ICO probes social media platforms on teen data privacy

The Information Commissioner's Office (ICO) has launched investigations into several leading social media platforms, including TikTok, Reddit, and Imgur, to examine how they handle personal information of teenage users. This development has sparked discussions about data privacy and the potential for increased scrutiny and claims related to the improper use of children's data.

The focus on TikTok comes as no surprise, according to William Richmond-Coggan, a partner at Freeths LLP who specialises in data protection and technology. He notes that the ICO is likely prioritising its resources to ensure that any interventions have a significant impact, especially on platforms with massive user bases.

However, Richmond-Coggan warns that smaller organisations should not see this as an indication that they can operate without oversight. He emphasises that the ICO's Children's Code and legislation like the Online Safety Act impose serious obligations on any businesses that collect substantial quantities of children's data or offer services appealing to young audiences.

Richmond-Coggan also highlights that the increased scrutiny and potential claims are not limited to larger companies. He notes that while smaller businesses might fly under the radar unless a breach occurs, litigation is already emerging in the UK and other regions concerning the harmful impacts of TikTok's algorithms on young users. He suggests prudent businesses will preemptively ensure compliance to avoid becoming regulatory examples, particularly as more concerned parents and young people may choose to take legal action independently.

Alongside the ICO, Ofcom is taking measures to combat illegal content on social media platforms. Platforms are being urged to outline their strategies for addressing such content, underlining the importance of proactive risk assessments. Mark Jones, a partner at Payne Hicks Beach, references Ofcom Chief Executive Melanie Dawes' remarks about the need for swift regulatory action. Jones suggests there is public expectation for Ofcom to wield its regulatory powers decisively to mitigate online harms.

Ofcom's stance is further clarified by its enforcement director, who has characterised risk assessments as essential first steps toward platform safety. However, it is emphasised that these assessments must be critically reviewed by Ofcom to avoid becoming mere bureaucratic exercises. Without active engagement from the regulator in scrutinising these risk assessments, there is concern that the process will remain ineffective, further intensifying calls for a revision of the Online Safety Act.

As social media giants and smaller tech firms alike navigate this intensified regulatory landscape, the potential ramifications of these investigations are vast. Industries handling youth data must not only address current regulatory expectations but also anticipate evolving legal and societal standards to safeguard their operations and public trust. Both the ICO's and Ofcom's current and future actions will serve as crucial indicators of how the UK might navigate the balance between fostering innovation and ensuring public safety in the digital age.