The Federal Trade Commission announced the largest civil penalty obtained in a Children’s Online Privacy Protection Act (COPPA) case, in a $5.7 million settlement with video social network app TikTok, formerly known as Musical.ly.
In operation since 2014, the app allows users to create short videos of themselves or friends lip-syncing to music and then share the videos with other users. Although free to download, the app generated revenue through in-app purchases, with approximately 65 million accounts registered in the United States.
To register for the app, users provide their email address, phone number, first and last names, short biography, profile picture and username. The app provides a platform for users to connect and interact, and since the app’s content is set to public by default, a user’s profile bio, picture and videos are public and searchable by other users. Users can also direct message each other, and until October 2016, the app had a feature that allowed users to view other users within a 50-mile radius.
However, despite knowing that a significant percentage of app users were children under the age of 13, Musical.ly’s operators failed to obtain parental consent before it collected and used their children’s personal data, and failed to notify the parents that it would delete personal information if they so requested, according to the FTC’s California federal court complaint.
The app didn’t age-gate user registration until July 2017 and even then, did not request age information retroactively for already registered users.
Not only did news stories highlight the popularity of the app with kids, but also the online library featured songs from popular children’s movies and those popular among tweens, the FTC said, with song folders titled “Disney” and “school.” The app’s simple tools made it easy for children to create and upload videos, and included colorful emojis—smiley faces and cute animals, for example—that users could send to each other.
The operators received “thousands” of complaints from parents that their children under the age of 13 had created a Musical.ly account without their knowledge, the agency alleged, with more than 300 complaints in a single two-week period in September 2016.
To settle the suit, the operators agreed to comply with COPPA going forward, take all videos made by children under the age of 13 offline and pay $5.7 million to the FTC.
To read the complaint and the proposed stipulated order in United States v. Musical.ly, click here.
Why it matters: “This record penalty should be a reminder to all online services and websites that target children: We take enforcement of COPPA very seriously, and we will not tolerate companies that flagrantly ignore the law,” FTC Chair Joe Simons said in a statement about the action, which was initiated by a tip from the Children’s Advertising Review Unit. In addition to setting a milestone for COPPA enforcement action, the case has been used by two commissioners to argue that corporate officers and directors should be held personally liable. In a joint statement, Commissioners Rohit Chopra and Rebecca Kelly Slaughter called the settlement “a big win in the fight to protect children’s privacy,” but noted that FTC investigations typically focus on individual accountability only in limited circumstances. “We should move away from this approach,” Chopra and Slaughter wrote. “Executives of big companies who call the shots as companies break the law should be held accountable.”