TikTok fined $5.7 million for illegally collecting data from children

The hugely popular video-sharing app's 'disturbing practices' have been described as 'a willingness to pursue growth even at the expense of endangering children'

Chinese short-form video-sharing app TikTok is under fire for filtering out videos deemed insufficiently attractive to them. AFP

The operators of video social networking app TikTok have been handed the largest-ever fine for a US case on children's data privacy. The company has agreed to pay $5.7m (Dh21m), after the Federal Trade Commission (FTC) found it had knowingly hosted content published by underage users.

It had also illegally held the data of children, including their email address, phone number, username, first and last name, a short biography, and a profile picture.

According to the landmark ruling, the app formerly known as Musical.ly (which was later acquired and incorporated into TikTok), had been aware a "significant percentage" of their database were younger than 13, and had received thousands of complaints from concerned parents of children with TikTok accounts.

There have also been public reports of adults trying to contact children via the app.

As a result, TikTok was ordered to delete all the data of users aged under 13, as well as implement more regulations going forward.

In fact, as of Wednesday, the day the ruling was announced, TikTok users in the US are newly required to verify their age when they open the app. The company had pledged to introduce a raft of other measures to cater to users who say they are under 13 as part of the ruling.

“The operators of Musical.ly – now known as TikTok –  knew many children were using the app but they still failed to seek parental consent before collecting names, email addresses, and other personal information from users under the age of 13,” FTC chairman Joe Simons says.

“This record penalty should be a reminder to all online services and websites that target children: We take enforcement of COPPA [the Children's Online Privacy Protection Act] very seriously, and we will not tolerate companies that flagrantly ignore the law.”

As a direct response, TikTok announced a "separate app experience" that comes with extra privacy protections for young users.

The Chinese app has become something of a phenomenon internationally since its inception in September 2017.

Storming the downloading charts with lightning speed, it quickly became one of the most downloaded apps across the world, surpassing even Facebook, Youtube and Instagram, and as of July 2018, boasted over 500 million users globally.

In the UAE, it was among the top one or two downloads in the Google Play store and Apple's App Store for much of 2018 and early 2019, but has since slipped to seventh and eight, respectively, according to SimilarWeb.

What exactly is Tiktok?

The app allows users to upload brief clips (up to 15 seconds) set to music, often with the creator lip-syncing along. These videos can then be enhanced by a range of editing features, such as Snapchat-like augmented-reality filters and the option to speed up and slow down the footage. There is also scope for collaboration between users – if you reply to a video, you can do joint videos on a split screen. Some creators have tens of millions of followers.

In 2017, Chinese internet company ByteDance, the world’s most valuable start-up at $75bn, bought Musical.ly, the music video-sharing app, for $1bn (Dh3.6bn), merged it with an existing video app, and relaunched it as TikTok.

This led to the Chinese tech giant recently surpassing Uber as the world’s most valuable start-up, due in no small part to its burgeoning role in emerging markets.

How has TikTok protected its users' privacy until now?

So, how do you see these videos, you may ask? You follow people, just like you would on Instagram or Twitter, and then their videos will pop up on your feed.

­Privacy-wise, there are only two, quite restrictive, options: you can either make your videos private, only to you, or public to everyone else on the app. There is no option to open up your content to only a few of your friends. In terms of private messaging, you can share messages only with your TikTok friends, not with those who aren’t a connection.

The crux of the FTC's complaint was the fact that for the first three years of its existence, TikTok did not ask for a user's age. When the age query was implemented, however, it did not backtrack and ask for the ages of all of its incumbent users.

This resulted in a large database of children using the service who were under 13 – the age until which, under United States law, websites and online services must gain parental consent before collecting a user's personal information.

Bios, pictures and phone numbers – how TikTok collected childrens' personal information

According to the FTC's ruling, which was released on its website, there were a raft of accusations levelled at the app.

For starters, to register, Musical.ly required users to provide an email address, phone number, username, first and last name, a short biography, and a profile picture.

As well as video sharing, the app allows users to interact with other users via direct message and comments. User accounts were public, "which meant that a child’s profile bio, username, picture, and videos could be seen by other users," the ruling said.

"While the site allowed users to change their default setting from public to private so that only approved users could follow them, users’ profile pictures and bios remained public, and users could still send them direct messages.

"In fact, as the complaint notes, there have been public reports of adults trying to contact children via the Musical.ly app. In addition, until October 2016, the app included a feature that allowed users to view other users within a 50-mile radius of their location."

The FTC notes that the company was aware a "significant percentage" of their database were younger than 13, and had received thousands of complaints from concerned parents of children with TikTok accounts.

According to the FTC ruling, TikTok didn't ask for the user's age for the first three years of its existence.

When it did start asking and preventing people under 13 from making accounts in July 2017, it did not go back and request information from those who already had accounts.

What does the FTC ruling mean?

Tiktok will now ask users in the US to verify their age when they open the app, but not those elsewhere in the world, as they argue the ruling only applies to the US.

However, this isn't a foolproof solution.

Like many social networks, age verification relies on the basis of trust; the person signing up isn't required to enter proof of their date of birth, so a user is able to easily lie to sidestep the rule.

As well as the hefty fine, TikTok was also ordered to comply with COPPA going forward, and to take all videos made by children under 13 offline.

In a joint statement from FTC commissioners Rohit Chopra and Rebecca Kelly Slaughter, the crack down was hailed as a "major milestone", after uncovering Tiktok's "disturbing practices".

"In our view, these practices reflected the company’s willingness to pursue growth even at the expense of endangering children.

"The agency secured a record-setting civil penalty and deletion of ill-gotten data, as well as other remedies to stop this egregious conduct. This is a big win in the fight to protect children’s privacy."

The statement goes on to say: "Executives of big companies who call the shots as companies break the law should be held accountable.

"As we continue to pursue violations of law, we should prioritise uncovering the role of corporate officers and directors and hold accountable everyone who broke the law."

Tiktok's response: a new app for younger users

"While we’ve always seen TikTok as a place for everyone, we understand the concerns that arise around younger users. In working with the FTC and in conjunction with today’s agreement, we’ve now implemented changes to accommodate younger US users in a limited, separate app experience that introduces additional safety and privacy protections designed specifically for this audience," a statement from TikTok said hours after the ruling was made public.

"The new environment for younger users does not permit the sharing of personal information, and it puts extensive limitations on content and user interaction. Both current and new TikTok users will be directed to the age-appropriate app experience, beginning today."

It also announced a new video tutorial series to educate users through the company's community guidelines, privacy settings, digital wellbeing tools and more.