Marketers’ love affair with TikTok might be growing stronger by the day but so too are concerns over the social media giant’s data protection practices, with a new complaint alleging 18 separate violations of GDPR.
Dutch group Stichting Onderzoek Marktinformatie (SOMI), a non-profit privacy rights organisation, first aired its concerns about TikTok in September 2020 after filing a subject access request (SAR) to find out about the company’s data processing, on behalf of 60,000 parents.
The response to the SAR was deemed “insufficient” and, since then, TikTok has been officially reminded twice to provide the information but has failed to comply accordingly.
SOMI is also organising a class-action lawsuit against the company to seek compensation for its alleged failure to protect children and for stealing private data.
In January, SOMI filed a complaint with the Dutch data protection authority (Autoriteit Persoonsgegevens) on the grounds of TikTok’s illegal data processing and failure to protect children on its platform. Children under the age of 16 need permission from their parents to get a TikTok account, but SOMI claims age verification is easy to circumvent.
Concerns have been heightened following fatal incident with the so-called “blackout challenge” on TikTok, in which users let themselves suffocate for as long as possible while photographing themselves. Last month, a 12-year-old American boy died as a result of this challenge. Earlier this year, a 10-year-old Italian girl died from the challenge of a power outage, her parents said.
Now SOMI has filed a complaint with the Irish Data Protection Commission, demanding immediate action against TikTok’s mass violations of GDPR and to protect young people against what it brands “the continuous hazards emerging from the platform”.
Among the 18 violations of GDPR, SOMI claims that the most serious is that TikTok has no “instruments to verify the age of its users”.
“The app is even primarily aimed at children and TikTok is aware that many children are using their app, but it fails to take appropriate measures to verify the age of its users,” the letter to the Irish DPC states.
In a separate statement, SOMI said: “TikTok is home to many life-threatening challenges that has claimed the life of many youngsters. TikTok’s algorithm works in a way that spread these dangerous trends like wildfire. Risky videos attract more views, likes and comments, and more often it is shared on the page of others. The problem with these challenges is that being ‘viral’ and popular seem so attractive to young adults that are more prone to peer pressure.”
In its defence, TikTok claims user safety its “number one priority”. For example, user accounts between the ages of thirteen and fifteen are set to private by default, and their videos are not automatically seen by strangers. Moderators also block inappropriate videos and users can report offensive material.
However, as far back as 2019, the company was forced to pay $5.7m in a settlement in the US over allegations it “illegally collected images, voice recordings, and geolocation” of children, some younger than 13.
Last summer, the European Data Protection Board (EDPB) set up a task force to co-ordinate potential actions against parent company ByteDance and to acquire a more comprehensive overview of TikTok’s data processing and practices across the EU. The UK Information Commissioner’s Office is also investigating the platform, while the new UK “super-regulator”, the Digital Regulation Cooperation Forum (DRCF), has also put TikTok on notice.
And, in February this year, pan-European consumer body BEUC, whose UK partners include Which? and Citizens Advice, filed a complaint to the European Commission about TikTok.
The 44 member organisation claims a major investigation has exposed breaches of consumer rights on a “massive scale”. The main thrust of its complaint is that TikTok’s terms of service are “unclear, ambiguous and favour TikTok to the detriment of its users”, and the platform’s copyright gives TikTok the right to use, distribute and reproduce users’ videos without remuneration.
‘Super-regulator’ puts TikTok, AI and adtech on notice
TikTok in the dock again as privacy complaints mount
TikTok eyes home shopping bonanza with new features
WPP jumps aboard TikTok with global ad partnership
Oracle told not to ditch TikTok DNA as it wins US bid
Government balks at TikTok plans to build British HQ
TikTok whacked again over abuse of kids’ personal data
Clock ticking on TikTok as EU probes data compliance