ICO launches investigation into use of children's data by social media and video sharing platforms

The ICO is investigating TikTok, Reddit and Imgur for their handling of children's data, particularly concerning how they use personal information to recommend content to 13–17-year-olds and whether their age assurance measures are adequate. 

These investigations are part of a broader effort to ensure that companies are designing digital services that protect children's privacy in accordance with the ICO’s Children's Code and Online Safety Act and whether there have been any data protection breaches.

Key points

• TikTok: The investigation focuses on how TikTok uses the personal information of 13–17-year-olds to make recommendations and deliver suggested content. There are concerns that the data generated by children's online activity could lead to them being served inappropriate or harmful content
• Reddit and Imgur: The investigations into Reddit and Imgur are examining how these platforms use children's personal information and their age assurance measures. Age assurance is crucial for keeping children and their personal information safe online

At this stage, the ICO is investigating whether there have been any infringements of data protection legislation. If sufficient evidence is found that any of these companies have broken the law, the ICO will present this to the companies and obtain their representations before reaching a final conclusion.

Next steps

The ICO will continue to enforce data protection laws and ensure compliance with the Children's Code. The responsibility to keep children safe online lies with the companies offering these services, and the ICO is committed to holding them accountable. 

John Edwards, the UK Information Commissioner, emphasised that while the ICO welcomes the technology and innovation brought by social media companies, it cannot come at the expense of children's privacy. The ICO's ongoing efforts aim to ensure that children's information rights are upheld and that digital services are designed with their safety in mind. 

The ICO is continually pushing changes to the Children’s Code and working closely with Ofcom, which has responsibility for enforcing the Online Safety Act to ensure coordinated efforts of compliance. 

Compliance requirements for the Children’s Code

To comply with the Children's Code, organisations must adhere to several key requirements:

1. Data Protection Impact Assessments ('DPIAs'): Organisations must conduct DPIAs to identify and mitigate risks to children's data privacy. This involves assessing how data is collected, stored, and used, and ensuring that appropriate safeguards are in place
2. Age-appropriate design: Services must be designed with children's best interests in mind. This includes providing clear and accessible privacy information, using child-friendly language, and ensuring that default settings are privacy-protective
3. Data minimisation: Organisations should only collect and retain the minimum amount of personal data necessary for the service. This reduces the risk of data breaches and misuse
4. Parental controls and age verification: Implementing robust age verification mechanisms and parental controls to ensure that children are accessing age-appropriate content and services
5. Transparency and accountability: Organisations must be transparent about their data practices and be accountable for complying with the Children's Code. This includes regular audits and reporting on compliance efforts

Our views

The changes brought about by the Children's Code will have a significant impact on both organisations and children. 

For organisations, there will be a greater emphasis on designing digital services that comply with UK data protection laws and prioritise children's privacy. This may involve implementing stricter age verification processes, limiting data collection, and ensuring that privacy settings are child-friendly by default. 

For children, these changes mean a safer and more secure online environment where their personal information is protected, and they are less likely to be exposed to harmful content or targeted by inappropriate communications. Overall, the Children's Code represents a crucial step towards creating a digital world that respects and protects the privacy of its youngest users.

The changes and the ongoing monitoring and investigations highlight the requirement by online platforms for compliance with data protection legislation, the Online Safety Act and Children’s Code and continuous monitoring of their websites and content to ensure compliance. The onus of compliance is on the companies and in its ongoing efforts to secure compliance and improve online services, the ICO published improvements made by social media platforms following notices from the ICO.

The ICO will continue to gather evidence and invite stakeholders to input into serious risk to children’s privacy and compliance with the data protection legislation and the Children’s Code. The ICO will also engage with parents, carers and children so ensure understanding of actions that can be taken to safeguard children’s privacy. 

The ICO will continue to monitor and, where necessary, enforce (via fines or enforcement powers) the most serious risks to children’s privacy rights on social media and video sharing platforms and work to reduce them.