My child uses TikTok: Should I be worried about their privacy?

Privacy Commissioners’ Report gives plenty of cause for concern

Kids are more online than ever. What used to be a way to conduct research, keep up with friends, and play the occasional game has transformed into a virtual world that is at the centre of life for many kids. Nearly three-quarters of Canadian teens, and many children under the age of 13, use social media.

Data-driven advertising is how social media companies make their money – but how much do you know about the data they collect, and the way they use it? How much do kids know?

On September 23, 2025, Offices of Privacy Commissioners for Canada, British Columbia, Québec, and Alberta published the results of a joint investigation focused on TikTok, one of the most widely used social media platforms among Canadian teens and children.^[1] The investigation was conducted with the ultimate goal of creating “a safer, more transparent online environment for children,” and gives us a glimpse into the vast realm of information collected by TikTok about its users. The Commissioners concluded that TikTok hasn’t been doing enough to protect the privacy of users, namely the hundreds of thousands of Canadian children that access TikTok’s platform each year.^[2]

What is TikTok?

TikTok is one of the world’s most popular social media platforms, offering its users the ability to share and stream short-form videos. It is accessible across Canada via a website and app.

What personal information does TikTok collect from its users and is it sensitive?

Like other social media platforms, TikTok collects vast amounts of personal information from its users, either directly or by deriving it from users’ activities on the platform, and uses this information to target users with advertisements. According to the Commissioners’ report, the types of personal information that TikTok collects, uses and monetizes may include users’:

• profile information (email, phone number, biographical information like name, age, gender);
• user-generated content (videos, images, comments, hashtags, metadata);
• purchase information;
• biometric information via facial and voice analytics;
• engagement with content and ads (searches, browsing habits, view time, time actively using the platform, comments, likes, etc.), from which information on a user’s demographics and interests or behavioural data can be inferred, including health information, political opinions, gender identity and sexual orientation;
• device information (IP address, mobile device information, mobile carrier, operating system data, network information, advertising IDs on mobile devices, system settings, etc.);
• contacts (contact list from device and other social media profiles like Facebook friends, mutual connections, etc.); and
• geolocation information (approximate location, approximated to three-square kilometres).

According to the Commissioners, taken together, this personal information may be sensitive, particularly if it belongs to a child. Accordingly, if exposed or placed in the wrong hands, this kind of intimate data may present a real risk of significant harm to an individual, including, among other things, humiliation and damage to reputation or relationships. By law, this type of information must be safeguarded against unauthorized access, disclosure, and use.^[3]

What did the Privacy Commissioners say about TikTok’s privacy failures?                     

Given the sensitive nature of the personal information it collects, TikTok generally requires the valid and express consent of its users to collect and use their information for advertising purposes. However, the Privacy Commissioners found that TikTok has failed to protect user privacy in several ways, including by:

1. failing to obtain valid and meaningful consent from its users to collect and use their personal information—including the sensitive information of under-age users—for data practices related to tracking, profiling, targeting and content personalization;
   
2. implementing inadequate measures to keep children under the age of 13 off the platform, in violation of its own policies;
   
3. using personal information to deliver targeted content to children, which “can have significant impacts on children’s well-being;”^[4] and
   
4. failing to clearly provide key information to users and their parents about this collection and use of personal information, some of which was hard to find, difficult to read, and not presented in both English and French.

In the face of the Commissioners’ findings that TikTok implemented inadequate measures to prevent the improper collection and use of children’s sensitive personal information for profiling and targeting purposes, among other things, TikTok has agreed to implement enhanced privacy protections for younger users—including age-assurance methods—and strengthen privacy communications to ensure that users understand how their data can be used for these purposes.

Are there steps I can take to protect my child’s personal information when using TikTok and other social media platforms?

TikTok allows you and your child to pair accounts using a Family Pairing feature,^[5] which gives you some access and control over what happens on your child’s account. However, it’s important to note a few things:

1. It’s possible for your child to create multiple accounts. What you see in Family Pairing is only based on the paired account;
   
2. You can’t control every setting or every option, and you can’t control how TikTok uses the data that is shared with it; and
   
3. Once information is shared on the platform, deleting an account only removes the information associated with it from TikTok’s servers after a delay, and may not do anything to protect information that was already shared with a third party.

There are useful guides by advocacy groups and online safety companies for further guidance. One example is: Talking TikTok: A Family Guide | MediaSmarts,^[6] which reminds parents that open conversation with your child about social media use is key. Some information, once shared online, can never be “un-shared,” even by deleting the account from which it was shared.

What should I do if I think my child’s privacy is compromised by a social media platform?

If you are concerned or have been notified that you or your child’s personal information may have been impacted by a social media platform, you may have a legal claim for compensation. Siskinds LLP is here to help.

For more information on your legal rights, or if you have any questions concerning this article please contact me, Stefani Cuberovic, a lawyer in Siskinds LLP’s Class Actions group , by email: [email protected] or telephone: 416.594.4395.

[1] PIPEDA Findings #2025-003: Joint investigation of TikTok Pte. Ltd.

[2] News release: Joint investigation into TikTok highlights privacy concerns related to the collection and use of children’s personal information – Office of the Privacy Commissioner of Canada

[3] You can read more about your privacy rights here.

[4] Backgrounder: Investigation into TikTok and user privacy – Office of the Privacy Commissioner of Canada

[5] TikTok – Family Pairing

[6] This guide is shared for information purposes only and should not be construed as advice from or as endorsed by Siskinds LLP.