For children under 13, TikTok has created a ‘younger users’ version of the app to comply with the Children’s Online Privacy Protection Act (COPPA) that limits what data the app can collect from them. It is not a redesign of the app made for kids, but rather an absence of features from the regular version.
Less data is collected from TikTok’s younger users compared to users aged 13 and over. Younger users also cannot publicly share personal information, including videos or profile details.
What data does TikTok collect?
For users of all ages, TikTok collects the user’s username and password; date of birth; email and/or phone number. It also collects the device ID; IP address; web browser type and version; location (down to country level); video watches; time in the app; and general usage data.
For users over the age of 13, much more data is collected, including a profile photo, profile video, and any information disclosed on the user’s profile. On the device front, it also collects data relating to the user agent; mobile carrier; time zone settings; identifiers for advertising purposes; model of device; the device system; network type; screen resolution and operating system; app and file names and types; keystroke patterns or rhythms; battery state; audio settings; and connected audio devices.
Location data is more granular too, based on the user’s SIM card and/or IP address, and more precise location data, such as GPS. Additional in-app activity data collected for those aged over 13 includes preferences, list of followers, and list of those the user is following.
For older users, TikTok also collects photographs; audios, and videos the user uploads or creates; comments and livestreams made by the user; and clipboard data. It also collects data on in-app purchases, including purchases made; the date and time when purchases were made; and the amount spent; as well as payment card numbers or third-party payment information, such as PayPal. Finally, for users aged over 13, TikTok collects their phone contact list and Facebook contact list.
VPNOverview.com advises parents to take precautions when setting up an account for a young child, such as using an avatar instead of a selfie for their profile picture, as this is visible to everyone, whether their account is public or private. It also advises going into the privacy security settings to ensure that the child has a private account, so that only users they approve can follow their account and watch videos.
“Ensuring a child’s safety on the internet can be a tedious undertaking. After all, why would a ten-year-old care about data security? Chances are they won’t. They just want to watch funny videos on their phone,” the company said. “We should all stay vigilant and critical about what kind of data these apps are collecting and where they may be using them. ‘Free’ apps and services still need to make money, so if users aren't paying for services, it is likely that they’ll be making money elsewhere – by sharing your data with third parties.”