We review vendors based on rigorous testing and research but also take into account your feedback and our affiliate commission with providers. Some providers are owned by our parent company.
Learn more
vpnMentor was established in 2014 as an independent site reviewing VPN services and covering privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: ExpressVPN, CyberGhost, and Private Internet Access which may be ranked and reviewed on this website. The reviews published on vpnMentor are believed to be accurate as of the date of each article, and written according to our strict reviewing standards that prioritize the independent, professional and honest examination of the reviewer, taking into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings and reviews we publish may also take into consideration the common ownership mentioned above, and affiliate commissions we earn for purchases through links on our website. We do not review all VPN providers and information is believed to be accurate as of the date of each article.
Advertising Disclosure

vpnMentor was established in 2014 as an independent site reviewing VPN services and covering privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: ExpressVPN, CyberGhost, and Private Internet Access which may be ranked and reviewed on this website. The reviews published on vpnMentor are believed to be accurate as of the date of each article, and written according to our strict reviewing standards that prioritize the independent, professional and honest examination of the reviewer, taking into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings and reviews we publish may also take into consideration the common ownership mentioned above, and affiliate commissions we earn for purchases through links on our website. We do not review all VPN providers and information is believed to be accurate as of the date of each article.

TikTok Faces $379M Fine in EU Over Children’s Data Privacy

TikTok Faces $379M Fine in EU Over Children’s Data Privacy
Keira Waddell Published on 19th September 2023 Senior Writer

TikTok is facing a fine of €345 million (approximately $379 million) from Irish regulators for violations related to the privacy of children’s data. The Irish Data Protection Commission (DPC) issued the fine after conducting an investigation into TikTok’s data handling practices, particularly concerning users aged 13 to 17.

The investigation, initiated in September 2021, was prompted by concerns about TikTok’s compliance with the European Union’s General Data Protection Regulation (GDPR) regarding the data of children. The DPC delved into several key aspects of TikTok’s operations, including default account settings, "Family Pairing" features, and age verification processes.

It was found that TikTok violated eight articles of the GDPR, including breaches related to data processing lawfulness, fairness, and transparency, data minimization, data security, controller responsibility, data protection by design and default, data subjects’ rights to clear communication, and the right to receive information on the recipients of personal data.

Concerningly, the investigation found that TikTok set the accounts of child users to "public" by default. This meant that videos posted by young users were visible to anyone, even individuals outside the platform.

The "Family Pairing" feature was also found to be insufficient. Its purpose is to allow for the linking of children’s accounts with those of adults to facilitate parental control. However, the DPC discovered that 16+ child accounts could be linked to adult profiles that TikTok hadn’t verified as belonging to a parent or guardian. This allowed any adult user to relax the privacy settings on the child’s account, including the enabling of direct messages.

The investigation also raised questions about TikTok’s age verification processes. The report noted that TikTok’s age gate could be “easily circumvented and that the measures applied after users gained access to TikTok were not applied in a sufficiently systematic manner”. However, it did not have sufficient information to conclude a breach in regards to TikTok’s age verification efforts.

In response, TikTok has been ordered to bring its data processing practices into compliance with the GDPR within three months. The company has disputed the decision, arguing that the criticisms mainly pertain to settings that were in place three years ago, and which have already been addressed.

The decision reflects a broader trend of regulatory scrutiny on social media platforms. In 2022, Meta faced a fine of over $400 million for allowing teen Instagram users to sign up for business profiles, inadvertently exposing their contact information to the public.

While TikTok’s €345 million fine is significant, it is notably smaller than Meta’s €1.2 billion fine in 2022 for mishandling data transfers between Europe and the US. However, it still underscores the growing importance of data privacy compliance, especially when safeguarding minors' data in an increasingly digital world.

About the Author

Keira is an experienced cybersecurity and tech writer dedicated to providing comprehensive insights on VPNs, online privacy, and internet censorship.