Backgrounder: Investigation into TikTok and user privacy

What you need to know

TikTok states that its platform is not intended for people under the age of 13, but our investigation found that hundreds of thousands of children in Canada access TikTok’s platform each year – and that TikTok has been collecting and using their personal information. Our investigation found that the measures in place to keep children off the platform were inadequate.

TikTok collects a broad range of data from its users, including children

The investigation uncovered that TikTok collected vast amounts of personal information of its users, such as:

• User-provided data: Date of birth, and location, among other sensitive personal information.
• Device information: IP address, GPS data, device model, and operating system.
• Behavioural data: Content viewed, how long users watch videos, what they like or comment on, and what they buy.
• Who you know: The contact list from a user’s device and other social media profiles (like ‘Facebook Friends’) as well as ‘Friends’ on the platform.
• Facial recognition and biometric data: Facial features and voiceprints.

User profiles to target advertising and content

TikTok uses vast amounts of personal information to create profiles about users, including children, which is being used to deliver targeted ads and customized content to them.

Online marketing practices and content targeting can have significant impacts on children’s well-being, including:

• the marketing of games that can lead to the normalization of gambling
• an increased risk of identity theft and fraud
• hindering young people’s normal development and identity exploration, as well as fostering negative body image and early sexualization
• exposing children to gender stereotypes and discrimination

TikTok failed to obtain meaningful consent

Our investigation found that TikTok did not provide key information up-front to users, including what information would be collected and used to deliver user-targeted ads and personalize content to them.

• Complex practices like ad targeting and content personalization were not fully described in TikTok’s privacy policy, and other documents that provided a better explanation were hard to find.
• There was a lack of information designed for younger users to reasonably understand its practices related to ad targeting and content personalization.
• Key privacy information was not provided in French.

What is changing as a result of the investigation

TikTok has either already taken steps or committed to take steps to improve its privacy practices, including:

• Improving measures to keep children off its website and app.
• Stopping use of granular information, such as interests inferred from use of the platform, to target ads to users under 18.
• Improving its communications to better explain its privacy practices, especially for teens.

Further reading

For individuals

For tips on how to protect your personal information:

• Your privacy and social media
• 12 online privacy tips for parents
• Guidelines for obtaining meaningful consent

For organizations

Organizations must respect their obligations under Canada’s privacy laws. This includes appropriately safeguarding personal information. Given the sensitivity of the personal information of children, products and services that are likely to be popular with children should be designed with strong protections and respect their right to privacy.

For information on how organizations can protect the privacy rights of children:

• Putting best interests of young people at the forefront of privacy and access to personal information

For more information on the TikTok investigation, read the Report of Findings.