data lawyers can help to safeguard your business.