TikTok made children's accounts public by default — the Irish DPC fined it €345M

On 15 September 2023 Ireland's Data Protection Commission announced a €345 million fine against TikTok over how it treated child users. The inquiry examined only five months — 31 July to 31 December 2020 — and found that accounts for users aged 13 to 17 were set to public by default on registration, visible to anyone.

The findings ran to eight GDPR violations: holes in the 'Family Pairing' controls meant to link a child's account to a parent, insufficient age verification at sign-up, and too little information given to children about the default settings. After a binding decision by the European Data Protection Board in August 2023, the DPC also found TikTok had used 'dark patterns' — design nudges that push users toward less private choices.

TikTok was reprimanded, ordered to bring its processing into compliance within three months, and fined the largest penalty it has received from any regulator. It said it respectfully disagreed, particularly with the level of the fine, and noted the criticised settings had been changed before the inquiry began — under-16 accounts became private by default in January 2021. The UK's ICO had already fined TikTok £12.7 million in April 2023 over under-13s on the platform.