TikTok faces $29 million fine for allegedly collecting personal data from kids

TikTok is facing a potential £27 million fine for allegedly collecting personal data from users under the age of 13.

The United Kingdom’s Information Commissioner’s Office (ICO) today sent a “notice of intent”–which it describes as “a legal document that precedes a potential fine”–to TikTok, warning it that it may have to pay up pending the results of the ICO’s investigation.

According to a statement posted to the ICO’s website, the office suspects TikTok breached U.K. data protection laws between May 2018 and July 2020.

In addition to collecting private data from users under 13 (which is also illegal in the U.S.), TikTok allegedly “failed to provide proper information to its users in a concise, transparent and easily understood way,” and “processed special category data, without legal grounds to do so,” the ICO said.

“Special category data” refers to personal data related to “ethnic and racial origin, political opinions, religious beliefs, sexual orientation, Trade union membership, genetic and biometric data or health data,” per the ICO’s definition.

“We all want children to be able to learn and experience the digital world, but with proper data privacy protections,” Information Commissioner John Edwards said in a statement. “Companies providing digital services have a legal duty to put those protections in place, but our provisional view is that TikTok fell short of meeting that requirement.”

As Edwards noted, the ICO’s allegations and its letter of intent are provisional—meaning the fine and findings are not yet finalized.

A TikTok spokesperson told The New York Times, “While we respect the ICO’s role in safeguarding privacy in the U.K., we disagree with the preliminary views expressed and intend to formally respond to the ICO in due course.”

This is not the first time TikTok has faced scrutiny for its handling of young users’ information. In 2019, the United States’ Federal Trade Commission fined it $5.7 million because Musical.ly, which TikTok’s parent company ByteDance acquired and merged with TikTok, collected data from users under 13.