View Page As PDF
Share Button
Tweet Button
Last week, the Federal Trade Commission (FTC) fined TikTok a record $5.7 million for alleged violations of the Children’s Online Privacy Protection Act (COPPA). TikTok, formerly known as, operates a mobile application that allows users to share 15-second video clips set to music and to interact with other app users. TikTok agreed to settle the FTC action, paying the largest ever civil penalty imposed for a children’s privacy matter. 

The FTC alleges that TikTok was aware that many of the app’s users were under the age of 13, but failed to collect valid parental consent, as required by COPPA, for the collection of personal information from those children.

In order to register for the TikTok app, a user was asked to provide name, email address, phone number, username, a short biography, and a profile picture. Between December 2015 and October 2016, the app also collected geolocation information of the mobile devices of app users. This information constitutes “personal information” as defined by COPPA.

What is COPPA?

COPPA requires operators of websites and online services directed at children to meet specific requirements related to the collection of personal information from children. In addition to requiring parental consent, an operator is required to post a privacy policy on its website that describes what information is collected from children online, how such information is used and disclosed, and how the operator collects parental consent. COPPA also requires such information to be provided directly to parents before any personal information is collected from children. Personal information collected from children is to be retained only as long as is reasonably necessary to fulfill the purpose for which the information was collected, and is to be deleted upon parental request.

FTC complaint against TikTok

The FTC complaint against TikTok alleges that a “significant percentage of users are children under 13, and numerous press articles between 2016 and 2018 highlight the popularity of the App among tweens and younger children.” 

The FTC alleges that TikTok failed to:
  • Provide notice on the website of the information collected online from children.
  • Produce direct notice to parents of information collection and use practices.
  • Obtain consent from parents before collecting and using children’s personal information.
  • Delete personal information collected from children at the request of parents.
  • Retained personal information for longer than necessary to fulfill the original purpose. 
As part of the settlement, the app is required to comply with COPPA going forward, and to take offline all videos made by children under the age of 13.