TikTok fined €345 million in data privacy case partially launched by Dutch regulator

TikTok was slapped with a fine of 345 million euros by the Data Protection Commission in Ireland for failing to protect children's data and the social media platform's underage users. The fine was determined on September 1, and was publicly announced on Friday. The case was partly launched at the request of the Dutch Data Protection Authority following its own investigation into the platform two years ago.

The fine was handed to TikTok Technology Limited, the platform's data controller for users in the European Economic Area and Switzerland since June 2020. The entity is officially based in Dublin. The Irish investigation covered the period from July 31, 2020, through the end of that year, to determine if TikTok was in compliance with the European Union's General Data Protection Regulation (GDPR), which specifically lays out requirements for handling the personal data of minor-aged users.

The Irish regulator found that TikTok violated ten different sections of GDPR. Among them, child users' accounts were set to public by default, giving anyone access to view content published by those minors, regardless if the viewer was logged into TikTok at the time. This not only endangered children from the age of 13, the intended minimum age of TikTok users, but also younger children who managed to use the social media service.

On top of that, adults could easily couple their accounts to that of a child's, even if the adult was not verified as a parent or guardian. Using TikTok's Family Pairing setting, the adult could then make it possible to exchange private messages with children from the age of 16.

Authorities in Ireland also said TikTok created an interface that pushed its users to accept options that were more invasive when creating an account, and later when publishing videos. The company also was accused of being intentionally opaque when providing information to underage children about the platform and their accounts.

In a statement sent to media outlets, TikTok said that the concerns raised by the Irish Data Protection Commission (DPC) were already addressed at the start of 2021. “We respectfully disagree with the decision, particularly the level of the fine imposed,” a TikTok spokesperson stated. The company was considering its options to appeal the decision.

"The DPC's criticisms are focused on features and settings that were in place three years ago, and that we made changes to well before the investigation even began, such as setting all under 16 accounts to private by default."

In 2021, the Dutch Data Protection Authority fined TikTok 750,000 euros for only providing a privacy statement written in English to children in the Netherlands. The investigation into TikTok "revealed more privacy problems at the time," which emerged in the Irish case, the Dutch authority said on Friday.

Ireland was then asked to review the Dutch authority's initial findings, to conduct its own investigation, and to impose a sanction if enough evidence emerged to do so. Dutch authorities made the request because TikTok had opened its office in Ireland in 2020. The Dutch Data Protection Authority was "no longer authorized to make a decision about a large part of the investigation's findings."

"This case shows how privacy regulators in Europe are jointly taking a stand against large tech companies that violate privacy," said Dutch Data Protection Authority Chair Aleid Wolfsen. "Even when those companies open a head office in another European country during an investigation."

Last year, a draft of the Irish Data Protection Commission's decision was submitted to all relevant supervisory authorities in Europe. An objection raised by the authority based in Berlin led to the determination that TikTok violated rules by using "dark patterns" to push people to make decisions that were invasive with regard to their privacy. The Italian authority also objected, saying that TikTok did not comply with age verification rules. Their objection was not adopted in the final draft.