TikTok faces another penalty in a new lawsuit over data protection and privacy violations

TikTok faces legal action that could result in fines worth millions of pounds after failing to comply with strict General Data Protection Regulation (GDPR) imposed by the European Data Protection Board (EDPB) and their own privacy policy.

GDPR has been a concern for tech companies operating within the European Union (EU) since it was implemented to safeguard user data and privacy in 2016.

TikTok has faced scrutiny following concerns from the Irish Data Protection Authority (DPA). They say TikTok processed the data of children under the age of 13 without first seeking parental consent, in direct violation of GDPR.

“The objections concerned, among other things, whether there had been an infringement of data protection by design and default with regard to age verification”, said the EDBP.

The Irish DPA’s inquiry asserts that TikTok Technology Limited did not implement sufficient measures to verify the ages of its users. They also failed to stop underaged children from accessing the platform, despite being aware that it was a common occurrence.

TikTok was previously ordered to pay British regulators £12.7 million in April. They were found to have unlawfully collected data on children without obtaining their parents’ consent, and to lack transparency regarding data usage and sharing practices.

In defence, a TikTok spokesperson said: “We invest heavily to keep under 13s off the platform and our 40k-strong safety team works round the clock to help keep the platform safe for the community.”

This legal action adds to several lawsuits related to privacy violations involving TikTok dating back to 2019. They were sued for publicly displaying the information of children under 13, such as their full names, profile pictures, and biographies, by default.

To date, TikTok’s global fines related to data and privacy have already exceeded £93 million.