TikTok – €750,000 Fine (Netherlands, 2021)

The Dutch DPA (Autoriteit Persoonsgegevens, 'AP'), launched an ex officio investigation into the processing of personal data by TikTok Inc (TikTok), which is based in California, USA. TikTok operates the TikTok app, which allows users to create, edit, and share short videos online. TikTok processes a large amount of personal data via the app, including: User ID, name/nickname, user settings, user generated content (e.g. videos, messages, contents), IP address, mobile carrier, time zone settings, App version, device model, device system, network type, device ID, screen resolution, operating system, and appID. A large group of Dutch children under the age of 16 use the TikTok app, some of whom are around 12 years old. When a user creates a TikTok account, they are informed in Dutch that they are agreeing to TikTok's Privacy Policy. However, the AP's investigation revealed that between 25 May 2018, and 28 July 2020, TikTok provided its Privacy Policy to Dutch users - including children - only in English. This was true both during the registration process, as well as when a user is logged in and wants to consult the Privacy Policy in the TikTok app. Since 29 July 2020, TikTok has provided its Privacy Policy to Dutch data subjects in Dutch. It also provides a separate document that is appropriate for Dutch speaking children in terms of language and form. The AP found that TikTok Inc. infringed Article 12(1) GDPR during the period from 25 May 2018 to 28 July 2020, by only providing its Privacy Policy to Dutch children in English. Article 12(1) GDPR provides that the controller shall take appropriate measures to provide any information relating to the processing of personal data to data subject's in a concise, transparent, and intelligible and easily accessible form, using clear and plain language, in particular for information addressed specifically to a child. Under the WP29's Guidelines on Transparency, TikTok is required to know its intended audience and ide