Elizabeth Denham, the information commissioner, told a parliamentary committee the investigation began in February, prompted by a multimillion-dollar fine from the US Federal Trade Commission (FTC) for similar violations.
“We are looking at the transparency tools for children,” Denham said on Tuesday. “We’re looking at the messaging system, which is completely open, we’re looking at the kind of videos that are collected and shared by children online. We do have an active investigation into TikTok right now, so watch this space.”
As well as general concerns about how private data was collected, the commissioner said there were concerns about how the open messaging system allowed any adult to message any child.
 |
| TikTok received a record US fine earlier this year for illegally collecting personal data of children under 13. Photograph: Danish Siddiqui/Reuters |
She said the company was potentially violating the general data protection regulation (GDPR) which “requires the company to provide different services and different protections for children”.
In February, Bytedance, the Chinese firm that owns TikTok, was fined a record ($5.7m) £4.2m for illegally collecting personal information from children under 13. The FTC said the company had previously been aware that “a significant percentage of users were younger than 13”, the age at which US laws mandate strict data protections, “and received thousands of complaints from parents that their children under 13 had created Musical.ly accounts”. Musical.ly was the previous name of TikTok.
Despite that, the FTC’s chair, Joe Simons, said, “they still failed to seek parental consent before collecting names, email addresses and other personal information from users under the age of 13”.
Bytedance, a private startup based in Beijing, has a valuation of $75bn, based primarily on the extraordinary growth of TikTok and its Chinese equivalent, Douyin. The app is popular among teenagers and preteens for its combination of music and meme-based humour.
In April, Lil Nas X found fame overnight when his track Old Town Road was used extensively on 15-sec clips on the social network. That enthusiasm took the artist to the top of the US Billboard Hot 100 chart.
A company can be fined up to €20m (£17.9m), or 4% of revenue, whichever is higher, for violating the GDPR. As a private company, Bytedance does not have to disclose revenue so it is unknown how high such a fine could be.
In a statement, TikTok said: “We cooperate with organizations such as the ICO to provide relevant information about our product to support their work. Ensuring data protection principles are upheld as a top priority for TikTok.
