
TikTok allegedly violated federal privacy law by
collecting “extensive personal information” from children younger than 13, the Department of Justice alleged in a lawsuit filed Friday.
The app, owned by the Chinese company
ByteDance, also allegedly failed to comply with the terms of its February 2019 Federal Trade Commission settlement over potential violations of the Children's Online Privacy Protection Act. That law
prohibits operators of websites and apps from knowingly collecting personal information from children under 13 without parental consent.
The new suit comes around six weeks after the FTC took
the rare step of publicly stating it had referred TikTok to the Justice Department over alleged violations of the children's privacy law.
A TikTok spokesperson said the company disagrees with
the allegations, adding that many “relate to past events and practices,” and “are factually inaccurate or have been addressed.”
advertisement
advertisement
The Justice Department's complaint, filed in U.S. District Court for the Central District of California, focuses on TikTok activity that occurred between March
2019 -- soon after it agreed to settle FTC charges -- and 2022.
The complaint, which also names ByteDance as a defendant, alleges that even though the app had a “Kids Mode” setting
for children under 13, TikTok allowed users 12 and under to bypass that setting and create non-Kids Mode accounts.
For instance, TikTok allegedly asked people who signed up for new accounts to
provide a birthdate, and placed users who said they were under 13 in a Kids Mode account. But TikTok also allegedly allowed users who said they were under 13 to create non-kids account simply by
starting the sign-up process over and providing a different birthdate.
TikTok also allegedly allowed people to create accounts by logging in through Google or Instagram, even though Google
allowed people under 13 to maintain accounts with parental permission, and Instagram didn't require users to provide their ages until December 2019, according to the complaint.
TikTok's
“insufficient policies and practices thus allowed children to create a non-Kids Mode TikTok account, gaining access to adult content and features of the general TikTok platform without providing
age information,” the complaint alleges.
The company then “collected and maintained vast amounts of personal information from the children who created and used these regular TikTok
accounts,” the Justice Department adds.
That personal information included full names, email addresses, phone numbers, photos, videos, location data, and data from “cookies and
similar technologies that track users across different websites and platforms,” according to the complaint.
The government also alleges that TikTok collected personal information --
including device identifiers (typically alphanumeric strings comparable to serial numbers) and IP addresses -- from Kids Mode users, without parental consent.
While the children's privacy law
generally requires parental consent to collect identifiers, there's an exception if those identifiers are used solely for internal operations.
But TikTok allegedly harnessed the identifiers in
ways that went beyond internal operations. For instance, until at least mid-2020, TikTok allegedly shared children's persistent identifiers with Facebook and AppsFlyer in order to “encourage
existing Kids Mode users whose use had declined or ceased to use Kids Mode more frequently,” according to the complaint.