Cybersecurity Policy Report, Canadian Regulators Press TikTok to Improve Privacy, Protection of Kids, (Sep 24, 2025)
TikTok’s Canadian division has agreed to improve its privacy practices and adopt new measures to ensure that underage users are kept off the platform following a joint investigation by privacy authorities for Canada, Québec, British Columbia, and Alberta.
Canada’s Office of the Privacy Commissioner (OPC) and the three provincial privacy offices “found that the measures in place to keep children off the popular video-sharing platform and to prevent the collection and use of their sensitive personal information for profiling and targeting purposes were inadequate,” the OPC said in a news release.
“Even though the company has stated that its platform is not intended for people under the age of 13, the investigation found that hundreds of thousands of Canadian children access TikTok’s platform each year—and that TikTok has been collecting and using their personal information,” the OPC said.
“Although the joint investigation was focused on children, it also found that TikTok did not adequately explain its data practices to teen and adult users, nor did it obtain meaningful consent for the collection and use of vast amounts of user data, including sensitive data of younger users, as required under Canadian privacy laws,” it added.
The investigation determined that TikTok was in violation of Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and corresponding provincial laws. The privacy officials didn’t impose a penalty on the company but obtained commitments from TikTok that would bring it into compliance.
TikTok agreed, among other things, to ensure that its Canadian platform would provide “the highest level of privacy by default” and to improve its privacy disclosures “to support meaningful consent” and inform users of “its collection, use, and disclosure of personal information for the purposes of targeted advertising and content personalization as enabled by tracking and profiling,” according to the OPC’s findings.
To address the use of the platform by children under the age of 13, TikTok agreed to implement new age assurance techniques, the OPC said.
Previously, TikTok simply asked new users to enter their birthdates and used “human moderation of user accounts flagged as potentially belonging to an underage user by either (a) an automated tool that searched for language indicating that a user may be underage, or (b) reports by other users.”
Those and other techniques were likely to be ineffective at identifying underage “lurkers”—users who didn’t post content, the OPC noted. TikTok pledged to develop a new way to identify lurkers by looking for “patterns of behaviour from previously identified underage user accounts,” it said. TikTok said its “passive underage user detection model” would be an “industry first,” the OPC added.
“TikTok generally disagreed with our findings, asserting that it was in most respects, through a combination of its existing practices and associated communications, compliant” with PIPEDA and the provincial privacy laws, the OPC said.
The company also claimed it would be difficult to configure its Canadian platform to implement all of the privacy officials’ recommendations, according to the OPC. “That said, the company confirmed that it would work with the Offices to implement the other recommendations set out above in an expedited manner in order to resolve the matter,” it noted.
The OPC will monitor TikTok’s adoption of the corrective measures and considers the case to be “conditionally resolved,” it said.
“TikTok is one of the most prevalent social media applications used in Canada, and it is collecting vast amounts of personal information about its users, including a large number of Canadian children,” Privacy Commissioner Philippe Dufresne said.
“The investigation has revealed that personal data profiles of youth, including children, are used at times to target advertising content directly to them, which can have harmful impacts on their well-being,” he said.
“This investigation also uncovered the extent to which personal information is being collected and used, often without a user’s knowledge or consent,” he added. “This underscores important considerations for any organization subject to Canadian privacy laws that designs and develops services, particularly for younger users.”
News: InternationalLegislation LitigationEnforcement DataPrivacy