TikTok collected sensitive personal data on 'a large number of Canadian children,' privacy commissioner says

“Recognizing the significant gaps that we observed in TikTok’s underage user detection mechanisms, we found it likely that many more children continued to use the platform, undetected, and therefore subjected to profiling and targeting by TikTok.”

But because TikTok has committed to implementing most of the report’s recommendations — despite the investigation noting the company “generally disagreed with our findings” — the commissioners said they consider the matter “well-founded and conditionally resolved.”

That means that the company contravened parts of Canadian privacy law, but that it promised to put in place “satisfactory corrective actions.” 

The report comes more than two years after the joint investigation was first launched in early 2023. 

Dufresne and his counterparts began the probe to determine whether TikTok’s practices complied with Canadian privacy law. In particular, the probe examined whether the app was obtaining “valid and meaningful consent” regarding its handling of personal information and primarily focused on how TikTok’s privacy practices apply to younger users given the app’s enormous popularity among youth.

Despite TikTok’s ban on users under the age of 13, or 14 in Quebec, the report found that the app had not put in place “reasonable measures to prevent its collection and use of the personal information of underage users,” that there were “deficiencies” in TikTok’s age-verification mechanisms, and that using young people’s data for personalizing advertising and content, and training algorithms, was not appropriate and did not fulfill a “bona fide business interest.”

The report also found that despite TikTok’s assurances that it takes steps to prevent certain parameters from being allowed to target users — like data regarding someone’s mental health, eating disorders, or sexual orientation — it was determined during a site visit to the company’s Toronto office that hashtags like ”#transgendergirl” were made available to advertisers as targeting criteria. 

“TikTok personnel were unable to explain, either during the site visit or when offered a followup opportunity, why these hashtags had been available on the ad manager platform as options. The company later confirmed that the hashtags should not have been available, have since been removed as options, and had not been used in any Canadian ad campaigns from 2023 to the date of our site visit in 2024,” the report notes, adding it was a concern that the company had not caught the issue itself. 

The report stated that while TikTok “makes special efforts to preserve the privacy of youth (13-17),” the app “did not explain to younger users, in accessible plain-language communications appropriate to their general level of cognitive development, how it would collect and use such a wide array of their personal information to serve them targeted ads and personalized content.”

In another finding, the report estimated that the number of underage Canadian users on the platform likely exceeds the roughly 500,000 detected by the app annually, a conclusion TikTok deemed “speculative.”

“We find it particularly troubling that even though TikTok has implemented many sophisticated analytics tools for age estimation to serve its various other business purposes, evidence suggests that the company did not consider using those tools or other similar tools to prevent underage users from accessing, and being tracked and profiled on, the platform,” the commissioners noted.

“The trends identified in this report go beyond just TikTok and reflect what has become the industry standard for many platforms targeting young people,” B.C. Privacy Commissioner Michael Harvey said at a news conference in Ottawa. 

The four privacy offices issued a number of recommendations that TikTok is working towards, including launching three new age-verification mechanisms, better explaining its privacy policies, and blocking advertisers from targeting users under 18. 

The company has also agreed to submit privacy impact assessments and testing plans, completing most of its changes within six months, and provide monthly updates to the privacy offices. 

The massively popular app, whose parent company, ByteDance, is headquartered in Beijing, has had a fraught relationship with Canada in recent years: days after the privacy probe was launched, the federal government banned the app from government-issued mobile devices, framing the move as a precautionary measure due to “concerns about the legal regime that governs the information collected from mobile devices.”

Last November, Ottawa announced it had ordered TikTok to wind up its business operations in Canada, after a national security review revealed “specific national security risks” linked to ByteDance. The government said it was not able to publicly disclose specific risks.

Jurisdictions around the world have raised concerns over whether Chinese security laws would force companies to hand users’ personal data to Beijing. TikTok has denied it is controlled by the Chinese government, says Canadian data is stored outside China, asserts that the app’s operations in Canada are subjected to this country’s privacy laws, and has widely defended many of its practices. 

TikTok Canada has previously accused the federal government of dragging the app into the midst of a geopolitical spat with Beijing following allegations of Chinese interference in Canadian elections. The company said in 2023 that Ottawa never reached out about its privacy and security concerns before barring the app on government devices.

In December, the company launched a legal challenge against the shutdown order, arguing Ottawa “failed to engage with TikTok Canada” about its concerns and that the move bears “no rational connection to the national security risks it identifies.”

Dufresne’s office has said the shutdown request did not affect the privacy investigation and that fears of Chinese government access largely fell outside the scope of his probe.

“However, in the context of consent, in the context of information, we spoke of that concern about data being taken outside of Canada and being potentially accessed by other states. And so one of our specific recommendations was that the policy should make that more explicit,” Dufresne said, of another change TikTok agreed to implement.