The Authority admonishes the famous video-sharing platform TikTok

With its recent Order No. 248 of 7 July 2022, the Authority ruled on the user data collection policies for advertising purposes of TikTok, the famous Chinese video-sharing platform.

The measure comes at the end of a preliminary investigation, initiated following the social network's announcement of a change in its privacy policy applying to all users in the European Economic Area, the United Kingdom and Switzerland. Specifically, as of 13 July, TikTok proposed to send personalised advertising to people over the age of 18 without the data subject's explicit consent for the processing of personal data, using, as legal justification, the so-called legitimate interest of the data controller.

In light of the information provided by TikTok, the Authority warned the Chinese platform that such a change of legal basis, at least in relation to the information stored on users' devices, is to be considered incompatible with the E-Privacy Directive and with Article 122 of the Personal Data Protection Code, provisions which clearly require the consent of the data subject, to the processing of personal data, as the legal basis for storing or accessing information already stored.

The Authority also took the opportunity to express concern about the protection offered to minors registered on the social network. In fact, in view of TikTok's difficulty in ascertaining that its users are above the minimum age required to access the platform, it is not, according to the Authority, possible to avoid the possibility that such personalised advertising reaches even the youngest subjects and potentially suggesting videos with inappropriate content.

TikTok’s failure to comply with the E-Privacy Directive allowed the Authority to act outside the cooperation procedure provided for by the General Data Protection Regulation ('GDPR'), i.e. without the intervention of the Irish Data Protection Authority, the country where TikTok has its main establishment.  The Authority urged TikTok to withdraw from its intention, reserving the right to take further measures, including urgent ones, should it fail to do so.

Following the Authority’s warnings, the famous video-sharing platform postponed the debut of personalised advertising based on legitimate interest for individuals over the age of eighteen. In light of TikTok's response, the Authority declared itself open "to a dialogue aimed at finding a balance between economic interests and users' rights".