Justice Department accuses TikTok of collecting children's data

The Department of Justice on Friday accused TikTok Inc. of knowingly violating the Children's Online Privacy Protection Act by illegally collecting data from children younger than 13, allowing them to bypass the social media platform's age gate and use sections of the application that's intended for older audiences.

TikTok disputed the allegations in a statement: "We disagree with these allegations, many of which relate to past events and practices that are factually inaccurate or have been addressed."

According to the federal complaint filed in Los Angeles, the government claims, "Since at least March 2019, defendants have offered in the United States what they refer to as TikTok for Younger Users or 'Kids Mode' to children who identify themselves as being under 13 when they create an account, and a regular TikTok experience for other users. However, defendants have knowingly allowed children under 13 to create accounts in the regular TikTok experience and collected extensive personal information from those children without first providing parental notice or obtaining verifiable parental consent, as required by the [Children's Online Privacy Protection Act]," U.S. v. ByteDance Ltd. et al., 2:24-cv-06535 (C.D. Cal., Aug. 2, 2024).

The act was enacted in 1998 to protect the safety and privacy of children online by prohibiting online operators from collecting information from children younger than 13 years old without legal permission. The law went into effect in 2000 and requires operators of websites and other online services to meet specific requirements before collecting, using or disclosing children's personal information online, such as providing clear parental notice of its information practices and data collection disclosures.

In a statement from the Justice Department, Principal Deputy Assistant Attorney General Brian M. Boynton said, "This action is necessary to prevent the defendants, who are repeat offenders and operate on a massive scale, from collecting and using young children's private information without any parental consent or control."

The case is being prosecuted by the Justice Department's Assistant Directors Rachael L. Doud and Zachary A. Dietert and Trial Attorneys Benjamin A. Cornfeld and Marcus P. Smith of the Civil Division's Consumer Protection Branch.

However, TikTok claims the company has been, and continues to be, proactive with its implementation of strict safeguards to protect minors from unauthorized use of its platform. "We are proud of our efforts to protect children, and we will continue to update and improve the platform. To that end, we offer age-appropriate experiences with stringent safeguards, proactively remove suspected underage users, and have voluntarily launched features such as default screentime limits, family pairing and additional privacy protections for minors," the company's statement read.

Additionally, the government attorneys alleged TikTok failed to keep records required by a 2019 permanent injunction where the company promised to notify parents of unauthorized collected data and remove content when a parent requests deletion in compliance with the online children protection law.

In the government's 2019 case against Musical.ly Inc. - which rebranded as TikTok in 2019 - the social media company settled with the Federal Trade Commission after agreeing to pay $5.7 million for similarly alleged Children's Online Privacy Protection Act violations. U.S. v. Musical.ly Inc., 2:19-cv-01439 (C.D. Cal., filed Feb. 27, 2019).

"Between February 2019 and July 2022, for example, defendants collected over 300,000 problem reports from users in Kids Mode that included children's email addresses. Defendants did not delete these children's email addresses after processing the reports, and thus retained these email addresses longer than reasonably necessary to fulfill the purpose for which the information was collected, in violation of the rule. ... Defendants did not notify parents of this ongoing practice."

The government claims TikTok uses this practice that allows "millions of children" to create general accounts outside of Kids Mode without parental consent while maintaining an "unreasonable" process for parents to request deletion of their children's data.

"Parents must navigate a convoluted process to figure out how to request deletion of their child's account and information. For example, as recently as 2023, a parent visiting TikTok.com to request deletion of their child's TikTok account and information had to scroll through multiple webpages to find and click on a series of links and menu options that gave no clear indication they apply to such a request," the complaint stated. "Even if a parent succeeded in submitting a request to delete their child's account and information, defendants often did not honor that request."

The government claims when TikTok did delete a child's account, the company did nothing to prevent them from creating a new account using the same device and previously used identifiers such as email addresses and phone numbers.