ByteDance: TikTok failed to bar users it suspected to be under 13

According to TikTok’s own rules, users must be at least 13 years old to create an account in the video sharing app. But many children and teenagers don’t care. The app asks for the date of birth, but TikTok does not check whether users are telling the truth.

Internally, TikTok has been aware of the problem for a long time. Not long ago, TikTok and its predecessor musical.ly were mainly populated tby kids; hardly anyone over 14 used the app.

To counter the problem, TikTok has developed an internal system called „user rate“. Content moderators were instructed to classify users into different age groups based to their appearance. This was confirmed to netzpolitik.org by two independent sources with insight into TikTok’s internal moderation practices in Europe. The policy was in place at least until the end of 2019. The categories were:

• Whitelist+ for users who looked 15 or older.
• Whitelist for users who looked 13 or older.
• Blacklist for users who looked younger than 13.
• No rate

Children were not blocked

Remarkable: The accounts of users assumed to be younger than 13 years old were not automatically blocked or suspended. Rather, their videos were restricted in range.

This contradicts TikTok’s rules and the company’s parental guidance. The latter states: „If your teen is under 13 years old and has registered for a TikTok account from 13 years old, you can notify us at privacy@tiktok.com. We will then take appropriate action.“

It is also a violation of European Union data protection laws. According to the General Data Protection Regulation, children and teens under the age of 16 need their parents‘ consent if they want to use apps such as TikTok, Facebook or Instagram. This consent must be given in writing in advance.

Conspicuous videos were escalated to Beijing

In countries such as Austria and Denmark the age for consent has been lowered to 13 years. But even there, TikTok appears to have deliberately risked breaking the law.

The „user rating“ was done in the same team as the rest of the content moderation, and there were specially trained staff members for this purpose. Moderators also had the option to escalate conspicuous videos to another team in Beijing, which could decide to block the account.

TikTok did not provide any statement on how many users were internally blacklisted and why their accounts were not blocked or suspended. TikTok also did not answer our question about how many users were subsequently blocked due to the age limit.

The company responded to our detailed questions with the following written statement: „As our Terms of Service make clear, TikTok is for people aged 13 and above. We have an age-gate system in place that asks people to provide their age to determine if they are eligible to use our platform. In addition, our policy has always been that, if we become aware that someone under 13 is using TikTok, we will promptly suspend their account.“

User rate was visible in the source code

Until March of this year, the category „user_rate“ was also visible in the app’s source code: where users left comments under the videos of others. This was discovered by security researchers of the Australian Strategic Policy Institute (ASPI) when they examined the app. TikTok used a numerical system and for most users, the user rate was set to 1. However, some users had different numerical values. ASPI and netzpolitik.org were unable to find out more about what the values stand for and TikTok did not provide any information on request.

With an update in March the „user_rate“ disappeared from the source code of the comments section. Instead, there is now a new field: „user_buried“. The value can be set to „true“ or „false“. TikTok did not give any comment on what this value stands for.

TikTok has repeatedly been criticized for suppressing certain users or videos, especially through so-called shadowbanning. When a user is shadowbanned, their videos or comments are not deleted, but become invisible to all but the banned. The corresponding category in the internal moderation guidelines of TikTok was called „visible to self“.

Shadowbanning can be one way to keep bullies and trolls at bay. The intervention is difficult to prove, both for those affected and for outsiders. Shadowbanned users might only notice that their videos don’t get any views or that no one responds to their comments.

A quarter of all 10-year-olds use the app

Recent date shows how many children are actually on TikTok: In Denmark, 4 out of 10 children between the ages of 9 and 14 are supposed to use the app every day, according to a recent survey by Danish Broadcasting Corporation DR. In Germany, according to a study by Bitkom, a quarter of all 10- to 11-year-olds used the app, among the 12- to 13-year-olds it was almost a third. The figures are from 2019, and are likely to be even higher today.

Now the Danish data protection authority has intervened. They are investigating whether TikTok possibly violates data protection laws in the country. In Denmark, users under the age of 13 are only allowed to register with an app like TikTok with their parents‘ consent. TikTok is not doing enough to ensure that this is the case, a lawyer for the authority told DR.

The data protection authorities in the Netherlands and France have also initiated proceedings. They are also concerned about the way TikTok handles children’s data.

In Denmark, TikTok this week blocked the account of 12-year-old user Lianna Riedel Frank, who had more than 10,000 followers – but only after DR reported on her. She used TiKTok with her mother’s consent.

TikTok has already been fined in the US

TikTok has already paid millions for the careless handling of children’s data. In 2019, the US authorities imposed a record fine of 5.7 million dollars on TikTok for collecting data from children under the age of 13 without parental consent.

As part of the settlement, TikTok agreed to set up a special service for children under the age of 13 that would only be available in the United States and promised to remove all uploaded videos of these users.

However, according to a new complaint filed with the U.S. Consumer Protection and Competition Commission (FTC), TikTok has not fulfilled its obligations.

Currently, TikTok is on the verge of being shut down in the United States after Donald Trump issued two decrees against the company.

More control for parents

In April, TikTok introduced new control mechanisms for parents. Using the „family pairing“ mode parents can limit the screen-time for their children, filter videos from the stream or determine who can send them messages. In addition, since the end of April, only users aged 16 and over can send and receive direct messages in the app.

The data protection authorities are well aware of the dilemma of young people and their parents. „For many users this is an important way of staying in touch with friends and spending time together during the Corona crisis,“ the Dutch data protection authorities wrote in a statement. At the same time, it writes that children and young people are particularly vulnerable and therefore need to be particularly well protected. Preliminary results of the investigation there are expected later this year.