13 ms·

Why Are Creators Paying for TikTok’s Mistake?

181 points by panarky 8y ago

darkpuma 8y ago
It seems to be TikTok should be castigated for the first two mistakes (allowing children on their platform, and implementing the birth date dialog poorly.) However their response to that second error seems sane to me. If they're going to reactivate accounts closed for being too young, shouldn't they make an attempt to verify the age of the person reopening the account? I doubt the FTC would be amused if TikTok started permitting 12 year olds to reopen their accounts with no form of attempted verification. Also I'm not quite sure I buy the argument that the birth date dialog was bugged. Defaulting it to the current date is dumb, but was it really non-functional for some users? Really? Or did some users just click past it unthinking, annoyed that they were being asked something without bothering to stop and look at what they were being asked? The later seems more likely to me. These users would doubtlessly be annoyed, but what really can be done about that scenario? Those users should take it as a learning experience and be thankful TikTok is a thoroughly frivolous platform so they lost nothing of worth this time.
- panarky 8y ago
  > was it really non-functional for some users? Really? What matters is the result, not some technicality like whether the form worked correctly in every browser. And the result was bad. No users were actually zero days old but they got their videos deleted just the same. When you get bad results, don't blame the user for not understanding your system. It's always a bad design. See also: Boeing 737 Max
  - darkpuma 8y ago
    What's the minimum age do you think? You've got toddlers running around with ipads. I know they use youtube, they might be using tiktok as well.
    - josefresco 8y ago
      TikTok assumed that what my daughter entered was correct. The birth date she saved made her 5 months old.
- tfehring 8y ago
  If it's possible to click through a form with all defaults retained, you should assume that some users will do so. It's probably also safe to assume that deleting their account and all of their uploaded content is not the typical user expected behavior from doing so. I don't think the problem was defaulting to the current date. No default is probably better in general for this sort of thing, and in hindsight it definitely would have been better in this case. But for a field for which you really need the user to provide a value, if you're going to set a default, that default should be obviously and universally invalid (the current date qualifies for that when you're asking for DOB), and you should have logic in place to deal with obviously invalid inputs.
  - darkpuma 8y ago
    Sure. But even if they did that form right, they'd still have some adults flip the year a few years, some falling short of 13. At that point they get banned because that's what the FTC requires, so what procedure do you use to let them appeal? Asking for an ID seems reasonable to me.
    - tfehring 8y ago
      I agree that the appeals decision is a little bit tricky and that asking for an ID is probably the best option in those cases. But I'd bet that some very basic, sensible validation would have reduced the number of those cases by orders of magnitude.
      - darkpuma 8y ago
        You could ask for a CC or something like that, which wouldn't be bulletproof but probably reasonably good enough. But I think you'd still have the EFF complaining that not everybody has a credit card, particularly teenagers, just like they object to the photo ID requirement. Asking for a photo ID was probably easier for them than asking for a credit car though, since with the credit card method they now have to worry about PCI compliance. Getting themselves out of one regulatory shithouse by walking into another probably wasn't something they were eager to do. They could ask the appealing user to upload a quick video of themselves requesting the appeal, and then use common sense to grant the appeal to people who reasonably appeared to be adults. That might make the FTC upset with them a second time though, since you'd doubtlessly have kids filming and uploading appeal videos, which would probably put TikTok back in violation of COPPA... I don't think asking for a link to other social media like facebook would help, because even though Facebook is presumably in compliance with COPPA, somebody having an account on Facebook and being in compliance with COPPA doesn't necessarily mean they are >13 years old; their parent or legal guardian could have given them permission to use facebook, but not tiktok. So you can't assume that control of a facebook account means they're >13 or have parental approval to use your service. There might be other ways out of this mess, but I can't think of any at the moment.
- PhasmaFelis 8y ago
  > These users would doubtlessly be annoyed, but what really can be done about that scenario? Easy--never create an input field where clicking through on the default value is guaranteed to do something the user doesn't want, irreversibly. That's terrible design.
  - darkpuma 8y ago
    That doesn't really solve the problem, only reduces the magnitude of it. You'd still have 30 year olds entering something like 2010 as their birth date just because they're impatient, didn't care to provide their real birth date, and didn't realize the significance of the question. They'd go from "wtf stop asking me questions" to "you don't need to know that about me" to "wtf I'm locked out?" in about 5 seconds flat. And I don't think there is anything you can do about that. If they implemented a second chance system ("are you sure about that? input a different year or we're going to lock your account") it sounds like that would be another violation of COPPA, defeating the point of the whole ordeal.
    - PhasmaFelis 8y ago
      Of course good design won't solve every single user problem, but it will solve a lot of them, and we have a responsibility to do that.
- josefresco 8y ago
  > Also I'm not quite sure I buy the argument that the birth date dialog was bugged Sorry to break it to you, but this happened to my daughter. Defaulted to 2018, she saved quickly (assuming her birth year was the default) without noticing.
manfredo 8y ago
Age requirements for any web app always struck me as a joke. I'm sure everyone is telling the truth when they click "I am over 13/18 years old".
- chrisseaton 8y ago
  It takes it from 'we didn't even bother asking' to 'the person actively lied to us when we tried to do the right thing'. Seems like a big difference in responsibility to me.
  - manfredo 8y ago
    I don't deny that TikTok made a mistake. I'm pointing out that in practice throwing up an age gate changes nothing. Sure, it's a dirt simple way of avoiding responsibility and TikTok should have at least done that much (doubly so since a whole story arc about this was aired on Silicon Valley). But if we really care about keeping under 13-year-olds from using these web apps or having their data collected then a more robust system of verification should be implemented.
    - SiempreViernes 8y ago
      Yeah, like what was the lowest age their ad targeting tools would go?
    - londons_explore 8y ago
      I think the point is nobody really cares about stopping 12 year olds using the service. The 12 year old themselves wants to use the service. The service wants to be used. Most parents want their child to be able to do what they think is fun. The only people against it are the people who don't want to properly supervise their children online, but also don't want them disadvantaged, so want the entire online service banned so nobody gets access.
      - DanBC 8y ago
        COPPA isn't about preventing children accessing the service, it's about protecting their right not to have their personal data gathered and sold. Wikipedia has a reasonable summary: https://en.wikipedia.org/wiki/Children%27s_Online_Privacy_Protection_Act https://en.wikipedia.org/wiki/Children%27s_Online_Privacy_Pr...
kccqzy 8y ago
Seems to me that they totally forgot about COPPA when designing the app, and then hastily added the age verification in response to the FTC fine. Didn't test the change properly, rolled it out, and disaster ensued.
koala_man 8y ago
>defaulted to putting in the current date while also not making crystal clear to users why it needed that information and what could result It's been years since I've worked with COPPA, but isn't it illegal both to 1. default to e.g. 1970-01-01 so that accepting implies you're of age, and 2. for your prompt to be "You must be 13+ to use this service. If you are under 13 your videos will be deleted. What is your birthday?" because you're basically encouraging kids to lie?
- dimal 8y ago
  It's been a while since I dealt with COPPA, but I'm almost positive you're correct.
  - darkpuma 8y ago
    The FTC's FAQ page on COPPA compliance concurs: https://www.ftc.gov/tips-advice/business-center/guidance/complying-coppa-frequently-asked-questions https://www.ftc.gov/tips-advice/business-center/guidance/com... >If you choose to block children under 13 on your general audience site or service, you should take care to design your age screen in a manner that does not encourage children to falsify their ages to gain access to your site or service. Ask age information in a neutral manner at the point at which you invite visitors to provide personal information or to create a user ID. > In designing a neutral age-screening mechanism, you should consider: [...] Avoiding encouraging children to falsify their age information, for example, by stating that visitors under 13 cannot participate or should ask their parents before participating. In addition, simply including a check box stating, “I am over 12 years old” would not be considered a neutral age-screening mechanism.
- mediumdeviation 8y ago
  Just leave it blank and force the user to explicitly enter something? I don't see how defaulting to the current date is ever useful for date of birth from a user interface design perspective.
  - londons_explore 8y ago
libraryatnight 8y ago
Tangent: I don't trust TikTok. I notice "they" use bots on other media platforms to post gifs/images with their logo (Imgur was getting this a lot) to drive people to their platform. Couple that with that we now know how Russia (and ostensibly others) are using social media platforms for manipulation, and it just seems rather suspicious. I'm probably just being tinfoil hat paranoid, but I feel like memes are basically vehicles for propaganda and we should be cautious with where we spend our time.
- SiempreViernes 8y ago
  If you don’t trust tik tok then please use their platform as the paranoia will make you prudently cautious. There really isn’t much reason to treat any social media company as trustworthy, or the networks themselves as inherently safe and healthy. Both Syria and Christchurch provide ample evidence for the dangers they can transmit.
- judge2020 8y ago
  > "they" use bots on other media platforms to post gifs/images with their logo Are you sure these are bots? They might just be regular users that download these videos through the app. No matter what, when you download a video on TikTok, it downloads you a watermarked version.
  - libraryatnight 8y ago
    I can't speak for every post, but there are plenty that are bots. At first I thought the same, because I noticed people leaving notes on these posts like "Don't upvote, bot" (not that it ever mattered) but I wasn't sure - so whenever I saw tiktok I started checking account histories and nearly every time it was an account with no activity other than maybe one or two failed tiktok posts, then one successful front page post. There'd also be posts that took already successful FP content, and reposted it with the tiktok branding. Not very scientific, but it was enough at the time for me to sort of take note.
  - ratling 8y ago
    I was going to say this. TikTok makes it trivially easy to download content by default. I've probably got a couple hundred videos in my photo library now.
tropdrop 8y ago
It's mind boggling that they just "forgot" about COPPA. Out of curiosity I browse the Snapchat scrolling feed from time to time, and since a few months ago I have been inundated with TikTok ads. 90% of them seem to be targeting teenagers, featuring pre- to early teens, dancing in front of the camera and flicking rubber bands at folded pieces of paper with Sharpied messages on them. Something like - "to all the boys who think I'm cute..." (note 1, rubber band flick) "wait till you see..." (note 2, flick to reveal third note, which is covered up by the TikTok logo that prompts you to download to find out the rest). It seems more likely to me that they just followed the classic "move fast and break things," gambling that no one noticed.
- hombre_fatal 8y ago
  The last time I encountered a COPPA opt-in was on the register.php page of a vBulletin forum where you had to enter your birthdate. It doesn't boggle my mind. I'm sure very few services online would stand up to scrutiny. It's just that such few platforms are ever in that position.
  - darkpuma 8y ago
    Are you sure your not just mentally filtering it out? I see "[checkbox] I agree that I am 13 years old or the legal guardian blah blah blah" pretty frequently on signup pages.
    - hombre_fatal 8y ago
      That's possible, but not that I can tell. Neither Twitter.com, Reddit.com, nor Pornhub.com ask, for example. Though, TikTok is a video platform with immense popularity among children. Put those two together and you're bound to be first on this sort of COPPA chopping block, so I suppose I do see how OP's mind could be boggled after all. Maybe it's "just" a fine of $5.7 million.
      - johnbatch 8y ago
        Reddit terms that you agree to when creating an account say: “Children under the age of 13 are not allowed to create an account or otherwise use the Services.” https://www.redditinc.com/policies/user-agreement https://www.redditinc.com/policies/user-agreement
rayraegah 8y ago
The problem isn't they forget, it's more along the lines of their culture. In China, they do the {thing} first then apologise. On a related note, TikTok is just a rebranded version of DouYin [0] which was originally built by a small group of young programmers called Beijing Shaking Youth [1]. It wasn't until their recent funding [2] they sent up an office in the USA by which time the damage had already been done. Not only do they violate laws their app is riddled with dark patterns by US standards (all of which btw is normal in China). If you go on LinkedIn and look up Jobs in Los Angeles you'll notice TikTok has 1200+ open positions. You'll also notice they're hiring people specifically to develop policies for each region. [0] https://Douyin.com https://Douyin.com [1] https://www.reddit.com/r/OutOfTheLoop/comments/9iy84y/whats_up_with_the_app_tik_tok/e6o2iwx https://www.reddit.com/r/OutOfTheLoop/comments/9iy84y/whats_... [2] https://techcrunch.com/2018/08/08/bytedance-is-raising-2-5b-3b/ https://techcrunch.com/2018/08/08/bytedance-is-raising-2-5b-...
- nickpsecurity 8y ago
  " In China, they do the {thing} first then apologise." That's startup culture in the U.S., too. It was popularized by the likes of Facebook, Uber, and Airbnb. Chinese companies also do their own version of it.
- voldacar 8y ago
  >their app is riddled with dark patterns by US standards (all of which btw is normal in China) I've never used tiktok, could you give a few examples?
- zanny 8y ago
  "its easier to ask forgiveness than permission" is an ancient tenant of business at this point
- _bxg1 8y ago
  "they do the thing first then apologize" This isn't Chinese culture, this is what any capitalist willing to accept some risk does. If anything, they learned it from us.
bredren 8y ago
This reminds me of a great quote from Tropic Thunder: "Behold, God's mistake!" Anyhow, interesting to see the eff getting in on what it perceives as a dark UI pattern. I ran through this age check screen and had no problem. I do not see a profound issue with creators that rushed through it having to submit gov ID. If the account is that valuable, teenagers can get ID. Frankly, they should probably have one anyway.
Smoosh 8y ago
I keep getting SMS text messages from TikTok several times a week even though I have never used the service. They are in the format: [#][TikTok] 1234 is your verification code aBcDefGhij1 At first I assumed these were someone accidentally or deliberately giving TikTok my phone number when registering. But if they never got the code, How could they activate the account? So why would they (or others) keep using my number? I read online that it may be a confirmation needed to delete an account. But that implies that TikTok accepted my phone number without verification. And again, if the person didn't get the code, what good did using my phone number do them? All very dubious.
- kapitalx 8y ago
  I remember years ago, at a startup, we had a person complaining that they were getting SMSs from us several times a day. It turned out that we had a test that wasn't properly mocked, it also used a 'fake' number which was actually a real person (should always use 555 numbers in tests). So every time the tests were run, this user would get an SMS similar to what you are getting.
  - klntsky 8y ago
    > should always use 555 numbers in tests ...And don't give your test suite access to the real world.
  - josefresco 8y ago
    Reminds of me a "spa confirmation" I got to my email a few weeks back from a spa 3,000+ miles from me. We called to clarify and they embarrassingly admitted that they used our email address, assuming it wasn't a legit address. The funny part is my email address is not generic like testguy@gmail.com. It was an amusing call.
- teknologist 8y ago
  This could be a way to get their name out there? And claim it's a bug in their verification system or something if anyone asks.
ratling 8y ago
"Users logging in for the first time after the order were prompted to give their birthdate, but TikTok’s own interface defaulted to putting in the current date while also not making crystal clear to users why it needed that information and what could result." If you can't work a birthdate field in 2019 you should not be on the internet.
- PhasmaFelis 8y ago
  Don't blame the user for terrible design.
- josefresco 8y ago
  My daughter did this by accident - she'd run rings around you on the Internet.
- SmellyGeekBoy 8y ago
  Have you never had your phone slip in your hand and hit something you didn't mean to?
fouc 8y ago
The mistake here is not the prior lack of COPPA compliance. The mistake here is their rushed implementation of the compliance. Why do I feel like many companies, in the exact same situation, would have also messed up? Aggressively deleting accounts of even older users due to messing up birthdate collection, with no recourse is such a bone headed move. Falling back to defensively asking for government ID can't really be counted as recourse.
fattypouch 8y ago
Great job Dinesh.
Benjammer 8y ago
This is the same exact thing that happened to Dinesh and PiperChat on Silicon Valley...
leowoo91 8y ago
When I get into Youtube from a private browser, it shows videos in my country. What if I'm under 13? Clearly it's using my IP and it doesnt ask whether I'm 13 or older?
- DanBC 8y ago
  COPPA isn't about banning people under 13 from the app. It's about gathering personal information from those users, and about letting them delete their content. This means if you're under 13 you can watch videos on YouTube, but you can't create an account or use notifications or subscriptions. THis does create weird things though. Children like that notification bell, and so they use their parent's accounts. This means advertisers think the person viewing the videos is over 18, and that it's okay to show ads for alcohol or gambling. That's not ok in the UK, and the regulator tells advertisers to be more careful when placing ads.
- asdff 8y ago
  "Please sign in to verify age" pops up all the time on youtube, it depends on the content.
- SmellyGeekBoy 8y ago
  They're not collecting personally identifying information so what's the problem?
roonyh 8y ago
>The FTC required TikTok to “destroy” the “personal information” of any account belonging to someone currently 13 or under... If they are required to "destroy" the data, how can they restore it after proving age using a government ID?
- GunlogAlm 8y ago
  I thought that too, but perhaps only personal data is deleted irrecoverably, allowing them to retrieve other/periphery account data; maybe an account's "fans" aren't considered personal data, for instance? I'm not familiar with TikTok, admittedly. Otherwise, perhaps there was some delay on account deletion?
  - londons_explore 8y ago
    A 30 day delay on deletion is commonplace
caymanjim 8y ago
Creators are paying for TikTok's mistake because TikTok made even more mistakes in attempting to comply with COPPA. Why does the EFF care about this?
- GunlogAlm 8y ago
  Why wouldn't the EFF concern itself with the careless and disorganised response of a digital company to online privacy legislation?
  - jessaustin 8y ago
    I support EFF from time to time, but ISTM this case could have inspired some reflection on the not-completely-graceful COPPA regulation itself, in addition to the low-calorie castigation of the latest Chinese-origin USA moral panic. How effective is COPPA in meeting its stated goals? Could it be more effective, with fewer undesirable side effects like those described here?
helloindia 8y ago
Related: “New hunting ground for paedophiles: Chinese apps” https://m.timesofindia.com/india/new-hunting-ground-for-paedophiles-chinese-apps/articleshow/66758462.cms?utm_source=contentofinterest&utm_medium=text&utm_campaign=cppst https://m.timesofindia.com/india/new-hunting-ground-for-paed...
justforfunhere 8y ago
I think COPPA applies to US only. TikTok is doing fine elsewhere in the world. Anyway, I wonder how big a market US is for TikTok?
Albert500 8y ago
I’m Albert a hacker who has built a very good reputation and undeniably one of the best hackers you can come across.i have got access to hack into any account and also get to generate passwords for accounts like Facebook,Instagram,Twitter,gmail,yahoo mail,whats-app,we-chat,etc.Retrieving hacked social media accounts,clearing criminal records,increase credit scores,CC hack,hack bank accounts for transfers and credit card top ups,application hacking.We do custom software and web development in php, java, asp.net etc.hacking computer systems,Website hack,Catch hacker scammers,Phishing emails, that's to mention a few.You can contact me on. Email ... Theredhackergroup@gmail.com Whatsapp...+17867089974 or TEXT:571 318 9498 Best Online hacker with 100% guarantee and money back return policy for 48hours.
sigi45 8y ago
Oh yes someone is asking the real questions here! Wait
josefresco 8y ago
Having gone through this just recently I feel compelled to comment. I feel this isn't being discussed more, because parents are ashamed they allowed their children to use the service (I am not). ===== My kids started on Musical.ly before other social media. Private accounts, IRL friends only. My daughter, a TikTok user was prompted one day to enter her birthdate. Not thinking too much about it (and without asking me), she did so. She entered her birth DAY but used the current year: 2018 (see the article). Should be an easy fix right? Despite this obvious error (do 5 month olds really use the app?) she was now locked out. tears We requested a copy of all her videos. TikTok sent a text file to our email with a list of MP4 URLS. I downloaded a browser extension to help auto-download this rather extensive list. My daughter now has a new account, with a just old enough age to not get locked out again. sigh ===== TikTok literally built a billion dollar business on kids and are now giving them the boot.
kazinator 8y ago
> We hope online service providers of all stripes learn from TikTok’s mistakes. Right; heaven forbid the users should learn a lesson about stuffing content into someone's walled garden.

181 points by panarky 8y ago

It seems to be TikTok should be castigated for the first two mistakes (allowing children on their platform, and implementing the birth date dialog poorly.) However their response to that second error seems sane to me. If they're going to reactivate accounts closed for being too young, shouldn't they make an attempt to verify the age of the person reopening the account? I doubt the FTC would be amused if TikTok started permitting 12 year olds to reopen their accounts with no form of attempted verification. Also I'm not quite sure I buy the argument that the birth date dialog was bugged. Defaulting it to the current date is dumb, but was it really non-functional for some users? Really? Or did some users just click past it unthinking, annoyed that they were being asked something without bothering to stop and look at what they were being asked? The later seems more likely to me. These users would doubtlessly be annoyed, but what really can be done about that scenario? Those users should take it as a learning experience and be thankful TikTok is a thoroughly frivolous platform so they lost nothing of worth this time.

panarky 8y ago
> was it really non-functional for some users? Really? What matters is the result, not some technicality like whether the form worked correctly in every browser. And the result was bad. No users were actually zero days old but they got their videos deleted just the same. When you get bad results, don't blame the user for not understanding your system. It's always a bad design. See also: Boeing 737 Max
- darkpuma 8y ago
  What's the minimum age do you think? You've got toddlers running around with ipads. I know they use youtube, they might be using tiktok as well.
  - josefresco 8y ago
    TikTok assumed that what my daughter entered was correct. The birth date she saved made her 5 months old.
tfehring 8y ago
If it's possible to click through a form with all defaults retained, you should assume that some users will do so. It's probably also safe to assume that deleting their account and all of their uploaded content is not the typical user expected behavior from doing so. I don't think the problem was defaulting to the current date. No default is probably better in general for this sort of thing, and in hindsight it definitely would have been better in this case. But for a field for which you really need the user to provide a value, if you're going to set a default, that default should be obviously and universally invalid (the current date qualifies for that when you're asking for DOB), and you should have logic in place to deal with obviously invalid inputs.
- darkpuma 8y ago
  Sure. But even if they did that form right, they'd still have some adults flip the year a few years, some falling short of 13. At that point they get banned because that's what the FTC requires, so what procedure do you use to let them appeal? Asking for an ID seems reasonable to me.
  - tfehring 8y ago
    I agree that the appeals decision is a little bit tricky and that asking for an ID is probably the best option in those cases. But I'd bet that some very basic, sensible validation would have reduced the number of those cases by orders of magnitude.
    - darkpuma 8y ago
      You could ask for a CC or something like that, which wouldn't be bulletproof but probably reasonably good enough. But I think you'd still have the EFF complaining that not everybody has a credit card, particularly teenagers, just like they object to the photo ID requirement. Asking for a photo ID was probably easier for them than asking for a credit car though, since with the credit card method they now have to worry about PCI compliance. Getting themselves out of one regulatory shithouse by walking into another probably wasn't something they were eager to do. They could ask the appealing user to upload a quick video of themselves requesting the appeal, and then use common sense to grant the appeal to people who reasonably appeared to be adults. That might make the FTC upset with them a second time though, since you'd doubtlessly have kids filming and uploading appeal videos, which would probably put TikTok back in violation of COPPA... I don't think asking for a link to other social media like facebook would help, because even though Facebook is presumably in compliance with COPPA, somebody having an account on Facebook and being in compliance with COPPA doesn't necessarily mean they are >13 years old; their parent or legal guardian could have given them permission to use facebook, but not tiktok. So you can't assume that control of a facebook account means they're >13 or have parental approval to use your service. There might be other ways out of this mess, but I can't think of any at the moment.
PhasmaFelis 8y ago
> These users would doubtlessly be annoyed, but what really can be done about that scenario? Easy--never create an input field where clicking through on the default value is guaranteed to do something the user doesn't want, irreversibly. That's terrible design.
- darkpuma 8y ago
  That doesn't really solve the problem, only reduces the magnitude of it. You'd still have 30 year olds entering something like 2010 as their birth date just because they're impatient, didn't care to provide their real birth date, and didn't realize the significance of the question. They'd go from "wtf stop asking me questions" to "you don't need to know that about me" to "wtf I'm locked out?" in about 5 seconds flat. And I don't think there is anything you can do about that. If they implemented a second chance system ("are you sure about that? input a different year or we're going to lock your account") it sounds like that would be another violation of COPPA, defeating the point of the whole ordeal.
  - PhasmaFelis 8y ago
    Of course good design won't solve every single user problem, but it will solve a lot of them, and we have a responsibility to do that.
josefresco 8y ago
> Also I'm not quite sure I buy the argument that the birth date dialog was bugged Sorry to break it to you, but this happened to my daughter. Defaulted to 2018, she saved quickly (assuming her birth year was the default) without noticing.

manfredo 8y ago

Age requirements for any web app always struck me as a joke. I'm sure everyone is telling the truth when they click "I am over 13/18 years old".

chrisseaton 8y ago
It takes it from 'we didn't even bother asking' to 'the person actively lied to us when we tried to do the right thing'. Seems like a big difference in responsibility to me.
- manfredo 8y ago
  I don't deny that TikTok made a mistake. I'm pointing out that in practice throwing up an age gate changes nothing. Sure, it's a dirt simple way of avoiding responsibility and TikTok should have at least done that much (doubly so since a whole story arc about this was aired on Silicon Valley). But if we really care about keeping under 13-year-olds from using these web apps or having their data collected then a more robust system of verification should be implemented.
  - SiempreViernes 8y ago
    Yeah, like what was the lowest age their ad targeting tools would go?
  - londons_explore 8y ago
    I think the point is nobody really cares about stopping 12 year olds using the service. The 12 year old themselves wants to use the service. The service wants to be used. Most parents want their child to be able to do what they think is fun. The only people against it are the people who don't want to properly supervise their children online, but also don't want them disadvantaged, so want the entire online service banned so nobody gets access.
    - DanBC 8y ago
      COPPA isn't about preventing children accessing the service, it's about protecting their right not to have their personal data gathered and sold. Wikipedia has a reasonable summary: https://en.wikipedia.org/wiki/Children%27s_Online_Privacy_Protection_Act https://en.wikipedia.org/wiki/Children%27s_Online_Privacy_Pr...

kccqzy 8y ago

Seems to me that they totally forgot about COPPA when designing the app, and then hastily added the age verification in response to the FTC fine. Didn't test the change properly, rolled it out, and disaster ensued.

koala_man 8y ago

>defaulted to putting in the current date while also not making crystal clear to users why it needed that information and what could result It's been years since I've worked with COPPA, but isn't it illegal both to 1. default to e.g. 1970-01-01 so that accepting implies you're of age, and 2. for your prompt to be "You must be 13+ to use this service. If you are under 13 your videos will be deleted. What is your birthday?" because you're basically encouraging kids to lie?

dimal 8y ago
It's been a while since I dealt with COPPA, but I'm almost positive you're correct.
- darkpuma 8y ago
  The FTC's FAQ page on COPPA compliance concurs: https://www.ftc.gov/tips-advice/business-center/guidance/complying-coppa-frequently-asked-questions https://www.ftc.gov/tips-advice/business-center/guidance/com... >If you choose to block children under 13 on your general audience site or service, you should take care to design your age screen in a manner that does not encourage children to falsify their ages to gain access to your site or service. Ask age information in a neutral manner at the point at which you invite visitors to provide personal information or to create a user ID. > In designing a neutral age-screening mechanism, you should consider: [...] Avoiding encouraging children to falsify their age information, for example, by stating that visitors under 13 cannot participate or should ask their parents before participating. In addition, simply including a check box stating, “I am over 12 years old” would not be considered a neutral age-screening mechanism.
mediumdeviation 8y ago
Just leave it blank and force the user to explicitly enter something? I don't see how defaulting to the current date is ever useful for date of birth from a user interface design perspective.
- londons_explore 8y ago

libraryatnight 8y ago

Tangent: I don't trust TikTok. I notice "they" use bots on other media platforms to post gifs/images with their logo (Imgur was getting this a lot) to drive people to their platform. Couple that with that we now know how Russia (and ostensibly others) are using social media platforms for manipulation, and it just seems rather suspicious. I'm probably just being tinfoil hat paranoid, but I feel like memes are basically vehicles for propaganda and we should be cautious with where we spend our time.

SiempreViernes 8y ago
If you don’t trust tik tok then please use their platform as the paranoia will make you prudently cautious. There really isn’t much reason to treat any social media company as trustworthy, or the networks themselves as inherently safe and healthy. Both Syria and Christchurch provide ample evidence for the dangers they can transmit.
judge2020 8y ago
> "they" use bots on other media platforms to post gifs/images with their logo Are you sure these are bots? They might just be regular users that download these videos through the app. No matter what, when you download a video on TikTok, it downloads you a watermarked version.
- libraryatnight 8y ago
  I can't speak for every post, but there are plenty that are bots. At first I thought the same, because I noticed people leaving notes on these posts like "Don't upvote, bot" (not that it ever mattered) but I wasn't sure - so whenever I saw tiktok I started checking account histories and nearly every time it was an account with no activity other than maybe one or two failed tiktok posts, then one successful front page post. There'd also be posts that took already successful FP content, and reposted it with the tiktok branding. Not very scientific, but it was enough at the time for me to sort of take note.
- ratling 8y ago
  I was going to say this. TikTok makes it trivially easy to download content by default. I've probably got a couple hundred videos in my photo library now.

tropdrop 8y ago

It's mind boggling that they just "forgot" about COPPA. Out of curiosity I browse the Snapchat scrolling feed from time to time, and since a few months ago I have been inundated with TikTok ads. 90% of them seem to be targeting teenagers, featuring pre- to early teens, dancing in front of the camera and flicking rubber bands at folded pieces of paper with Sharpied messages on them. Something like - "to all the boys who think I'm cute..." (note 1, rubber band flick) "wait till you see..." (note 2, flick to reveal third note, which is covered up by the TikTok logo that prompts you to download to find out the rest). It seems more likely to me that they just followed the classic "move fast and break things," gambling that no one noticed.

hombre_fatal 8y ago
The last time I encountered a COPPA opt-in was on the register.php page of a vBulletin forum where you had to enter your birthdate. It doesn't boggle my mind. I'm sure very few services online would stand up to scrutiny. It's just that such few platforms are ever in that position.
- darkpuma 8y ago
  Are you sure your not just mentally filtering it out? I see "[checkbox] I agree that I am 13 years old or the legal guardian blah blah blah" pretty frequently on signup pages.
  - hombre_fatal 8y ago
    That's possible, but not that I can tell. Neither Twitter.com, Reddit.com, nor Pornhub.com ask, for example. Though, TikTok is a video platform with immense popularity among children. Put those two together and you're bound to be first on this sort of COPPA chopping block, so I suppose I do see how OP's mind could be boggled after all. Maybe it's "just" a fine of $5.7 million.
    - johnbatch 8y ago
      Reddit terms that you agree to when creating an account say: “Children under the age of 13 are not allowed to create an account or otherwise use the Services.” https://www.redditinc.com/policies/user-agreement https://www.redditinc.com/policies/user-agreement

rayraegah 8y ago

The problem isn't they forget, it's more along the lines of their culture. In China, they do the {thing} first then apologise. On a related note, TikTok is just a rebranded version of DouYin [0] which was originally built by a small group of young programmers called Beijing Shaking Youth [1]. It wasn't until their recent funding [2] they sent up an office in the USA by which time the damage had already been done. Not only do they violate laws their app is riddled with dark patterns by US standards (all of which btw is normal in China). If you go on LinkedIn and look up Jobs in Los Angeles you'll notice TikTok has 1200+ open positions. You'll also notice they're hiring people specifically to develop policies for each region. [0] https://Douyin.com https://Douyin.com [1] https://www.reddit.com/r/OutOfTheLoop/comments/9iy84y/whats_up_with_the_app_tik_tok/e6o2iwx https://www.reddit.com/r/OutOfTheLoop/comments/9iy84y/whats_... [2] https://techcrunch.com/2018/08/08/bytedance-is-raising-2-5b-3b/ https://techcrunch.com/2018/08/08/bytedance-is-raising-2-5b-...

nickpsecurity 8y ago
" In China, they do the {thing} first then apologise." That's startup culture in the U.S., too. It was popularized by the likes of Facebook, Uber, and Airbnb. Chinese companies also do their own version of it.
voldacar 8y ago
>their app is riddled with dark patterns by US standards (all of which btw is normal in China) I've never used tiktok, could you give a few examples?
zanny 8y ago
"its easier to ask forgiveness than permission" is an ancient tenant of business at this point
_bxg1 8y ago
"they do the thing first then apologize" This isn't Chinese culture, this is what any capitalist willing to accept some risk does. If anything, they learned it from us.

bredren 8y ago

This reminds me of a great quote from Tropic Thunder: "Behold, God's mistake!" Anyhow, interesting to see the eff getting in on what it perceives as a dark UI pattern. I ran through this age check screen and had no problem. I do not see a profound issue with creators that rushed through it having to submit gov ID. If the account is that valuable, teenagers can get ID. Frankly, they should probably have one anyway.

Smoosh 8y ago

I keep getting SMS text messages from TikTok several times a week even though I have never used the service. They are in the format: [#][TikTok] 1234 is your verification code aBcDefGhij1 At first I assumed these were someone accidentally or deliberately giving TikTok my phone number when registering. But if they never got the code, How could they activate the account? So why would they (or others) keep using my number? I read online that it may be a confirmation needed to delete an account. But that implies that TikTok accepted my phone number without verification. And again, if the person didn't get the code, what good did using my phone number do them? All very dubious.

kapitalx 8y ago
I remember years ago, at a startup, we had a person complaining that they were getting SMSs from us several times a day. It turned out that we had a test that wasn't properly mocked, it also used a 'fake' number which was actually a real person (should always use 555 numbers in tests). So every time the tests were run, this user would get an SMS similar to what you are getting.
- klntsky 8y ago
  > should always use 555 numbers in tests ...And don't give your test suite access to the real world.
- josefresco 8y ago
  Reminds of me a "spa confirmation" I got to my email a few weeks back from a spa 3,000+ miles from me. We called to clarify and they embarrassingly admitted that they used our email address, assuming it wasn't a legit address. The funny part is my email address is not generic like testguy@gmail.com. It was an amusing call.
teknologist 8y ago
This could be a way to get their name out there? And claim it's a bug in their verification system or something if anyone asks.

ratling 8y ago

"Users logging in for the first time after the order were prompted to give their birthdate, but TikTok’s own interface defaulted to putting in the current date while also not making crystal clear to users why it needed that information and what could result." If you can't work a birthdate field in 2019 you should not be on the internet.

PhasmaFelis 8y ago
Don't blame the user for terrible design.
josefresco 8y ago
My daughter did this by accident - she'd run rings around you on the Internet.
SmellyGeekBoy 8y ago
Have you never had your phone slip in your hand and hit something you didn't mean to?

fouc 8y ago

The mistake here is not the prior lack of COPPA compliance. The mistake here is their rushed implementation of the compliance. Why do I feel like many companies, in the exact same situation, would have also messed up? Aggressively deleting accounts of even older users due to messing up birthdate collection, with no recourse is such a bone headed move. Falling back to defensively asking for government ID can't really be counted as recourse.

fattypouch 8y ago

Great job Dinesh.

Benjammer 8y ago

This is the same exact thing that happened to Dinesh and PiperChat on Silicon Valley...

leowoo91 8y ago

When I get into Youtube from a private browser, it shows videos in my country. What if I'm under 13? Clearly it's using my IP and it doesnt ask whether I'm 13 or older?

DanBC 8y ago
COPPA isn't about banning people under 13 from the app. It's about gathering personal information from those users, and about letting them delete their content. This means if you're under 13 you can watch videos on YouTube, but you can't create an account or use notifications or subscriptions. THis does create weird things though. Children like that notification bell, and so they use their parent's accounts. This means advertisers think the person viewing the videos is over 18, and that it's okay to show ads for alcohol or gambling. That's not ok in the UK, and the regulator tells advertisers to be more careful when placing ads.
asdff 8y ago
"Please sign in to verify age" pops up all the time on youtube, it depends on the content.
SmellyGeekBoy 8y ago
They're not collecting personally identifying information so what's the problem?

roonyh 8y ago

>The FTC required TikTok to “destroy” the “personal information” of any account belonging to someone currently 13 or under... If they are required to "destroy" the data, how can they restore it after proving age using a government ID?

GunlogAlm 8y ago
I thought that too, but perhaps only personal data is deleted irrecoverably, allowing them to retrieve other/periphery account data; maybe an account's "fans" aren't considered personal data, for instance? I'm not familiar with TikTok, admittedly. Otherwise, perhaps there was some delay on account deletion?
- londons_explore 8y ago
  A 30 day delay on deletion is commonplace

caymanjim 8y ago

Creators are paying for TikTok's mistake because TikTok made even more mistakes in attempting to comply with COPPA. Why does the EFF care about this?

GunlogAlm 8y ago
Why wouldn't the EFF concern itself with the careless and disorganised response of a digital company to online privacy legislation?
- jessaustin 8y ago
  I support EFF from time to time, but ISTM this case could have inspired some reflection on the not-completely-graceful COPPA regulation itself, in addition to the low-calorie castigation of the latest Chinese-origin USA moral panic. How effective is COPPA in meeting its stated goals? Could it be more effective, with fewer undesirable side effects like those described here?

helloindia 8y ago

Related: “New hunting ground for paedophiles: Chinese apps” https://m.timesofindia.com/india/new-hunting-ground-for-paedophiles-chinese-apps/articleshow/66758462.cms?utm_source=contentofinterest&utm_medium=text&utm_campaign=cppst https://m.timesofindia.com/india/new-hunting-ground-for-paed...

justforfunhere 8y ago

I think COPPA applies to US only. TikTok is doing fine elsewhere in the world. Anyway, I wonder how big a market US is for TikTok?

Albert500 8y ago

I’m Albert a hacker who has built a very good reputation and undeniably one of the best hackers you can come across.i have got access to hack into any account and also get to generate passwords for accounts like Facebook,Instagram,Twitter,gmail,yahoo mail,whats-app,we-chat,etc.Retrieving hacked social media accounts,clearing criminal records,increase credit scores,CC hack,hack bank accounts for transfers and credit card top ups,application hacking.We do custom software and web development in php, java, asp.net etc.hacking computer systems,Website hack,Catch hacker scammers,Phishing emails, that's to mention a few.You can contact me on. Email ... Theredhackergroup@gmail.com Whatsapp...+17867089974 or TEXT:571 318 9498 Best Online hacker with 100% guarantee and money back return policy for 48hours.

sigi45 8y ago

Oh yes someone is asking the real questions here! Wait

josefresco 8y ago

Having gone through this just recently I feel compelled to comment. I feel this isn't being discussed more, because parents are ashamed they allowed their children to use the service (I am not). ===== My kids started on Musical.ly before other social media. Private accounts, IRL friends only. My daughter, a TikTok user was prompted one day to enter her birthdate. Not thinking too much about it (and without asking me), she did so. She entered her birth DAY but used the current year: 2018 (see the article). Should be an easy fix right? Despite this obvious error (do 5 month olds really use the app?) she was now locked out. tears We requested a copy of all her videos. TikTok sent a text file to our email with a list of MP4 URLS. I downloaded a browser extension to help auto-download this rather extensive list. My daughter now has a new account, with a just old enough age to not get locked out again. sigh ===== TikTok literally built a billion dollar business on kids and are now giving them the boot.

kazinator 8y ago

> We hope online service providers of all stripes learn from TikTok’s mistakes. Right; heaven forbid the users should learn a lesson about stuffing content into someone's walled garden.