What just happened?
The popular online video sharing platform, TikTok, is being sued by former children’s commissioner for England, Anne Longfield over how it collects and uses children’s data. The claim is being filed on behalf of millions of children in the UK and EU who have used the platform.
What does this mean?
There have been issues in the past with TikTok mishandling children’s data, including a case in South Korea in 2020 where the company was fined 186 million Korean Won (£153,000) after the South Korean media watchdog, KCC, confirmed that the app had not communicated to young users that their data was being exported overseas, which was a huge concern regarding national security and children’s safety online.
In 2020, TikTok’s parent firm, ByteDance, which is based in Beijing, made billions in profits, the majority of which was from advertising revenue. It was reported by the Daily Telegraph that watchdog Ofcom had found that around 44% of children aged 8-12 in the UK were using the app, despite the guidance in TikTok’s rules saying the app is for children aged 13 and up. [1]
Taking up the case with Scott+Scott law firm as a “litigation friend” to a 12-year-old girl who last year made a similar claim against TikTok, Ms. Longfield is now bringing a billion-dollar claim against TikTok on behalf of the millions of children whose data she says has been harvested without sufficient warning, transparency or the consent required by law.
“They’re collecting what we would call an excessive amount of data on children” explained Ms. Longfield, whose post as England’s Children’s Commissioner ended last year.
“That includes data on names, contacts, habits, and interests, who children follow on TikTok, but also information around childrens’ geolocation, videos they’ve made, even draft videos, and potentially, we believe, facial recognition.”
This data, some of which could reveal “where a child is at any time while using the app”, is being collected from children younger than 13, claims Ms Longfield, in spite of these children not legally being able to consent to the process of their data under UK GDPR law.[2]
What does this mean for the legal sector?
The problem with this is that TikTok is still a company that needs to make a profit, and a large proportion of their users are children and if they didn’t advertise products to children, they wouldn’t make this profit. Lawyers on behalf of Anne Longfield, former children’s commissioner for England will allege that it collects and sells their data to third-party advertisers without the understood consent of children. The data that lawyers are claiming is being taken illegally includes child’s personal information such as phone numbers, videos, exact location, and biometric data
According to TikTok’s own privacy policy, this is shared with “selected third parties” including advertisers, analytics and measurement providers, and business partners including Facebook, Twitter, and Instagram.
Normally this is fine. When adults are able to give informed consent to their data being collected, such as their age, the videos they like, and their ethnicity, which is then sold to advertisers who will promote a product that fits the data they have been provided.
The issue arises when children, who cannot give informed consent, have their data taken but it is more than their age, ethnicity, and liked videos. It’s the data that could mean the theft of their identity or the worst offense in competition law, price discrimination.
Though normally an offense targeted at adults, by collecting data from children, ByteDance could potentially sell this data to companies and collude with other businesses to form a pricing strategy for products sold in that region.
For example, if a great number of children are watching Mario kart videos on TikTok in East Midlands; hypothetically speaking; if the company wants to - it can sell this data to any third party companies that may sell Mario kart games or force companies to order Mario kart games to sell because there is a demand for it in that region. The pro with this is that businesses are thriving as they know the demand for the game is high and they exploit this. The con is that only third parties with connections and the money to buy this data from Bytedance will be able to profit from this event.
According to the government’s explanation of section 9, Article 8(1) of the Data Protection Act 2018, Persons giving consent need to have a certain level of understanding of what they are being asked which is why the GDPR specifies that parents or guardians must give consent to personal data processing on behalf of young children using information society services. "Information society services" generally include commercial websites.[3]
This means that the majority of children in the UK between the age of 8 and 15[4] (which according to a report in the Daily Telegraph is 50% of children in that age bracket) are not able to give understood consent to their personal data being taken and used by TikTok, which would mean that the platform is breaking GDPR which could land them with a fine as big as the $5.7million[5] they had in 2019, which was 5% of their net income from that year.[6]
There are other legal concerns surrounding TikTok’s (in addition to China’s) mishandling of data.
Notably, in 2020, Former President Donald Trump considered banning the app in the states as a matter of national security when there were concerns that ByteDance were affiliated with the Chinese Government and they were able to see and use the data of children and indeed other citizens from the US. It is for this same reason that India banned the app in 2019. If the allegations against ByteDance working with the Chinese government are true, what they are essentially doing is getting that upper hand in committing to strategies of cyber-warfare; manipulation of economy and political landscape of that country because they have got the date of the future residents of the country.
A report from Euractiv article stated that Beijing tried to dissipate the mistrust of Chinese tech companies, such as ByteDance. The Chinese Government allegedly detailed measures against back doors that would enable surveillance by public authorities and it is, for this reason, that tech giants from China such as Huawei were banned from the 5G network in Europe, despite China claiming to comply with the EU’s data strategy[7].
Are these accusations of collecting too much and the wrong kind of data from children that Anne Longfield proposed are true? Are the accusations of data being passed to the Chinese government true? Only TikTok themselves can answer for that.
Written by Gillis Robbie
References:
[1] https://www.telegraph.co.uk/technology/2020/06/23/half-british-children-use-tiktok-regularly-despite-safety-fears/
[2] https://www.yorkshirepost.co.uk/lifestyle/family-and-parenting/parents-and-children-are-being-duped-why-ex-childrens-commissioner-anne-longfield-is-suing-tiktok-for-billions-3208540
[3] https://www.legislation.gov.uk/ukpga/2018/12/notes/division/3/index.htm
[4] https://www.telegraph.co.uk/technology/2020/06/23/half-british-children-use-tiktok-regularly-despite-safety-fears/
[5] https://www.nbcnews.com/tech/tech-news/tiktok-pay-5-7-million-over-alleged-violation-child-privacy-n977186
[6] https://www.businessofapps.com/data/tik-tok-statistics/
[7] https://www.euractiv.com/section/data-protection/news/global-data-transfer-uncertainty-undermines-eu-digital-ambitions/