TikTok collected sensitive data on Canadian children, broke privacy laws: report

OTTAWA — TikTok broke privacy laws by not doing enough to keep children off its platform and collecting sensitive information about users aged 12 and under to serve them with potentially harmful tailored ads and videos, according to a new report.  

“TikTok must do more to keep underage children off its platform,” federal Privacy Commissioner Philippe Dufresne said Tuesday.  

In 2023, Dufresne and his provincial counterparts in B.C., Alberta and Quebec launched an investigation into TikTok’s privacy practices, with a particular focus on underage users. The wildly popular video app’s terms of service do not allow users under 13 years old (14 in Quebec).  

The privacy commissioners published the fruits of their probe on Tuesday, finding that the tools TikTok had implemented to keep underage children off its platform were “largely ineffective.”

They also found that TikTok was using biometric data — including tools to scan faces in uploaded videos — to “infer sensitive data” about its users such as their age range, gender and spending power.  

The company used that data without having obtained meaningful consent to show users tailored ads and content, the report found.  

“A user signing up for TikTok would have no reason to expect that TikTok would conduct an analysis on their facial features and for which purposes, nor are they likely to review TikTok’s lengthy privacy policy to learn about TikTok’s biometric practices,” reads the report.  

During the press conference, B.C. Privacy Commissioner Michael Harvey said he and his colleagues were surprised by how deeply the app profiled its users and how that data was then used.  

He described the current situation as an “unacceptable status quo.”

“I think we were certainly struck by exactly how elaborate the profiling that was being used by TikTok in their systems, exactly what information was being collected with these facial and voice analytics and how it was being used in combination with things like location information,” he said.  

But despite having detailed, biometric-inspired information about its users, TikTok does not use the data to detect underage users and kick them off the platform, Dufresne told reporters.

“You’re using this innovation, these tools for certain purposes. You should at least be using them for the other purposes of protecting children,” he said.

The investigation also concluded that the tools TikTok does use to detect underage users on its platform are not working and need to be modernized.  

“This resulted in the collection of the sensitive information of many children and the use of that information for purposes of ad targeting and content recommendations,” said Alberta Privacy Commissioner Diane McLeod.  

“Children on TikTok are likely to see video content that is not age appropriate. Children on TikTok are likely to receive targeted ads that normalize gambling,” she added.  

The report made multiple recommendations to TikTok, including enhanced age assurance mechanisms and improving its privacy policy to better explain its advertising and content personalization practices.  

It also recommended TikTok stop allowing advertisers to target users under 18 years old and create “prominent up-front notices” about how user data — including biometrics — could be processed in China.

The commissioners noted in their report that while TikTok did not agree with all their findings, it agreed to implement all of their recommendations and regular follow-ups.  

“We are pleased that TikTok is committed to making some more important privacy enhancements to their platform, including modern age assurance mechanisms and improved age-appropriate communications around privacy,” said Harvey.  

TikTok Canada did not immediately respond to a request for comment.

TikTok is suing the federal government to prevent it from forcefully shutting down its Canadian offices due to concerns about national security, though Ottawa has declined to ban the controversial application outright.

Canada’s intelligence agencies have repeatedly warned that the app’s owner, Chinese tech giant ByteDance, can be compelled by the Chinese government to collect and provide it with sensitive user data.

The application is currently banned on government devices.

National Post

cnardi@postmedia.com 

Our website is the place for the latest breaking news, exclusive scoops, longreads and provocative commentary. Please bookmark nationalpost.com and sign up for our politics newsletter, First Reading, here.