What Companies Can Learn From TikTok’s Privacy Troubles with Tweens
Notwithstanding its negative effects on the world at large, COVID quarantine has been a boon to a growing group of entertainment-based apps and services. Netflix, Amazon, Zoom and Instagram are just the best-known apps that many have turned to break the monotony of pandemic-induced isolation. TikTok is also on the list of apps experiencing a surge in user activity, though chances are that your kids are more likely to have participated in a viral TikTok dance challenge than you. Unfortunately for the Chinese-owned company, this popularity among the tween-and-under set is the source of its ongoing struggles with privacy advocates.
Last week, 20 consumer and privacy advocacy groups, led by the Campaign for a Commercial Free Childhood, joined together to file an FTC complaint accusing TikTok of particularly egregious privacy lapses relating to children. The 56-page complaint details, among other things, TikTok’s alleged failure to obtain parental consent before collecting children’s data and to delete children’s data upon request. TikTok shouldn’t be surprised by the complaint, facing similar allegations in early 2019 they settled with the FTC for $5.7 million. Central to both complaints is the ease with which users under 14 are able to circumvent the app’s age controls.
For those building a privacy compliance program, the complaint is instructive on exactly how to avoid the ire of these advocacy groups. For example, the complaint points out that once an underage user realizes that age restrictions have been imposed on their account, they can simply create a new account, from the same device, using a fake birthdate. TikTok could have avoided this problem by using device IDs to require additional parental consent verification, by providing a credit card for example, on those devices on which an underage account was previously created.
Another interesting tidbit included in the complaint is an appendix detailing particularly egregious user accounts. The youngest user identified in the exhibit was just 4 years old. Despite this evidence of infant-adjacent users, one of TikTok’s defenses is that it is targeted at an older audience. The lesson for industry may be: know your users, and act accordingly.