Cutting corners: Canadian privacy regulators say TikTok has been collecting sensitive personal data from tens of thousands of children in the country, despite the app's rules prohibiting users under 13 – and under 14 in Quebec – from using the platform. A joint report released by the federal privacy commissioner, along with regulators in Quebec, British Columbia, and Alberta, found that TikTok's practices fell short of Canadian privacy law requirements and failed to obtain meaningful consent from users regarding how their information is collected, analyzed, and shared.
The review determined that TikTok's safeguards for keeping underage users off the platform were inadequate, leading to the collection of data from a large number of Canadian children. Regulators concluded that TikTok amassed information considered particularly sensitive, including biometric data such as facial and voice recognition details, as well as location information.
Depending on the content viewed, the platform may also have captured insights into areas such as health, political beliefs, gender identity, and sexual orientation.
Michael Harvey, British Columbia's information and privacy commissioner, said investigators were surprised by the depth of TikTok's profiling. He explained that the company combined biometric and location information to make "elaborate inferences about who the users were, about things like what their spending power was and use that, to then decide what content, including advertising, to feed back to them."
Harvey told CBC that this type of profiling is especially troubling given TikTok's reach among children and also raises questions about Canadian adults' awareness of the scale of data collection.
The report noted that during a demonstration of TikTok's advertising portal, officials observed the possibility for advertisers to target users based on transgender status. TikTok insisted that such targeting was not intended, but the company could not explain how the option appeared. Regulators also found that consent obtained when users accepted TikTok's terms and conditions was not valid, as it did not provide a meaningful understanding of how data is tracked, analyzed, and monetized.
While TikTok says it deletes around half a million underage Canadian accounts each year, the report noted that many minors likely remain undetected. Accounts that do not post content can often bypass the company's moderation efforts. Regulators found that even before underage accounts were detected and removed, TikTok had already collected detailed activity information from these users.
Law professor Michael Geist of the University of Ottawa said that strengthening age-verification mechanisms will be one of the company's most difficult tasks. "We all know that many kids are gonna be determined to get on some of these platforms," he said, emphasizing that stronger rules on data handling are just as important as detection tools. He added that parental oversight will continue to play an essential role.
Following the findings, TikTok agreed to implement stronger age-screening measures, provide clearer notifications about data use, and curb how advertisers target underage users. The company said it would "effectively stop" customized advertising to those under 18, with permitted targeting limited to general categories such as language and location.
In a statement released through spokesperson Danielle Morgan, TikTok pushed back on several elements of the report but said "we remain committed to maintaining strong transparency and privacy practices." Federal Privacy Commissioner Philippe Dufresne said his office intends to monitor TikTok's follow-through closely.
Beyond privacy-law compliance, the report also highlighted concerns that Canadian data collected on the platform could leave the country. ByteDance, TikTok's Beijing-based parent company, operates under Chinese laws requiring cooperation with state intelligence agencies. Dufresne said policy documents should be more forthcoming on this reality, explaining, "One of our specific recommendations was that the policy should make that more explicit, it should say this information can go to China and be accessed by the Chinese government."
National security officials in Canada have repeatedly warned about TikTok. Former Canadian Security Intelligence Service director David Vigneault told CBC in 2024 that "there is a very clear strategy on the part of the Government of China" to harness personal data and that the app is designed in a way that makes such access unavoidable.
Last year, Ottawa ordered ByteDance to wind down its Canadian subsidiary under the Investment Canada Act following a national security review. That decision requires the company's two Canadian offices to close but still allows consumers in Canada to use the app.
The decision has been criticized by Canadian content creators and artists, who say the absence of a Canadian team undermines their creative opportunities and reduces support for local cultural voices. Similar questions about TikTok's corporate structure remain active in the US, where a deal to sever ties between ByteDance and the app's US operations is still under negotiation.