FTC Enters Consent Decree with TikTok and Issues Largest-Ever Fine Under COPPA

On February 27, 2019, the Federal Trade Commission (FTC) entered into a consent decree with video-sharing service TikTok, wherein TikTok agreed to pay $5.7 million for alleged violations of the Children’s Online Privacy Protection Act (COPPA). This consent decree marks the largest fine to date issued under COPPA.

TikTok is a platform that allows users to create and share short videos and to connect with other users. The FTC targeted TikTok for collecting the name, phone number, and email address of users under the age of 13. In addition, through the app’s messaging system, concerns arose that adults could reach out to children directly. Further, the FTC alleged that between 2014 and late 2016, there was a feature that allowed users to see a list of other users within a 50-mile radius of their city.

The FTC’s complaint alleged that TikTok had actual knowledge that it was collecting information from children since 2014, in part due to receiving thousands of parental complaints, but had failed to remediate its services to comply with COPPA. Under COPPA, services that are directed to children must assume the person uploading content is a child and design systems to either give notice and obtain prior parental consent, remove child images and metadata prior to posting, or create a special area for posting by adults.

Under the consent decree, TikTok must stop collecting information from children and must delete the personal information of children that it currently has. In compliance with the duty to stop collecting information from children, TikTok has updated its app to differentiate services based on age information collected upon registration. This “age gate” means users who indicate they are under 13 will now only be allowed to like content and follow other users, but may not post their own content or use the messaging system.

While no individual corporate officer liability has been implicated in this instance, two FTC commissioners released a joint statement indicating a desire to pursue corporate officer liability in the future for these types of violations.

TIP: Take proactive steps to understand your customer base and identify whether users fall under the protections of COPPA. If you gain actual knowledge that users are under the age of 13, ensure you take the proper steps to protect the information of those users, which includes more than simply deleting the child’s account.