PIPEDA Findings #2025-003: Joint investigation of TikTok Pte. Ltd. by the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, the Office of the Information and Privacy Commissioner for British Columbia, and the Office of the Information and Privacy Commissioner of Alberta
A joint investigation by the Office of the Privacy Commissioner of Canada (OPC) and provincial privacy regulators (CAI, OIPC BC, OIPC AB) examined TikTok Pte. Ltd.'s compliance with federal and provincial private sector privacy laws. The investigation focused on TikTok's collection, use, and disclosure of personal information for ad targeting and content personalization, with a particular emphasis on practices affecting children. The Offices found that TikTok's age assurance measures were inadequate, leading to the collection and use of sensitive personal information from a large number of underage users for purposes deemed inappropriate. Furthermore, TikTok failed to obtain valid and meaningful consent from both adult and youth users due to unclear, inaccessible, and incomplete privacy communications, including regarding biometric information and cross-border data transfers. The CAI specifically identified contraventions related to Quebec's transparency and privacy-by-default obligations. While TikTok disagreed with the findings, it committed to implementing enhanced age assurance mechanisms, improving privacy communications, and limiting ad targeting for under-18 users. The Offices concluded the matter as well-founded and conditionally resolved, contingent on TikTok's satisfactory implementation of these significant commitments.
- 1Whether TikTok was collecting, using, and disclosing personal information, particularly with respect to children, for an appropriate, reasonable, and legitimate purpose.
- 2Whether TikTok's age assurance mechanisms were effective in preventing underage users from accessing the platform.
- 3Whether TikTok obtained valid and meaningful consent from its users for tracking, profiling, targeting, and content personalization.
- 4Whether TikTok's privacy communications provided sufficient upfront, clear, and comprehensive information to adult users to ensure meaningful consent.
- 5Whether TikTok adequately explained its collection and use of users' biometric information to ensure meaningful consent.
- 6Whether TikTok's privacy communications were adequate to obtain meaningful consent from youth (13-17), considering their cognitive development and potential harms from targeted ads.
- 7Whether TikTok met its obligations under Quebec's Private Sector Act to inform persons concerned about the collection and use of personal information for user profiles, ad targeting, and content personalization.
- 8Whether TikTok ensured that privacy settings provided the highest level of privacy by default under Quebec's Private Sector Act.
- Age assurance measures: Found inadequate
- Consent for data practices: Found invalid and not meaningful
- Privacy communications: Found unclear, inaccessible, and incomplete
- Quebec transparency obligations: Found contravened by CAI
- Quebec privacy-by-default: Found contravened by CAI
- Resolution of complaint: Concluded as well-founded and conditionally resolved
Matter well-founded and conditionally resolved
The Offices found that TikTok contravened federal and provincial privacy laws regarding appropriate purposes for collecting children's data, meaningful consent for all users, and Quebec's transparency and privacy-by-default rules, but TikTok committed to significant corrective actions to address these issues.
TikTok committed to implementing three new enhanced age assurance mechanisms, enhancing its privacy policy and communications (including a "Teen Summary" and "Privacy Highlights Video"), ceasing targeted advertising for under-18 users (except generic categories), implementing a "Privacy Settings Check-up" for Canadian users, and providing monthly updates and Privacy Impact Assessments to the Offices.
- subsection 5(3) PIPEDA
- clause 4.3 Schedule 1 PIPEDA
- clause 4.3.2 Schedule 1 PIPEDA
- section 6.1 PIPEDA
- section 4 Quebec's Private Sector Act
- section 8 Quebec's Private Sector Act
- section 8.1 Quebec's Private Sector Act
- section 9.1 Quebec's Private Sector Act
- section 11 PIPA BC
- section 14 PIPA BC
- section 6 PIPA BC
- section 7 PIPA BC
- section 11 PIPA AB
- section 16 PIPA AB
- section 7 PIPA AB
- section 8 PIPA AB
This summary is informational only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro