FTC Adds COPPA Violations to the Growing List of Privacy Concerns While TikTok is on the Clock

By: Jordan Briggs

For years now, TikTok has seemed to be the center of attention. From viral baking content to true crime to dancing videos to family-influencer content, everyone seems to be on it or talking about it. And the FTC has said that’s part of the problem.

On August 2, the Department of Justice (“DOJ”) brought a suit on behalf of the Federal Trade Commission (the “FTC”) against TikTok, its parent company ByteDance, and affiliated companies for violating the Children’s Online Privacy Protection Act (“COPPA”) by collecting and using personal information from children under 13 years old without notifying and obtaining parental consent.

Since 2000, COPPA has required websites directed to children or for which the “operator has actual knowledge that it is collecting personal information from a child” under the age of 13 to (1) provide notice about this collection on its website and (2) “to obtain verifiable parental consent” to collect, use, or disclose this information.[1] While an operator can ensure compliance by following COPPA’s requirements on its own, the act also has a safe harbor provision. Under the safe harbor, third-party organizations, such as advocacy groups, can set general guidelines for COPPA compliance. After these general guidelines are approved by the FTC, the organization becomes a “safe harbor organization” for the purposes of COPPA. Any operator who receives certification of compliance with the guidelines from a safe harbor organization is considered to be COPPA-compliant. There are currently six such safe harbor organizations. [2]

The complaint alleges that millions of children under the age of 13 are now on TikTok, in both the regular version of the app and on “Kids Mode,” as a result of TikTok’s “inadequate and ineffective policies” and that TikTok still collects information on these users despite actual knowledge of their age. According to discovery conducted by the FTC, TikTok has many avenues to find out whether a user is under 13— including self-reporting of age, moderator review of accounts, and an internal rating system of “grade level” to map on-app behavior to a user’s relative age—but not only does the company not use these tools properly, it allegedly avoids identifying users as under 13 unless they self-report. For example, the FTC found the lowest age the “grade level” feature is set to determine is now 16-years old.

When creating a TikTok account, users must self-report their age. If this age is under 13 years old, TikTok allows users to create an account in “Kids Mode.” However, the FTC alleges that TikTok still does not require parental notification or consent for children to open an account and that the app still collects information from these users. Additionally, the FTC found that millions more U.S. TikTok users self-reported their age as 14 or younger in 2020 “than the U.S. Census Bureau’s estimate of the total number of 13- and 14-year-olds in the United States.” (emphasis added). The FTC cites this overrepresentation as evidence that children under 13-years old are providing a false birthdate that shows them as just old enough to access the regular TikTok experience.

On the regular TikTok mode, the FTC states that when accounts are flagged internally as made by users under 13, the accounts are not always removed. According to the FTC, even for removed accounts the data associated with that user is kept and used instead of being deleted. Further, TikTok allegedly made parents jump through hoops to have a child’s account removed—requiring internal review of the account first and then a secondary form to be completed by the parent.

Importantly, this is not the first time that TikTok has been sued by the FTC for COPPA violations. In 2019, TikTok (at the time Musical.ly, Inc.), agreed to pay $5.7million to settle similar allegations and adhere to a permanent injunction—which the 2024 complaint alleges TikTok violated. The allegations in the 2019 complaint are even more egregious. The FTC alleged that prior to mid-2017, TikTok did not require the user to provide their age at account registration and that a significant percentage of app users were children under 13 years old. At that time, the user had to send an email to the company to close their accounts—a feature which led to the company receiving thousands of discoverable email complaints from parents of children under 13. The 2019 permanent injunction required TikTok to keep records on its COPPA compliance and permanently delete information related to its under-13 users, but the 2024 complaint alleges that TikTok did not follow through.

The 2024 complaint has been filed with the U.S. District Court for the Central District of California. The DOJ on behalf of the FTC is requesting a permanent injunction, civil penalties, and any additional relief as determined by the Court. Considering the violations of the 2019 permanent injunction, DOJ and the FTC are less likely to settle these claims on similar terms as before. The 2019 permanent injunction put TikTok on notice of its obligations under COPPA, and the FTC still found blatant violations in 2024. If the parties were to settle, we expect a higher fine and more stringent mandatory oversight than in the 2019 permanent injunction. However, if the parties cannot or do not want to reach a settlement agreement, the case will go to a jury trial—a result that is less certain for TikTok.

Even as to its older audience, TikTok had come under scrutiny for privacy concerns. TikTok is not allowed on federal government-issued devices[3] and most state governments have similar bans.[4] In 2023, Montana’s legislature passed an overall ban on TikTok’s use within the state, arguing that the app’s privacy concerns amounted to a national security threat.[5] This ban was blocked by the U.S. District Court over the state’s lack of authority in international affairs and first amendment and discrimination concerns. However, the federal government, who does have authority to pass laws affecting international diplomacy, after multiple Congressional hearings,[6] passed a bill in April 2024 that could ban TikTok if it is not sold by its parent company within a year.[7] The federal bill has bipartisan support due to national security concerns about Chinese companies sharing user information with the Chinese government.[8] TikTok has challenged this federal law in the D.C. District Court and oral argument in that case is scheduled for September 16, 2024.

While TikTok continues to enjoy incredible popularity in the world of social media platforms, its Chinese government connections and its apparent willfulness in repeatedly flouting COPPA’s protective measures is drawing the ire of the feds. This apparent ramping up in aggression from Congress and the federal agencies often signals federal criminal prosecution is on the horizon, and TikTok’s days of popularity in the U.S. may be numbered.

[1] 15 USC §§ 6501, 6502.

[2] A list of the approved safe harbor organizations is available at: https://www.ftc.gov/enforcement/coppa-safe-harbor-program.

[3] Stanislav Kogiku, “Biden signs TikTok ban for government devices, setting up a chaotic 2023 for the app,” NBC News (Dec. 30, 2022 at 4:24pm), available at https://www.nbcnews.com/tech/tech-news/tiktok-ban-biden-government-college-state-federal-security-privacy-rcna63724.

[4] Cailey Gleeson, “These 39 States Already Ban TikTok From Government Devices,” Forbes (Mar. 12, 2024 at 10:34am), available at https://www.forbes.com/sites/caileygleeson/2024/03/12/these-39-states-already-ban-tiktok-from-government-devices/.

[5] See Bobby Allyn, “Federal judge blocks Montana’s TikTok ban before it takes effect,” NPR (Nov. 30, 2023 at 6:24pm), available at https://www.npr.org/2023/11/30/1205735647/montana-tiktok-ban-blocked-state#:~:text=A%20federal%20judge%20has%20blocked%20a%20law%20in,on%20Jan.%201%2C%20has%20now%20been%20temporarily%20halted.

[6] See, e.g., Protecting Children Online, U.S. Sen. Comm. Judiciary https://www.judiciary.senate.gov/protecting-children-online; “TikTok Hearing Before House Energy and Commerce Committee: Lawmakers Appear Unconvinced by TikTok Chief’s Testimony,” NYT (last updated March 24, 2023), available at https://www.nytimes.com/live/2023/03/23/technology/tiktok-hearing-congress.

[7] Protecting Americans from Foreign Adversary Controlled Applications Act (“the Act”), Pub. L. No. 118-50, div. H (2024); See also “What a TikTok ban in the US could mean for you,” AP News (last updated April 24, 2024 at 10:51am), available at https://apnews.com/article/tiktok-divestment-ban-what-you-need-to-know-5e1ff786e89da10a1b799241ae025406.

[8] Id.