Britain's data watchdog fines TikTok $15.9 million for alleged misuse of children's data

The Information Commissioner’s Office estimated that the app allowed up to 1.4 million UK children under 13 use the platform in 2020.

Britain’s data watchdog fined the social media giant TikTok 12.7 million pounds, or roughly $15.9 million, on Tuesday for allegedly collecting the data of children under 13 without parental consent. The Information Commissioner’s Office estimated the app allowed up to 1.4 million U.K. children under 13 to use the platform in 2020. The regulator accused TikTok of failing to take the necessary steps to verify user identity and remove children under 13 from the platform.

The decision comes as TikTok faces enormous global scrutiny in both the U.S. and abroad over its privacy practices as well as its ties to China. Both U.K. and U.S. regulators have banned the use of the app on government devices and TikTok is now facing a potential full ban in the United States.

The ICO in Britain also accused TikTok of failing to properly inform all users on the platform about how their data was collected and used between 2018 and 2020. “Without that information, users of the platform, in particular children, were unlikely to be able to make informed choices about whether and how to engage with it,” the ICO press release states.

TikTok initially faced a $29 million fine, but regulators decided to drop a part of the initial findings that concluded TikTok had processed and misused revealing personal data.

“We all want children to be able to learn and experience the digital world, but with proper data privacy protections,” said ICO commissioner John Edwards. “Companies providing digital services have a legal duty to put those protections in place, but our provisional view is that TikTok fell short of meeting that requirement.”

TikTok disagreed with the findings. “We invest heavily to help keep under-13s off the platform and our 40,000-strong safety team works around the clock to help keep the platform safe for our community,” a TikTok spokesperson said in a statement to CyberScoop.

This isn’t the first time that a data protection authority has fined TikTok for allegedly violating the privacy of children under 13. In 2019, TikTok settled a $5.7 million fine brought by the Federal Trade Commission against Musical.ly, an app that later merged with TikTok, for allegedly violating U.S. law that requires companies gain parental consent before collecting the data of children under 13. In 2021, the Dutch Data Protection Authority fined TikTok 750,000 euros, or about $817,000 according to the recent exchange rate, for failing to provide privacy information in Dutch.

TikTok is far from the only social media company to attract the eye of regulators looking to shore up children’s privacy online. The ICO is currently looking at how 50 different online services comply with the British children’s data code and actively investigating six, according to the ICO press release.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure