Enforcement · Data Protection Authority of Ireland EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

TikTok Limited: Non-compliance with general data processing principles

€345,000,000 Fine
TikTok Limited
IRELAND
Art. 5 GDPR Art. 12 GDPR Art. 13 GDPR Art. 24 GDPR Art. 25 GDPR
Social Media IP Address Processing Processing Agreement Minors Personal Data Security Privacy by Design & Default
Sep 1, 2023 Source

How it connects

Related across sources

News Danish SA Declares Use of Google Analytics Unlawful Without Supplementary Measures Datatilsynet Guidance Guidelines 07/2022 on certification as a tool for transfers EDPB Guidance Guidelines 03/2022 on Deceptive design patterns in social media platform interfaces: how to recognise and avoid them EDPB News What Happened to the Risk-Based Approach to Data Transfers? Future of Privacy Forum News De Deense beschermingsautoriteit (SA) heeft verklaard dat het gebruik van Google Analytics onrechtmatig is zonder aanvullende maatregelen. Datatilsynet News Irish Data Protection Commissioner Fines Instagram EUR 405M for Children Privacy Violations Hunton Andrews Kurth

Full text

The Irish DPA (DPC), has imposed a fine of EUR 345 million on TikTok Limited. The DPC conducted an investigation primarily focused on the processing of personal data between July 31, 2020, and December 31, 2020. During their investigation, the DPC found that the profiles of child users were set to public access by default. As a result, the DPC concluded that TikTok had failed to implement appropriate technical and organizational measures to ensure that only necessary personal data was being processed. Furthermore, the DPC noted that the 'Family Pairing' feature, which allowed non-child users to link their accounts with those of child users, posed a security risk to the personal data of children. Additionally, TikTok failed to provide child users with information about the categories of recipients of their personal data and clear, understandable information on the scope and implications of data processing. The DPC also found that TikTok introduced so-called 'dark patterns,' leading users to frequently opt for less privacy-friendly options during registration and when posting videos on the platform. In addition to the fine, the DPC issued an order requiring TikTok to bring its processing activities in line with the GDPR within three months.

Industry: Media, Telecoms and Broadcasting

Original document at the source edpb.europa.eu

Similar Content