The FTC and DOJ sued TikTok and ByteDance for violating COPPA by collecting personal information from children under 13 without parental consent. The complaint alleges that TikTok knowingly allowed millions of children on its platform and failed to comply with a 2019 consent order. The lawsuit seeks civil penalties and a permanent injunction.
The FTC is seeking civil penalties and a permanent injunction against TikTok and ByteDance to prevent future COPPA violations.
In-house legal teams should review customer-facing agreements (Terms of Service, Privacy Policies), data processing agreements (DPAs) with third parties, and any vendor contracts involving data sharing or advertising. Focus on clauses governing consent for personal data collection from minors, age verification procedures, data retention and deletion policies for children's data, and breach notification protocols involving underage users. Given the alleged violation of a 2019 FTC consent order, contracts must be updated to include robust, verifiable parental consent mechanisms, explicit prohibitions on collecting data from users under 13 without compliance, and audit rights to ensure ongoing COPPA adherence. Consider adding indemnification provisions for child privacy violations and requiring subcontractors to follow identical standards.
Entity
TikTok and ByteDance
Also known as: TikTok
Industry
Social MediaOfficial Press Release
https://www.ftc.gov/news-events/news/press-releases/2024/08/ftc-investigation-leads-lawsuit-against-tiktok-bytedance-flagrantly-violating-childrens-privacy-law
bytedance complaint
https://www.ftc.gov/system/files/ftc_gov/pdf/bytedance_complaint.pdf
video social networking app musically agrees settle ftc alle
https://www.ftc.gov/news-events/news/press-releases/2019/02/video-social-networking-app-musically-agrees-settle-ftc-allegations-it-violated-childrens-privacy
Federal Trade Commission Enforcement Page
https://www.ftc.gov/enforcement
"TikTok, its parent company ByteDance, as well as its affiliated companies"
"violating a children’s privacy law—the Children’s Online Privacy Protection Act"
"The FTC Act allows civil penalties up to $51,744 per violation, per day."
"failed to comply with the COPPA requirement to notify and obtain parental consent before collecting and using personal information from children under the age of 13."
"August 2, 2024"
$930K
The FTC finalized orders requiring CMG Media Corporation (doing business as Cox Media Group), MindSift LLC, and 1010 Digital Works LLC to pay a total of $930,000 for falsely claiming they offered an AI-powered service that could target ads based on conversations captured from consumers' smart devices, and that consumers had opted into such targeting. The orders also prohibit the companies from making misrepresentations about their advertising services, voice data collection, and consumer consent.
The FTC announced it is seeking public comment on a proposed enforcement policy statement regarding personalized pricing, which is the use of personal data to set prices based on what a company believes an individual consumer is willing to spend. The statement warns that undisclosed collection or use of personal data for personalized pricing could violate the FTC Act's prohibition on unfair or deceptive practices. The Commission voted 2-0 to authorize the Federal Register notice.
$4.0M
The FTC and Connecticut secured a $4 million settlement with Chase Nissan LLC (doing business as Manchester City Nissan) over allegations the dealership charged consumers unauthorized fees, including double-charging for 'certified pre-owned' vehicles and inserting charges like total loss protection into financing agreements without consent. The settlement requires $4 million in consumer redress, prohibits misrepresentations about vehicle certification and warranties, mandates prominent disclosure of the maximum total vehicle price, and requires express informed consent for all charges.
The FTC filed a complaint against Credit Glory LLC and related entities for deceptive credit repair practices, including false promises, impersonating debt collectors, charging illegal upfront fees, and using negative option billing without consent. A federal court temporarily halted the operation.
The FTC issued a policy statement abandoning disparate-impact liability, stating it will no longer bring claims based on this theory. It also modified compliance obligations for several companies based on past decisions.
The FTC, along with Utah and California, filed a complaint against Hims & Hers alleging the telehealth provider shared consumers' sensitive health information with third-party advertising platforms without consent, and deceived consumers about billing and cancellation practices. The complaint alleges violations of the FTC Act and the Restore Online Shoppers' Confidence Act.