Finding of TikTok child privacy violations by federal, provincial privacy authorities an important building block toward tech accountability in Canada

Last week, a joint investigation published by the Privacy Commissioner of Canada and three provincial privacy authorities found that TikTok, a popular social media platform with over 14 million Canadian users, violated federal and provincial privacy laws, notably in relation to children who use their online service.

This finding sets a powerful precedent, and more importantly provides an example for how multiple levels of government in Canada can cooperate and help positively shape safety for children online. This joint action illustrates the power of public institutions using powers already at their disposal to protect children in digital spaces — consumer protection, privacy and child protection laws being among the levers that can be effective to motivate change. We note, however, that privacy laws complement but do not replace the urgent need for comprehensive national online safety laws.

Among the key findings, the privacy authorities determined that TikTok:

• Had "largely ineffective” measures to keep children under 13 (14 in Québec) from using its platform, as prohibited by their own terms of use;
• Employed sophisticated age estimation tools for certain business functions, but did not use them to age-gate children;
• Was collecting and using the personal information of children with no legitimate need and for inappropriate purposes;
• Failed to adequately explain its collection and use of children's biometric data in the context of its video/image and audio analytics;
• Did not ensure the privacy settings of its technological product provided the highest level of privacy by default.

As a result of this investigation, TikTok has committed to a number of important measures to protect children’s privacy, including the use of effective age assurance technology, design changes related to default privacy settings, and changes to its advertisement model to prevent the targeting of minors other than with general criteria such as language and approximate location.

We applaud the Office of the Privacy Commissioner of Canada and the commissioners in Quebec, British Columbia, and Alberta for their thorough investigation into TikTok’s privacy violations — we are confident that similarly thorough investigations into other mainstream platforms would likely yield similar findings.

Children are especially vulnerable online and deserve stronger protections, and so, in the mad rush for profit, we simply cannot allow online services to exploit the attention of Canadian children. TikTok’s commitment to improve its practices is welcome, but must be backed by action and oversight.

Let this be the beginning of a broader movement to protect children’s privacy and safety online.