TikTok under ICO investigation

TikTok, along with online forum site Reddit and image-sharing site Imgur, are to be investigated by the UK’s data protection watchdog over how they use personal information of teenage users.

The Information Commissioner's Office (ICO) has launched this investigation amid growing concerns about data privacy and the protection of young people online. The increasing reliance on social media platforms by teenagers has raised questions about how their personal data is collected, stored, and used. This move by the ICO highlights the need for stricter compliance with existing data protection laws.

William Richmond-Coggan, Partner in Dispute Management at Freeths LLP, commented:

"It is not surprising that the ICO has chosen to focus its investigatory efforts on TikTok. With limited resources, the ICO will want to ensure that any intervention is likely to benefit the highest number of users, and that any conclusions they reach will attract as much attention as possible.

But it would be a mistake for organisations that are not of the size of TikTok or Meta to imagine that this means that they are able to operate with impunity. A range of very serious obligations are imposed in relation to the safety of young people, and the protection of their personal data, under statutory guidance like the ICO’s Children’s Code and under legislation like the Online Safety Act. Most of those obligations apply to any business which operates using significant quantities of children’s data, or which offers products and services which might be expected to be of interest to young people (whether or not targeted at them). It may be that smaller businesses will be able to escape direct regulatory scrutiny, at least unless they suffer a breach or other incident. But we have already seen some litigation in the UK and elsewhere targeted at the potentially harmful impact on young people of TikTok’s algorithms.

The further spotlight shone on this sector, and its shortcomings, by the ICO’s new investigation is only likely to increase the potential for further claims. Prudent operators are not going to be waiting to be made an example of either in the Courts or by the regulators, but will be looking to secure a competitive advantage and drive down risk by ensuring full compliance with the range of child-related obligations they are subject to. And concerned parents and the young people directly affected by harmful or careless processing, are not likely to wait for regulatory processes to run their course before they take action against what they perceive to be the worst offenders."

The outcome of this investigation could have significant implications for the way social media platforms handle children’s data in the future. If breaches are found, companies may face heavy fines, legal claims, and regulatory pressure to implement stricter data protection measures.

As online safety remains a top priority, the ICO’s investigation will likely set an important precedent for other digital platforms. Businesses that process children’s data must ensure they comply with all relevant laws and regulations to protect users from potential harm.