TikTok Collected Sensitive Data From Canadian Children, Privacy Regulators Find
Canadian privacy regulators found that TikTok collected sensitive personal data, including biometric information, from hundreds of thousands of children under 13 despite prohibiting users under that age. The platform's age-verification measures were inadequate, and regulators found violations related to transparency and profiling practices used for targeted advertising.
What happened
A joint investigation by the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, the Office of the Information and Privacy Commissioner for British Columbia, and the Office of the Information and Privacy Commissioner of Alberta found that TikTok collected sensitive data from hundreds of thousands of Canadian children under 13 years old.
TikTok's terms of service prohibit users under 13, but the investigation found that the platform's age-verification measures were insufficient to prevent children from accessing it. TikTok collected birth dates, location data, IP addresses, GPS data, biometric data including facial recognition, device identifiers, behavioral data such as content viewed and time spent, and contact lists from users including children.
Reported impact
The privacy commissioners found that TikTok used children's data to create user profiles for targeted advertising and personalized content delivery. The commissioners stated that targeted advertising and customized content delivery based on this data could expose children to biased information, harmful stereotypes, and gendered expectations that may impede normal youth development and identity formation.
The commissioners also found that TikTok failed to provide users with adequate transparency about what information it collected and how it used it for advertising and content personalization. Critical privacy information was not provided in French, one of Canada's official languages.
Index analysis
The investigation determined that TikTok's data collection and use practices violated the Personal Information Protection and Electronic Documents Act (PIPEDA). The commissioners found that adequate safeguards for children's data were not in place despite TikTok's stated prohibition on users under 13.
Governance controls
Following the investigation, TikTok agreed to strengthen age-verification measures and enhance transparency about how young users' data is collected and used. TikTok also agreed to prohibit advertisers from targeting users under 18 except on the basis of general categories such as language and approximate location.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.