Skip to main contentTikTok: children’s privacy defaults
The DPC found infringements involving children’s public-by-default accounts, Family Pairing, transparency and fairness. It imposed €345 million in fines.
Case record
- Irish Data Protection Commission
- GDPR, Articles 5, 12, 13, 24 and 25
- DPC decision of 1 September 2023; appeal recorded by DPC
- 1 September 2023
- €345,000,000 · Administrative fines in cited decision
- 16 October 2026
What this record establishes
This page describes the cited regulatory action, rather than auditing the organisation’s current systems. A fine or order in the cited decision is not proof of payment or a complete history of later proceedings and appeals.
Checks for your own systems
Inth’s technical interpretation: use this case to choose what evidence to collect in your own implementation. These checks are not instructions issued by the court or regulator.
- Create age-appropriate test accounts and inspect initial visibility and sharing settings.
- Test family-pairing permissions and changes across devices and existing accounts.
- Check that the language and choice flow match the protections described for each age group.
- Compare the clicks, fields and identity checks required for acceptance and refusal.
- Confirm that refusal and withdrawal change the resulting requests and storage.
Sources and limits
Source review: 16 October 2026. This record covers the cited source and procedural stage. It does not audit the organisation’s present implementation or establish every later legal development.