The Information Commissioner’s Office (ICO), the UK’s data protection authority, this morning announced it is launching investigations into TikTok, Reddit, and Imgur relating to how they collect and use children’s data. The regulator says the three inquiries are part of a wider investigation into how video sharing platforms and social media businesses use children’s data.
TikTok is being investigated over how it uses 13-17-year-olds’ personal information in order to make content recommendations. The ICO says the investigation is being conducted “in light of growing concerns about social media and video sharing platforms using data generated by children’s online activity in their recommender systems, which could lead to young people being served inappropriate or harmful content”. Reddit and Imgur meanwhile are being assessed on how they use children’s personal information, and which age assurance measures they use to estimate and verify individual users’ ages.
The ICO says it is currently investigating in all cases whether there have been any infringements of data protection legislation. If there is sufficient evidence that this is the case, the businesses involved will have a chance to respond before the ICO reaches a final conclusion.
“In announcing these investigations, we are making it clear to the public what action we are currently taking to ensure children’s information rights are upheld,” said John Edwards, the UK’s information commissioner. “This is a priority area, and we will provide updates about any further action we decide to take”.
A simple message
UK data protection law has specific provisions for collection and use of children’s data, and the ICO has created a statutory code of practice which any tech businesses likely to be accessed by children must adhere to.
There are a few top level requirements which apply across the board. For example, businesses must check the age of people who use their services, geolocation tools which track users’ locations must be turned off, and ‘nudge’ techniques mustn’t be used to encourage children to provide more personal data. Other rules vary on a case-by-case basis. For example, the Children’s Code says that user profiling must be switched off by default for children, unless there’s a compelling reason which is in the best interests of child users for it to be on by default. Any businesses which do use profiling must have appropriate measures in place to protect the child from any harmful effects, such as being shown content which is detrimental to their health or wellbeing.
Thus, there’s room for interpretation within these laws, and businesses in some cases may find that collecting children’s personal data is appropriate, if it’s in the best interests of young users.
Edwards however says the ICO takes a hard line on these issues, meaning there won’t be much sympathy for businesses found to be stretching the rules for their own benefit. “My message is simple. If social media and video sharing platforms want to benefit from operating in the UK they must comply with data protection law,” he said. “The responsibility to keep children safe online lies firmly at the door of the companies offering these services and my office is steadfast in its commitment to hold them to account.”
Follow VideoWeek on Twitter and LinkedIn.
