Three-pronged probe into abuse of children's privacy

The Information Commissioner’s Office is launching three separate investigations into how TikTok, Reddit and Imgur protect the privacy of their child users in the UK, amid growing concerns over young people being served inappropriate or harmful content.

The investigation into TikTok is considering how the platform uses personal information of 13- to 17-year-olds in the UK to make recommendations to them and deliver suggested content to their feeds.

This is in light of growing concerns about social media and video sharing platforms using data generated by children’s online activity in their recommender systems.

The ICO’s investigations into Imgur and Reddit are considering how the platforms use UK children’s personal information and their use of age assurance measures.

Age assurance plays an important role in keeping children, and their personal information, safe online. There are tools or approaches that can help estimate or verify a child’s age, which then allow services to be tailored to their needs or access to be restricted.

The investigations are part of the regulator’s efforts to ensure companies are designing digital services that protect children.

At this stage, the ICO is investigating whether there have been any infringements of data protection legislation. If it finds there is sufficient evidence that any of these companies have broken the law, it will put this to them and obtain their representations before reaching a final conclusion.

The ICO maintains it has driven significant change in the way companies approach children’s online privacy since the Children’s Code came into force in 2021.

In the past year, it has focused on forcing further improvements in how social media and video sharing platforms protect children’s personal information online.

As a direct result of its regulatory intervention: X has stopped serving ads to users under 18; removed the ability for under 18s to opt in to geolocation sharing; improved the public transparency materials available for under 18s; and created a dedicated help centre for child users and parents.

Meanwhile, Sendit has stopped automatically including geolocation information in children’s profiles, while BeReal has stopped allowing children to post their precise location online. These changes can help keep children safer in the physical world.

And, Viber has committed to turn off personalised advertising for children, ensuring that children’s default advertising experience is not based on their behavioural data or profiles.

The regulator said it will be working closely with Ofcom, which has responsibility for enforcing the Online Safety Act, to ensure their efforts are coordinated.

Information Commissioner John Edwards said: “We welcome the technology and innovation that companies like social media bring to the UK and want them to thrive in our economy. But this cannot be at the expense of children’s privacy.

“My message is simple. If social media and video sharing platforms want to benefit from operating in the UK they must comply with data protection law.

“The responsibility to keep children safe online lies firmly at the door of the companies offering these services and my office is steadfast in its commitment to hold them to account.

“I also want to take this opportunity to assure children, parents and carers in the UK that we are working on their behalf to make the online world a safer place.

“In announcing these investigations, we are making it clear to the public what action we are currently taking to ensure children’s information rights are upheld. This is a priority area, and we will provide updates about any further action we decide to take.”