FTC sues TikTok for alleged COPPA violations and privacy infringements

On August 2, 2024, just one day ago, the Federal Trade Commission (FTC) took significant legal action against TikTok, its parent company ByteDance, and affiliated entities. The Department of Justice, acting on behalf of the FTC, filed a lawsuit in the U.S. District Court for the Central District of California, alleging multiple violations of the Children's Online Privacy Protection Act (COPPA) and infringement of a 2019 consent order. This legal move marks a pivotal moment in the ongoing debate surrounding children's privacy in the digital age and the responsibilities of social media platforms.

The lawsuit accuses TikTok and ByteDance of flagrantly violating COPPA, a federal law designed to protect the privacy of children under 13 online. According to the complaint, the defendants failed to comply with COPPA's fundamental requirements: notifying parents and obtaining their consent before collecting and using personal information from children under 13.

FTC Chair Lina M. Khan emphasized the gravity of the situation, stating that TikTok's actions threatened the safety of millions of children across the country. The lawsuit alleges that ByteDance and TikTok were aware of their obligations under COPPA and the 2019 consent order but chose to prioritize growth and engagement over compliance and children's privacy.

The complaint outlines several specific allegations against TikTok and ByteDance. One of the most striking claims is that as of 2020, TikTok maintained a policy of keeping accounts of children under 13 unless specific, rigid conditions were met. The company's human reviewers reportedly spent an average of only five to seven seconds reviewing each account to determine if it belonged to a child. This cursory review process raises serious questions about the effectiveness of TikTok's age verification methods.

Furthermore, the FTC alleges that TikTok continued to collect personal data from these underage users without proper parental notification or consent. This data was allegedly used for targeted advertising, a practice that directly contravenes COPPA's provisions. The complaint also claims that TikTok built "back doors" into its platform, allowing children to bypass age verification measures and create accounts without providing their age or obtaining parental consent.

One particularly concerning allegation involves TikTok's handling of "age unknown" accounts. The platform allegedly allowed children to create accounts using credentials from third-party services like Google and Instagram, classifying these accounts as "age unknown." According to the complaint, these accounts grew to number in the millions, potentially exposing a vast number of children to privacy risks.

The lawsuit also addresses issues with TikTok's "Kids Mode" service, a supposedly more protected version for younger users. Despite marketing this as a safer alternative, the FTC alleges that TikTok still collected and used children's personal information in violation of COPPA. The complaint states that TikTok gathered more data than necessary, including information about children's activities on the app and multiple types of persistent identifiers, which were used to build profiles on children.

Another troubling aspect of the allegations involves TikTok's handling of parental deletion requests. The FTC claims that TikTok made it unnecessarily difficult for parents to request the deletion of their children's accounts and often failed to comply with these requests when they were made. The complaint cites internal communications suggesting that TikTok executives were aware of these issues but failed to address them adequately.

The lawsuit also alleges that TikTok violated the terms of its 2019 FTC consent order shortly after it went into effect. This order, which resulted from previous COPPA violations, was meant to ensure TikTok's compliance with children's privacy laws. The alleged disregard for this order suggests a pattern of non-compliance that extends beyond a single incident or oversight.

The complaint provides insight into TikTok's internal processes for identifying and removing children's accounts. It alleges that TikTok's keyword matching process and human content moderation practices were woefully inadequate. For example, content moderators were given rigid criteria for identifying underage accounts and were not allowed to consider other evidence that an account belonged to a child, such as videos posted by the user.

The FTC's action seeks significant penalties against ByteDance and TikTok, with potential civil penalties of up to $51,744 per violation, per day. Given the scale of TikTok's user base and the duration of the alleged violations, the total penalties could be substantial. Additionally, the FTC is asking the court to impose a permanent injunction to prevent future violations of COPPA.

This legal action highlights the challenges social media companies face in balancing rapid growth and user engagement with regulatory compliance and ethical considerations. It also underscores the importance of robust age verification systems and parental controls in platforms that attract young users.

The outcome of this lawsuit could have far-reaching implications for the tech industry, potentially setting new precedents for how social media companies handle children's data and privacy. It may also spur renewed discussions about the adequacy of current regulations and whether additional measures are needed to protect children in the digital space.

Key facts about the FTC lawsuit against TikTok and ByteDance

Filed on August 2, 2024, in the U.S. District Court for the Central District of California

Alleges violations of the Children's Online Privacy Protection Act (COPPA)

Claims infringement of a 2019 FTC consent order

Accuses TikTok of maintaining accounts of children under 13 without proper consent

Alleges inadequate age verification processes, with reviewers spending only 5-7 seconds per account

Claims TikTok collected and used children's data for targeted advertising without parental consent

Alleges difficulties in parental deletion of children's accounts

Details issues with TikTok's "keyword matching" and content moderation practices

Seeks civil penalties of up to $51,744 per violation, per day

Requests a permanent injunction to prevent future COPPA violations

Voted 3-0-2 by the FTC Commission to refer the complaint to the Department of Justice