TikTok Technology Limited

DPC (Ireland) case IN-21-9-1, decided 2023-09-01. EUR 345,000,000.

What the regulator decided

TikTok's public-by-default account settings and the Family Pairing feature failed to provide age-appropriate protection for users aged 13-17, breaching Articles 5(1)(a), 5(1)(c), 5(1)(f), 12(1), 13(1)(e), 24(1), 25(1) and 25(2) GDPR; consent flows for child users were not presented in an objective, neutral way.

Primary source

Regulator-owned URL. Quote this in legal briefs and academic citations.

https://www.dataprotection.ie/sites/default/files/uploads/2023-09/Inquiry%20into%20TikTok%20Technology%20Limited%20-%20September%202023%20EN.pdf

Archived snapshot

Wayback Machine snapshot of the primary source. Use this when the regulator URL might be refactored or expire.

https://web.archive.org/web/20231017224852/https://www.dataprotection.ie/sites/default/files/uploads/2023-09/Inquiry%20into%20TikTok%20Technology%20Limited%20-%20September%202023%20EN.pdf

ConsentMark interpretation

Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.

Decision followed EDPB Binding Decision 2/2023 (Art. 65) on dispute resolution. The DPC's decisions index lists the case reference as IN-21-9-1 (not IN-21-9-7 as earlier note material had it). Cite alongside BD-02-2023 when the substantive issue is design patterns nudging child consent, not the cookie banner mechanics.

Verification trail

Verified by: donal
Verified at: 2026-05-26
Review due: 2026-11-26

Cite this case

Pick the format that matches where you are pasting. The methodology version is preserved in every variant so the citation stays verifiable after future methodology changes.

BibTeX

@misc{consentmark-precedent-dpc-in-21-9-1,
  author       = {{ConsentMark}},
  year         = {2023},
  title        = {DPC (Ireland) IN-21-9-1 - TikTok Technology Limited},
  howpublished = {\url{https://www.consentmark.com/precedent/dpc-in-21-9-1}},
  note         = {ConsentMark methodology v1.3}
}

APA

ConsentMark. (2023, September 1). DPC (Ireland) IN-21-9-1 - TikTok Technology Limited. Methodology v1.3. https://www.consentmark.com/precedent/dpc-in-21-9-1

Markdown

[DPC (Ireland) IN-21-9-1 - TikTok Technology Limited - ConsentMark](https://www.consentmark.com/precedent/dpc-in-21-9-1)

Plain text

DPC (Ireland) IN-21-9-1 - TikTok Technology Limited - ConsentMark, 2023-09-01, methodology v1.3, https://www.consentmark.com/precedent/dpc-in-21-9-1