Federal regulators fined social media app Musical.ly — now known as TikTok — $5.7 million for illegally collecting the names, email addresses, pictures and locations of kids under 13, a record penalty for violations of the nation’s child privacy law.
The fine is the result of a settlement between the Federal Trade Commission and TikTok, which merged with California-based Musica.ly in 2018, over allegations of illegal data collection of children.
The TikTok app, like Musical.ly before it, allows users to make videos of themselves lip-syncing to millions of songs, including from children's movies, and is broadly popular among adults and children. TikTok is owned by a Chinese company.
The FTC said TikTok had 65 million users registered in the United States, and as of Wednesday, it was the fourth and 25th most popular free app on Google and Apple devices, respectively. The illegal data collection alleged by the FTC predates the merger with Musica.ly and, according to TikTok officials, is no longer in practice.
"The operators of Musical.ly knew many children were using the app but they still failed to seek parental consent before collecting names, email addresses, and other personal information from users under the age of 13," said FTC Chairman Joe Simons in a news release Wednesday. "This record penalty should be a reminder to all online services and websites that target children."
The 1998 law, called Children's Online Privacy Protection Act, sharply limits the collection of personal data of online users under the age of 13, but regulators in the past have been unsure of how to apply the law to general-interest sites, as opposed to ones specifically directed at children. The law forbids online services from collecting data on children, unless their parents give explicit permission, but it covers only services directed at children or ones that have "actual knowledge" that children are using them.
Musical.ly debuted in 2014 and, when counting its successor TikTok, has been downloaded more than 200 million times. The original Musical.ly app required users provide their names, email addresses and phone numbers, and post a profile picture. Until October 2016, the app also collected the locations of users and allowed others to view which users were within a 50-mile radius of them, the FTC said.
The FTC noted in its filing that many TikTok users list their ages in short bios they post with their accounts, meaning that the app has "actual knowledge" that they are under 13. The FTC also reported receiving thousands of complaints from parents of young children using the app.
In response, TikTok said Wednesday that it would require new users to verify their age, while prompting existing users to verify how old they are. Users under age 13 would only be able to access a "limited, separate app experience" that meets U.S. restrictions on children's privacy, the company said in a blog post.
"We care deeply about the safety and privacy of our users," TikTok continued. "This is an ongoing commitment, and we are continuing to expand and evolve our protective measures in support of this."
While the FTC voted 5-0 to accept the settlement with TikTok that resulted in the $5.7 million fine, the commission's two Democrats said in a joint statement that the FTC should have held company executives personally accountable.
Democratic Commissioners Rohit Chopra and Rebecca Slaughter — called the fine a "big win" to protect children online — said in a statement, "As we continue to pursue violations of law, we should prioritize uncovering the role of corporate officers and directors and hold accountable everyone who broke the law."
Privacy advocates, meanwhile, said the FTC had not gone far enough to penalize TikTok, especially in an era when popular general-interest sites such as YouTube and games such as Fortnite are extremely popular among children.
"The FTC has given a gentle slap on the wrist, and it underscores how the agency has failed to enforce the only consumer privacy law it's responsible for on children," said Jeff Chester, the executive director of the Center for Digital Democracy. "TikTok and others have been failing to comply with COPPA for years, and the FTC has been reluctant to challenge the privacy invasive practices of the companies that target children. This is too little, too late."
A coalition of consumer and privacy groups filed a complaint with the FTC last year, alleging that YouTube routinely violates COPPA, but the commission — as is its standard practice when receiving complaints — has declined to comment on whether it is pursuing an investigating.
The TikTok case began with a referral from the Better Business Bureau’s Children’s Advertising Review Unit.