TikTok, the Chinese-owned social media platform, has been slapped with a hefty €345 million fine by a European Union regulator for violating child data protection rules, marking the latest in a series of sanctions against tech giants.
The Irish Data Protection Commission (DPC), a key EU regulatory body responsible for ensuring compliance with EU rules, imposed this fine on TikTok Technology Limited. In addition to the financial penalty, TikTok is required to adjust its operations to comply with the regulations within three months, as stated in a press release by the DPC.
The Irish regulatory authority initiated an investigation into TikTok’s practices in September 2021. The investigation covered practices between July 31 and December 31, 2020. TikTok boasts 134 million users in the EU, making it a significant platform for the investigation.
The regulator’s decision was primarily based on the fact that TikTok’s registration process for users under 18 years old defaulted their accounts as public. Another issue was the “family pairing” feature on TikTok, which allows the linkage of a teenager’s account to that of their parent without proper verification of the relationship.
The DPC did not find any violations in TikTok’s age verification steps for preventing users under 13 years old from signing up, but it noted that the platform inadequately assesses the risks faced by younger users.
TikTok has responded to the fine, stating that it “respectfully disagrees” and is “evaluating” its next steps. The company asserted that the criticisms by the DPC concern functions and settings that were in place three years ago and have since been changed. For instance, TikTok sets all accounts of users under 16 years old to private by default.
TikTok’s European headquarters are located in Dublin, Ireland, alongside other tech giants like Google and Meta (formerly Facebook). Earlier this year, the DPC imposed a record €1.2 billion fine on Meta for transferring EU user data to the United States in violation of a court ruling.
The General Data Protection Regulation (GDPR), enacted by the EU in 2018, is one of the strictest technology laws globally, ensuring that individuals provide explicit consent for the use of their data.