Musical.ly Reaches Landmark Settlement With FTC Over Alleged Violations of Children's Online Privacy Laws

Operators of the app, which is now called TikTok, will pay $5.7 million to settle FTC allegations — the largest civil penalty ever obtained by the agency in a children’s privacy case.
Courtesy of Musical.ly

Popular lip-syncing app Musical.ly will pay $5.7 million to settle a lawsuit alleging it is collecting personal information from kids in violation of the Children's Online Privacy Protection Act (COPPA). The settlement marks the largest civil penalty the FTC has ever collected in a children's privacy case.

Musical.ly, which is now known as TikTok, allows users to create videos and sync them with music or audio clips. Since 2014, about 65 million people in the U.S. and 200 million people worldwide have downloaded the app. Until July 2017, the company didn't ask for a user's age as part of the registration process, according to the complaint filed Wednesday by the Department of Justice, and it didn't request that information retroactively from users who signed up before then. 

That's a problem, the government says, because several of the app's default features implicate children's privacy. Unless the relevant settings are changed, profiles are public and all users can direct messages at any other user.

"Indeed, there have been many public reports of adults trying to contact kids via the Musical.ly App," states the complaint. "Until October 2016, the App had a feature where a user could tap on the 'my city' tab, which provided the user with a list of other users within a 50-mile radius, and with whom the user could connect and interact with by following the user or sending direct messages."

The government claims Musical.ly knew its app was popular with children under 13. 

COPPA, which was enacted in 1998, regulates websites and other online services targeted to children that collect personal information. The rule requires companies to post a clear privacy policy on its site or service, give notice directly to parents, obtain verifiable parental consent and delete a child's personal information at the request of his or her parent. 

"Through the Musical.ly App, Defendants collected personal information as defined in the COPPA Rule, including first and last name; online contact information; the content of direct messages between users; photos and videos containing a child’s image and voice, and, for some period of time, geolocation information," states the complaint.

In a statement Wednesday, FTC chairman Joe Simons said he hopes this sends a message: “This record penalty should be a reminder to all online services and websites that target children: We take enforcement of COPPA very seriously, and we will not tolerate companies that flagrantly ignore the law.”

TikTok on Wednesday issued a statement on its blog announcing a change in the platform: "Beginning today, this additional app experience now allows us to split users into age-appropriate TikTok environments, in line with FTC guidance for mixed audience apps. The new environment for younger users does not permit the sharing of personal information, and it puts extensive limitations on content and user interaction."

Feb. 27, 2:15 p.m. Updated with a statement from TikTok.