TikTok will bolster its age-assurance standards and implement additional privacy safeguards for users under age 18. The move comes after the Office of the Privacy Commissioner of Canada and provincial data protection authorities from British Columbia and Alberta conducted a joint investigation into the social platform's privacy tools for children.
The inquiry determined TikTok did not maintain adequate safeguards to protect children's personal data under the Personal Information Protection and Electronic Documents Act.
TikTok does not allow individuals under age 13 to create an account. However, the regulators' investigation found minors were able to access the platform due to alleged deficiencies with TikTok's age verification mechanisms.
The platform deletes approximately 500,000 accounts belonging to underage users each year. Despite its efforts to ban users under 13, the investigation report states the company "was already collecting, inferring and using information about them to serve them targeted ads and recommend tailored content to them."
Investigation findings
Under the PIPEDA, companies cannot obtain meaningful consent from underage users for behavioral advertising. Information and Privacy Commissioner of Alberta Diane McLeod claimed TikTok's age verification shortcomings allowed children to receive advertisements that were not considered age appropriate.
McLeod raised concerns about targeted advertising for underage users, noting it can "increase identity theft, hinder healthy development, foster negative body images or early sexualization or reinforce gender stereotypes."
Children's online safety is a strategic priority for Canada's OPC, with a specific focus on protecting underage users from potentially harmful content and design choices. The primary goal of the TikTok investigation was to assess standards and "create a safer, more transparent online environment for children, where they feel empowered to exercise their privacy rights, and where they can learn and grow without compromising their privacy or security," Privacy Commissioner of Canada Philippe Dufresne said.
Another concern highlighted in the report was TikTok's use of sensitive biometric data collected from content created on the platform. According to the inquiry, the social platform obtains users' voice and facial analytics "to infer potentially sensitive information about users" for advertising purposes.
TikTok's commitments
In response to the report, TikTok agreed to implement three age assurance tools to keep underage users off the platform and increase transparency about its collection of sensitive personal and biometric data that can be shared with organizations, including those based in China. Canadian users will also receive a reminder to update their privacy settings.
The company will share additional information with consumers about its targeted advertising policies and will no longer serve targeted ads to users under 18 years old.
The DPAs will work together to ensure TikTok submits privacy impact assessments and various safety mechanisms in a timely manner.
"We're pleased with the undertakings that TikTok has taken to meet our recommendations," Dufresne said. "We are going to monitor the situation. There are some steps that they still have to take, and we've provided timelines for that. For the moment, we find that it's conditionally resolved."
If TikTok does not maintain its commitment to implement the changes, there are "tools in the legislation where, federally, I can take it to court and take an order from the court," Dufresne said. "That's what we're doing in other cases when there's a refusal to follow our recommendation. I don't want to have to do that. That's lengthy, that's expensive, so it is a positive result when the organization, like this case, agrees to the recommendations."
TikTok will provide provide monthly updates on its progress toward PIPEDA compliance.
Lexie White is a staff writer for the IAPP.
