Letter to the Hon. Joseph Simons, Chairman of the FTC, the Hon. Noah Phillips, Commissioner of the FTC, the Hon. Rohit Chopra, Commissioner of the FTC, the Hon. Rebecca Slaughter, Commissioner of the FTC, and the Hon. Christine Wilson, Commissioner of the FTC - Senator Hawley, Colleagues Call for Investigation into TikTok's Children's Privacy Practices

Letter

We write to call upon your agency to investigate new evidence suggesting that the popular video
social media platform TikTok is violating legal obligations to protect kids' privacy and urge you
to hold the company accountable for any illegal activity. As the coronavirus pandemic continues
to keep kids at home and young people's screen time skyrockets,1 it is imperative that the
Federal Trade Commission (FTC) upholds its obligation to protect children's privacy and
enforce the Children's Online Privacy Protection Act (COPPA).
TikTok has a clear record of failing to adequately protect young users' privacy. On February 27,
2019, the FTC fined TikTok (previously Musical.ly) and negotiated a consent decree after
finding that the company had repeatedly violated COPPA. According to the FTC, TikTok collected information about children without receiving the requisite consent from parents.2 The
Commission also found that TikTok had not provided parents with notice of its data collection,
as COPPA requires, and failed to delete children's information from the platform at the request
of their parents.
3
These alleged violations showed a blatant contempt for COPPA's fundamental
tenets, and laid bare a dangerous disregard for children's privacy in today's online ecosystem. As
part of a settlement mandating the institution of new privacy safeguards, TikTok agreed to pay a
then-record $5.7 million penalty.
On May 14, 2020, however, a coalition of over 20 children's advocacy groups filed a 55-page
complaint with the FTC over TikTok's continuing privacy abuses. This investigation --
conducted by leading children's privacy legal experts -- found damaging evidence to suggest that
TikTok likely violated the FTC consent decree and may have further infringed upon child users'
privacy.
First, the researchers presented evidence suggesting that TikTok has failed to delete all personal
information collected about all the platform's users or delete all information collected about
users under age 13, two options stipulated under the consent decree. TikTok does not appear to
have deleted the personal information of all its users, and screenshots taken directly from the
TikTok platform show that children's data, including video and images of children who are
clearly under age 13, were still available on the application months after the FTC's consent
decree took effect.4 This evidence suggests that TikTok has not fulfilled its legal obligations to
protect children's privacy, as mandated under the company's settlement with the FTC.
Second, TikTok still fails to follow multiple legally binding regulatory transparency
requirements, according to researchers' findings. The FTC's regulations under COPPA require
TikTok to provide "direct notice" to parents about its data practices before collecting information
about children.5 However, researchers found that TikTok does not at any point contact a child's
parent when that young user signs up to use the app.6 Additionally, the COPPA Rule requires
TikTok to have a "prominent and clearly labeled" link to its privacy policy on its homepage, but
TikTok's policy is by no means easily found within the app. The policy also appears to lack
essential information, including a description of the data that the app collects about children, an
omission which leaves parents in the dark on whether they can opt-out of objectionable data
surveillance practices.
Finally, TikTok does not appear to give parents the option to review and delete their children's
data from the platform. The FTC order mandates that TikTok let parents remove their children's
information from the app.
8 The COPPA Rule itself requires TikTok's privacy policy to clearly
communicate to parents that they may "review or have deleted" their children's information.9
Yet researchers have demonstrated that TikTok's general notice to all users on how they may
seek data deletion does not offer information about how parents specifically may ask the
company to delete child users' data.10 These findings cast further doubt on TikTok's compliance
with important children's privacy safeguards.
Federal privacy laws, regulations promulgated under those laws, and consent decrees resulting
from privacy violations are effective only if they are vigorously enforced. As the ongoing public
health crisis continues to catalyze children's increased tech use, the FTC must increase its
attention to the dangers that minors encounter online, including the manipulation of kids'
attention and their data for advertising dollars. Already this year, the TikTok app has been
downloaded 307 million times, surpassing any other app in the world, and has many young users
hooked.11 Faced with compelling evidence that this wildly popular social media platform is
blatantly flouting binding U.S. privacy rules, the FTC should move swiftly to launch an
investigation and forcefully hold violators accountable for their conduct.
Thank you for your attention to these important matters.

Source