Italy’s data protection watchdog has ordered TikTok not to process the data of children under the age of 13.
The regulator’s 22 January order cited press reports of the 21 January death of a 10 year-old girl that was linked to her participation on TikTok. According to newspaper la Repubblica, prosecutors in Palermo are investigating whether the girl died while participating in a TikTok asphyxiation challenge.
The Italian data protection authority, known as Garante, said last week that it took “urgent measures” following the death. It has ordered TikTok to stop processing the data of children under the age of 13 until at least 15 February.
It said last week that it stepped in “in order to afford immediate protection to the minors in Italy that have joined the social platform”.
A TikTok spokesperson said the company has received the Garante’s order. "Our deepest sympathies are with the girl's family and friends. At TikTok, the safety of our community – in particular our younger users – is our priority, and we do not allow content that encourages, promotes, or glorifies dangerous behaviour that might lead to injury,” the spokesperson said.
The order was issued as part of a formal investigation the Garante opened into TikTok in late December.
The watchdog said at the time that TikTok failed to protect children’s privacy rights. The platform does not allow children under the age of 13 to create accounts, but the Garante said its sign-up process allowed children to circumvent that ban by entering fake dates of birth.
The Garante last week said it had decided to step in despite not yet having received TikTok’s pleadings. TikTok is banned from processing data relating to any user whose age it cannot verify “with full certainty”.
TikTok recently said Ireland’s Data Protection Commissioner has concluded that the company has its main establishment for GDPR purposes in Ireland, making the commission the platform’s lead regulator for cross-border processing in Europe.
The regulator’s decision is a rare example of a multinational platform receiving a stop-processing order pending the outcome of a full investigation. It is the latest in a series of aggressive moves by the Italian regulator, which has imposed several eight-figure fines against large companies – although the amount actually paid is much lower than the amount that was ordered.
However, the decision comes soon after Ireland’s Data Protection Commission accepted jurisdiction over TikTok’s cross-border processing of European data. Denmark’s data protection authority referred a TikTok case to the Irish regulator a day before the Italian stop-processing order.
The Garante issued its order a day after the Danish authority referred its case to TikTok. The Italian regulator said it will bring its stop-processing order to the attention of the Irish regulator.