The Irish Data Protection Commission (DPC) has imposed a substantial administrative fine of 345 million euros on the short-form video hosting platform TikTok.
This action comes as a result of TikTok’s violations of the European Union’s General Data Protection Regulation (GDPR) in handling the personal data of children.
The investigation primarily centered on several aspects of TikTok’s operations, including its default settings, family pairing feature, and age verification procedures during registration. The final decision was officially reached on September 1, with a public release issued on September 15.
The DPC’s inquiry revealed that TikTok had breached multiple provisions of the GDPR. As a consequence, the company has been instructed to align its data processing practices with GDPR requirements within a three-month period from the date of the decision.
The investigation also assessed TikTok’s age verification procedures for users under 13 years old and found no immediate infringements. However, it was noted that the platform had not adequately assessed the potential risks associated with younger users registering on the service.
One notable point raised in the DPC’s ruling was the default setting for TikTok accounts of children, which were set to “public” by default. This meant that anyone could view or comment on the content shared by these young users.
Additionally, the DPC criticized TikTok’s “family pairing” mode, designed to connect parents’ accounts with those of their teenage children. The DPC found that TikTok had not verified the parental or guardian status of users participating in this feature.
Ireland holds a central role in the GDPR framework because it hosts the European headquarters of TikTok, as well as major tech companies such as Google, Meta (formerly Facebook), and X (formerly Twitter).
TikTok, a subsidiary of the Chinese tech giant ByteDance, enjoys immense popularity among young people, boasting 150 million users in the United States and 134 million in the European Union.
In response to the fine imposed on Friday, TikTok expressed its disagreement with the verdict, stating that it is currently evaluating its next steps. TikTok also noted that the DPC’s criticisms primarily concern features and settings that were in place three years ago, many of which have since been modified, such as setting all accounts of users under 16 to private by default.
