FTC Fines Owners of TikTok App $5.7 Million for Illegal Collection of Children's Data

The fine is the largest ever in the U.S. for violations of children's privacy

Tiktok app Thomas Trutschel

The operators of the popular social networking app TikTok—formerly known as Musical.ly—will pay $5.7 million to settle a complaint from the Federal Trade Commission alleging that they illegally collected personal information from children without the consent of their parents.

The fine is the largest ever levied by the FTC for a violation of children’s privacy. In addition, TikTok's operators have agreed to comply with federal privacy laws going forward and to take offline any videos made by children under the age of 13.

More on Kids and Privacy

“This settlement makes it clear that businesses collecting information from children must put parents in the driver’s seat,” said Andrew Smith, director of the FTC’s Bureau of Consumer Protection, on a conference call with reporters.

“It’s not enough to just say that your service is meant for children over the age of 13, when it’s clear that a large portion of your users currently aren’t."

TikTok, which is owned by Chinese tech company ByteDance, allows users to create short lip-sync videos and post them on its network. The users can also interact with one another; commenting and liking videos or communicating via direct messages. It’s one of the most downloaded apps in the world; occupying top spots on both the Apple App Store and Google Play Store rankings.

TikTok's operators said in a Wednesday statement that they're making changes to accommodate younger U.S. users with a separate app featuring additional safety and privacy protections.

Going forward, younger users will be able to view videos in the app, as well as create and save their own videos to electronic devices, the operators say, but they won’t be able to share those videos through the app. All users—new and current—will be directed to their age-appropriate app beginning immediately.

The FTC's Complaint

The FTC charges that the app, which was known as Musical.ly until it was acquired by ByteDance in 2017 and merged with the company's TikTok app, collected names, email addresses, and other personal information from children under the age of 13.

In addition, users were asked to post a short biography and a profile picture. Accounts were set to “public” by default; allowing anyone to view the videos and personal details. And, even if a user changed the setting to “private,” which would allow only approved users to follow the account, the profile picture and bio remained visible to everyone. And the account holder could still receive direct messages from strangers.

Even more frightening, up until October 2016, the Musical.ly app let users see which other users were within a 50-mile radius.

But, despite sharing all of that information, the app didn’t first ask for the consent of the children's parents; something that’s long been required under the Children’s Online Privacy Protection Act (COPPA).

And the FTC says the app’s operators did this despite knowing that the app was popular with young children; pointing to thousands of complaints filed by parents of kids under the age of 13 who had set up accounts. And when parents demanded that their children’s data be deleted, the company failed to do so, the FTC says.

Sen. Edward Markey, D-Mass., one of the authors of COPPA, said in a statement that while this may be a record-high fine, it’s not high enough given the harm done to children and the need to deter other companies from doing the same thing.

“I urge the FTC to make COPPA enforcement a top priority and protect the privacy of a uniquely vulnerable class of Americans, our children," he said. "That means making companies pay higher monetary penalties that will actually incentivize COPPA compliance.”

What Parents Can Do

If anything, the settlement shows just how important it is for parents to keep an eye on what their children are doing online and who they’re sharing information with, the FTC's Smith said.

Here are some tips for doing that.

Talk to your kids. Children need to understand what’s appropriate behavior online and what can happen if they share their personal information with someone they shouldn’t.

“And this should be an ongoing dialogue, not a one-time conversation,” Smith said.

Keep an eye on your kids. Worried about keeping track of every app and social media network your child uses? Parental controls can help. They’ll let you block inappropriate content, as well as apps designed for adults. There are settings that can stop your child from sharing personal information, too.

And, finally, they’ll help you put limits on screen time; a task that many parents struggle with.

Don’t share your app store password. Make your child ask for permission before downloading an app. That way, you can review how age-appropriate it is. It keeps them from running up a tab with paid app purchases, too.

Bree Fowler

Bree Fowler

I write about all things "cyber" and your right to privacy. Before joining Consumer Reports, I spent 16 years reporting for The Associated Press. What I enjoy: cooking and learning to code with my kids. I've lived in the Bronx for more than a decade, but as a proud Michigan native, I will always be a die-hard Detroit Tigers fan no matter how much my family and I get harassed at Yankee Stadium. Follow me on Twitter (@BreeJFowler).