Last week, federal privacy commissioner Phillipe Dufresne, alongside his provincial privacy counterparts from Quebec, Alberta, and British Columbia, released the results of a multi-year investigation into TikTok’s privacy practices. While the outcome was never really in doubt—look under the hood of any social media company and you will find some privacy concerns—what was both surprising and risky was the commissioner’s demand that TikTok engage in increased surveillance of its users in the name of better privacy practices.
The commissioners identified several sources of concern, including inadequate communications of privacy practices. This leads to a failure to obtain meaningful consent since a user can’t reasonably consent to something they don’t know about. Those findings are important, but debates over the adequacy of disclosures are the equivalent of a referee calling holding in football. It’s there on virtually every play and can always be invoked.
The more important issue involved youth privacy and underage use of the platform, particularly users under the age of 13. TikTok’s own policies prohibit users that young, but everyone recognizes that implementing an effective ban is not easy. The company uses an “age gate” that asks for the user’s age. If they respond with a date of birth that renders them ineligible to use the service, TikTok blocks their registration and access.
However, circumventing the age gate is trivial, requiring only inputting a valid date of birth. The company does not require official identification or otherwise confirm the information. To supplement its approach, TikTok seeks to weed out underage users by responding to manual reports (parents reporting that their kids are on the platform) or by using automated monitoring tools that track keywords in which the user might disclosure their real age (“I am in grade 3”) as well as computer vision and audio analytics to seek to identify users under 18 appearing on a TikTok LIVE stream.
