• by Wendy Davis  @wendyndavis, August 2, 2024

TikTok allegedly violated federal privacy law by collecting “extensive personal information” from children younger than 13, the Department of Justice alleged in a lawsuit filed Friday.

The app, owned by the Chinese company ByteDance, also allegedly failed to comply with the terms of its February 2019 Federal Trade Commission settlement over potential violations of the Children's Online Privacy Protection Act. That law prohibits operators of websites and apps from knowingly collecting personal information from children under 13 without parental consent.

The new suit comes around six weeks after the FTC took the rare step of publicly stating it had referred TikTok to the Justice Department over alleged violations of the children's privacy law.

A TikTok spokesperson said the company disagrees with the allegations, adding that many “relate to past events and practices,” and “are factually inaccurate or have been addressed.”

The Justice Department's complaint, filed in U.S. District Court for the Central District of California, focuses on TikTok activity that occurred between March 2019 -- soon after it agreed to settle FTC charges -- and 2022.

The complaint, which also names ByteDance as a defendant, alleges that even though the app had a “Kids Mode” setting for children under 13, TikTok allowed users 12 and under to bypass that setting and create non-Kids Mode accounts.

For instance, TikTok allegedly asked people who signed up for new accounts to provide a birthdate, and placed users who said they were under 13 in a Kids Mode account. But TikTok also allegedly allowed users who said they were under 13 to create non-kids account simply by starting the sign-up process over and providing a different birthdate.

TikTok also allegedly allowed people to create accounts by logging in through Google or Instagram, even though Google allowed people under 13 to maintain accounts with parental permission, and Instagram didn't require users to provide their ages until December 2019, according to the complaint.

TikTok's “insufficient policies and practices thus allowed children to create a non-Kids Mode TikTok account, gaining access to adult content and features of the general TikTok platform without providing age information,” the complaint alleges.

The company then “collected and maintained vast amounts of personal information from the children who created and used these regular TikTok accounts,” the Justice Department adds.

That personal information included full names, email addresses, phone numbers, photos, videos, location data, and data from “cookies and similar technologies that track users across different websites and platforms,” according to the complaint.

The government also alleges that TikTok collected personal information -- including device identifiers (typically alphanumeric strings comparable to serial numbers) and IP addresses -- from Kids Mode users, without parental consent.

While the children's privacy law generally requires parental consent to collect identifiers, there's an exception if those identifiers are used solely for internal operations.

But TikTok allegedly harnessed the identifiers in ways that went beyond internal operations. For instance, until at least mid-2020, TikTok allegedly shared children's persistent identifiers with Facebook and AppsFlyer in order to “encourage existing Kids Mode users whose use had declined or ceased to use Kids Mode more frequently,” according to the complaint.