The Irish Data Protection Commission (DPC) has fined video-sharing platform TikTok €345m for breaches related to the processing of children's data.
It follows an investigation which began in September 2021 and focussed on the period from July to December 2020.
The inquiry examined certain TikTok settings as they related to child users.
It also looked at the processing of the personal data of children under the age of 13, in particular for age verification purposes, as part of the registration process.
The investigation found that "public-by-default" settings led to child accounts being automatically set to public rather than private.
A feature called "Family Pairing" meant a child's account could be "paired" with an unverified non-child user but TikTok did not verify whether this user was actually the child's parent or guardian.
Non-child users had the power to enable direct messages for child users above the age of 16, thereby making this feature less strict for the child user.
The DPC found that TikTok did not properly take into account the risks posed to children under 13 who gained access to its platform by the default account setting which allowed anyone, on or off TikTok, to view social media content posted by those users.
"The decision records that, because of this, TikTok did not implement appropriate technical and organisational measures to ensure and to be able to demonstrate that the foregoing processing was performed in accordance with the GDPR (General Data Protection Regulation)," the DPC found.
We need your consent to load this rte-player contentWe use rte-player to manage extra content that can set cookies on your device and collect data about your activity. Please review their details and accept them to load the content.Manage Preferences
TikTok said it disagrees with the ruling and added that the features at issue have already been changed.
"We respectfully disagree with the decision, particularly the level of the fine imposed," a TikTok spokesperson said.
"The DPC's criticisms are focused on features and settings that were in place three years ago, and that we made changes to well before the investigation even began, such as setting all under 16 accounts to private by default," the company said.
After the DPC submitted its draft findings to its fellow European data watchdogs, two supervisory authorities raised objections.
The European Data Protection Board subsequently directed that the DPC include a new finding of infringement and extend the scope of its order. It did not order the Irish data watchdog to increase the proposed fine.
As well as the €345m fine, TikTok has been issued with a reprimand and an order requiring the platform to bring its data processing into compliance.
Helen Dixon, the Irish Data Protection Commissioner said she is pleased to have concluded the investigation.
She added that she is satisfied that significant enforcement measures are warranted.
"Alone the fine of €345m is a headline sanction to impose but reflects the extent to which the DPC identified child users were exposed to risk in particular arising from TikTok’s decision at the time to default child user accounts to public settings on registration," Ms Dixon said in a statement.
"The result of this public-by-default setting of accounts meant that anyone – either on or off the TikTok platform – could view the social media content of child users and interact with those users via comments on a video.
"Child users were not adequately informed of the scope and consequences of the processing of their personal data on the platform," she added.
Reacting to today's fine, Alex Cooney, Chief Executive of CyberSafeKids said she believes the fine is appropriate and proportionate, given the billion in profit that TikTok makes annually,
"They need to do much more to address the issue of underage users on their platform and to protect child users from harmful content," she said.
"Our most recent data shows that 37% of 8-12 year olds are using TikTok, so the platform's failings represent a clear danger to a large number of Irish children."
A separate DPC investigation into data transfers to China by TikTok is continuing.
A draft ruling is expected in that case by the end of the year.
