The social media video sharing app Musical.ly (Tik-Tok) agreed to pay a $5.7 million settlement in response to allegations of violating the Children’s Online Privacy Protection Act (“COPPA”), which requires websites and other online services to obtain parental consent before collecting the personal information of children under the age of 13. The Department of Justice filed the FTC’s complaint on the commission’s behalf, alleging that Musical.ly violated COPPA by:
- Failing to provide notice on its website or service of the collection of information from children and how it uses such information.
- Failing to provide direct notice to parents of the information it collects from children.
- Failing to obtain consent from parents before any collection or use of personal information from children.
- Failing to delete personal information of children at the request of parents.
- Retaining the personal information longer than necessary to fulfill the purpose for which the data was collected.
The extremely popular app boasts over a billion downloads and allows users to upload short videos of themselves lip-syncing or acting to music or various sound bytes. Users were not asked for their age when creating their account, and user accounts included a profile bio, picture, and personally-uploaded videos that were all public by default. If the child changed their privacy settings from public to private, the app still allowed other users to view their picture and profile bio, as well as send direct messages. The complaint notes public reports of adults attempting to contact children via the direct messaging system within the app.
These disturbing reports underscore the need for children’s privacy law enforcement and is part of a larger trend of children being victimized on video-sharing and video-streaming apps. The National Society for the Prevention of Cruelty to Children (“NSPCC”) performed a survey of over 40,000 school children on video-sharing and video-streaming apps and found that of the 25% who had live-streamed with a stranger, one in twenty had been asked to take their clothes off.
FTC Chairman Joe Simons said of the settlement: “The operators of Musical.ly—now known as TikTok—knew many children were using the app but they still failed to seek parental consent before collecting names, email addresses, and other personal information from users under the age of 13….this record penalty should be a reminder to all online services and websites that target children: We take enforcement of COPPA very seriously, and we will not tolerate companies that flagrantly ignore the law.”
The settlement includes a permanent injunction which requires the operators of the Tik-Tok app to comply with COPPA standards going forward. In an effort to comply with the FTC’s guidance on mixed audience apps, the company will implement an additional app experience which splits users into separate “age-appropriate environments.” The users under the age of 13 will not be able to share videos, comment, maintain a profile, or send and receive direct messages, but they will still be able to view the content of the app.
In a separate statement, Commissioner Rohit Chopra and Commissioner Rebecca Kelly Slaughter addressed the case. Their statement reflected a commitment to shifting the approach of FTC investigations from focusing on individual accountability “only in certain circumstances,” to a more comprehensive approach that holds executives at large companies breaking the law accountable.