Federal regulators fined social media app Musical.ly — now known as TikTok — $5.7 million for illegally collecting the names, email addresses, pictures and locations of kids under age 13, a record penalty for violations of the nation’s child privacy law.
The TikTok app, like Musical.ly before it, allows users to make videos of themselves lip-syncing to millions of songs, including from children’s movies, and is broadly popular among adults and children. TikTok is owned by a Chinese company.
The FTC said TikTok had 65 million users registered in the United States, and as of Wednesday, it was the fourth and 25th-most popular free app on Google and Apple devices, respectively. The illegal data collection alleged by the FTC predates the merger with Musica.ly and, according to TikTok officials, is no longer in practice.
“The operators of Musical.ly — now known as TikTok — knew many children were using the app but they still failed to seek parental consent before collecting names, email addresses, and other personal information from users under the age of 13,” said FTC Chairman Joe Simons in a news release Wednesday. “This record penalty should be a reminder to all online services and websites that target children.”
The 1998 law, called Children’s Online Privacy Protection Act, sharply limits the collection of personal data of online users younger than 13, but regulators in the past have been unsure of how to apply the law to general-interest sites, as opposed to ones specifically directed at children. The law forbids online services from collecting data on children, unless their parents give explicit permission, but it covers only services directed at children or ones that have “actual knowledge” that children are using them.
Musical.ly debuted in 2014 and, along with its successor TikTok, has been downloaded more than 200 million times. The original Musical.ly app required users provide their names, email addresses and phone numbers and post a profile picture. Until October 2016, the app also collected the locations of users and allowed them to view which other users were within a 50-mile radius, the FTC said.
The FTC noted in its filing that many TikTok users list their ages in short bios they post with their accounts, meaning the app had “actual knowledge” they were under 13. The FTC also reported receiving thousands of complaints from parents of young children using the app.
In response, TikTok said Wednesday it would require new users to verify their age, while prompting existing users to verify how old they are. Users younger than 13 would only be able to access a “limited, separate app experience” that meets U.S. restrictions on children’s privacy, the company said in a blog post. The company has agreed to delete data it collected on children.
“We care deeply about the safety and privacy of our users,” TikTok said. “This is an ongoing commitment, and we are continuing to expand and evolve our protective measures in support of this.”
While the FTC voted 5-0 to accept the settlement with TikTok that resulted in the $5.7 million fine, the commission’s two Democrats said in a joint statement that the FTC should have held company executives personally accountable.
Democratic Commissioners Rohit Chopra and Rebecca Slaughter — called the fine a “big win” to protect children online — said in a statement, “As we continue to pursue violations of law, we should prioritize uncovering the role of corporate officers and directors and hold accountable everyone who broke the law.”
Sen. Edward J. Markey (D-Mass.), who as a House member in 1998 authored COPPA, said in a statement: “While this fine may be an historic high for a COPPA violation, it is not high enough for the harm that is done to children and to deter violations of the law in the future by other companies. I urge the FTC to make COPPA enforcement a top priority and protect the privacy of a uniquely vulnerable class of Americans, our children.”
Privacy advocates, meanwhile, said the FTC should be more aggressive in policing COPPA, especially in an era when popular general-interest sites such as YouTube and games such as Fortnite are widely popular among children.
“It is no secret that tech companies are illegally and knowingly collecting personal information from children," Jim Steyer, chief executive of Common Sense Media, said in a statement. "Musical.ly wasn’t the first company and they won’t be the last, which is why we need the FTC to continue to regularly enforce the Children’s Online Privacy Protection Act and hold companies accountable in a big way.”
Common Sense Media was part of a coalition of consumer and privacy groups that filed a complaint with the FTC last year alleging YouTube routinely violates COPPA, but the commission — as is its standard practice when receiving complaints — has declined to comment on whether it is pursuing an investigation.
The TikTok case began with a referral from the Better Business Bureau’s Children’s Advertising Review Unit.