Regulator action · 1 September 2023
Irish DPC decision on TikTok Technology Limited (children's data)
DPC Inquiry IN-21-9-1, decision 1 September 2023 · Data Protection Commission (Ireland)
What it means for your code
If minors can sign up, defaults must be private and settings-flow design must not nudge them toward sharing.
What happened
TikTok set child users' accounts to public by default, allowed unverified adults to pair with child accounts, and used design nudges toward privacy-intrusive options.
What was decided
Public-by-default settings for children, weak family-pairing verification and nudging design infringed data-protection-by-default, fairness and transparency obligations.
⚖ EUR 345 million administrative fine
The legal test applied
- Public-by-default settings for child users breach data protection by design and by default (Art. 25)
- Designs that nudge children toward privacy-intrusive options breach the fairness principle
- Transparency information must be adapted to children
What would have changed the outcome
- Private-by-default settings with age-appropriate explanations
Summary and analysis by Lawpatch, checked by an editor against the source. Risk analysis, not legal advice; the law may have moved on since this decision.