The immensely popular social media app TikTok has been collecting sensitive information from hundreds of thousands of Canadians under 13 years old, a joint investigation by privacy authorities found.
The investigation — launched by the federal privacy commissioner and his counterparts in Quebec, British Columbia and Alberta — looked into the video app’s privacy practices as they relate to younger users and whether “valid and meaningful” consent is being obtained for the collection, use and disclosure of personal information.
TikTok’s terms of service prohibit users under the age of 13 (14 in Quebec) from using the platform.
However, “as a result of TikTok’s inadequate age-assurance measures, the company collected the personal information of a large number of Canadian children, including information that the offices consider to be sensitive,” said the report.
It also found TikTok failed to adequately explain its collection and use of biometric information, such as facial and voice data, in the context of its video, image and audio analysis.
Michael Harvey, information and privacy commissioner for British Columbia, said they were “struck by exactly how elaborate” TikTok’s profiling was.
He said biometrics were used in combination with location data to “create elaborate inferences about who the users were, about things like what their spending power was and use that, to then decide what content, including advertising, to feed back to them.”
“Obviously that’s super sensitive when it comes to children and youth. But we don’t think that even adults had a reasonable expectation that this was happening,” Harvey said.
Depending on the content users upload or view, TikTok may also collect sensitive information about their health, political opinions, gender identity and sexual orientation.
“We noted with concern during a demonstration of TikTok’s advertising portal, the potential for advertisers to target users based on their transgender status,” the report flagged.
“TikTok claimed that this was not supposed to be possible but was unable to explain how or why this option had been available.”
During a Tuesday news conference in Ottawa, Canadian privacy commissioners shared findings of a joint investigation into TikTok’s policies concerning users under 13. Michael Harvey, information and privacy commissioner for British Columbia, said the company has been using face and location data from children for targeted advertising.
Federal Privacy Commissioner Philippe Dufresne said Canadians in general need to better understand how much sensitive data TikTok gleans from its users and decide if they are comfortable using the app.
TikTok requires users to expressly accept its terms and conditions and privacy policy, but the report found that consent when it came tracking, profiling, targeting and content personalization “was not valid or meaningful.”
Dufresne said “there’s certain things that we find just goes too far,” when users are under the age of 13 — even if they hit “agree.”
The investigation uncovered that TikTok removes approximately 500,000 underage Canadian users each year, but given that TikTok’s internal age moderation practices are limited if users do not post content, “it is highly likely that many more underage users access and engage with the platform without being detected.”
TikTok agrees to make changes
The report said TikTok was already collecting a wide array of information from children even before they were detected and removed from the platform.
The privacy commissioners said TikTok agreed to enhance its age verification and provide up-front notices about its wide-ranging collection of data.
The company also agreed to “effectively stop” allowing advertisers to target users under the age of 18, except based on broad categories such as language and approximate location, said the report.
In a statement, TikTok spokesperson Danielle Morgan said “while we disagree with some of the findings, we remain committed to maintaining strong transparency and privacy practices.”
Dufresne said he and his counterparts will be following up to make sure TikTok delivers on its promises.
Michael Geist, law professor and Canada Research Chair in internet and e-commerce law at the University of Ottawa, said successfully enhancing age verification may prove difficult
“We all know that many kids are gonna be determined to get on some of these platforms,” he said. “That in many respects speaks to the need to ensure that the core rules that the company abides by are fit for purpose and appropriate.”
Geist added that “parents have to play a significant role as well.”
TikTok should say data can go to China: commissioner
The review was triggered in part by an onslaught of media reports and academic probes raising concerns about TikTok’s collection, use and disclosure of personal information.
There are also mounting national security concerns because TikTok’s parent company ByteDance is based in China and subject to its laws requiring Chinese citizens anywhere in the world to assist and co-operate with China’s intelligence services.
While the report did not dive into those broader national security issues, Dufresne said he and the reports’ authors are concerned about data being taken outside of Canada.
“One of our specific recommendations was that the policy should make that more explicit, it should say this information can go to China and be accessed by the Chinese government,” he said.
Canada’s privacy commissioner, Philippe Dufresne, said Tuesday that TikTok has agreed to be more transparent with users that their data can be shared with the Chinese government.
Late last year the Canadian government ordered TikTok to dissolve its Canadian operation following a national security review into ByteDance.
The order, made under the Investment Canada Act, called for the company’s two Canadian offices to shutter, but allows Canadians to still use the app.
Not much has been made public about the national security review’s findings. The government has only said it made its decision based on information and evidence that surfaced during the review and on the advice of Canada’s security and intelligence community.
The former head of the Canadian Security Intelligence Service (CSIS), David Vigneault, has publicly warned Canadians — including teenagers — against using the app.
In a CBC News interview in May 2024, the then spy agency director said “there is a very clear strategy on the part of the Government of China” to acquire personal information and that it’s “very clear” from the app’s design that data gleaned from its users is available to the People’s Republic of China.
The federal government’s decision has faced backlash from Canadian creators and artists, who argue losing a Canada-based team hurts their careers and stifles home-grown creativity.
TikTok was previously told it had to sell its U.S. operations or risk being shut down. A deal is currently being negotiated by the Trump administration to sever control of the app from Bytedance.
