FTC Imposes Largest Civil Penalty for Violation of Children’s Online Privacy

On February 29, 2019, the Federal Trade Commission announced that the video social networking app Musical.ly, now known as TikTok, agreed to pay $5.7 million to settle a claim that the company illegally collected personal information from children, the largest such civil penalty to date.

The Children’s Online Privacy Protection Act (COPPA) requires websites and online services directed to children to obtain parental consent before collecting personal information from children under the age of 13.  The Musical.ly app, which allowed users to create videos lip-synching to music and to share the videos with other users, collected email addresses, phone numbers, first and last names, biographies and profile pictures; allowed users to interact by commenting on videos and sending direct messages; and included a feature allowing users to view other users within a 50-mile radius of their location.  While user profiles could be made private, the default settings made user accounts public, and even when profiles were made private, user profile pictures and bios remained public, and users could receive direct messages.

According to the FTC’s allegations, Musical.ly was well aware that a significant percentage of its users were under 13.   Multiple press articles between 2016 and 2018 highlighted the popularity of the app among tweens and younger kids, and the Musical.ly app had song folders with titles like “Disney” and “School.”  The FTC complaint alleged that the operators of Musical.ly received thousands of complaints from parents but failed to notify them about the app’s collection and use of personal information, obtain parental consent. They also failed to delete personal information at the request of parents. In addition to paying the civil penalty, the company agreed to change their practices in order to ensure COPPA compliance.

In a separate statement, FTC commissioners Rohit Chopra and Rebecca Kelly Slaughter urged the FTC to hold individual corporate officers and directors liable when they are found to have made business decisions that violated or disregarded the law.

The size of the penalty and the statement of commissioners Chopra and Slaughter make it clear that the FTC intends to make COPPA enforcement a priority, particularly where there is evidence that violations were purposeful.  Any online services that market to or are popular with children must take necessary steps to ensure COPPA compliance.