By its recent Order No. 248 of July 7, 2022, the Authority ruled on the user data collection policies for advertising purposes of TikTok, the famous Chinese video-sharing platform.
In the light of the information provided by TikTok, the Authority warned the Chinese platform that such a change of legal basis, at least with regard to the information stored on users’ devices, must be considered incompatible with the e-Directive. -Privacy and with Article 122 of the Personal Data Protection Code, provisions which clearly require the consent of the data subject, to the processing of personal data, as a legal basis for storing or accessing information already stored.
The Authority also took the opportunity to worry about the protection offered to minors registered on the social network. Indeed, given the difficulty of TikTok in ensuring that its users have exceeded the minimum age required to access the platform, it is not, according to the Authority, possible to prevent such advertising personalized message reaches even the youngest subjects and potentially suggests videos with inappropriate content.
TikTok’s non-compliance with the e-Privacy Directive allowed the Authority to act outside the cooperation procedure provided for by the General Data Protection Regulation (“GDPR”), i.e. say without the intervention of the Irish Data Protection Authority, the country where TikTok has its main establishment. The Authority urged TikTok to back down from its intent, reserving the right to take further action, including urgent action, if it fails to do so.
Following the Authority’s warnings, the famous video-sharing platform has postponed the launch of personalized advertising based on legitimate interest for people over the age of eighteen. In view of TikTok’s response, the Authority declared itself open “to a dialogue aimed at finding a balance between economic interests and user rights”.