Joint Privacy Investigation Finds TikTok Collected Children's Data for Algorithmic Profiling and Targeted Advertising

A joint investigation by four federal and provincial privacy commissioners found that TikTok collected personal information of Canadian children for ML-based algorithmic profiling, facial analytics, and targeted advertising without any legitimate purpose — making consent legally irrelevant (Office of the Privacy Commissioner of Canada, 2025; Office of the Information and Privacy Commissioner of Alberta, 2025).

The investigation, announced in February 2023 and published as PIPEDA Findings #2025-003 on September 23, 2025, was a major coordinated privacy enforcement action against an AI system in Canada (Barry Sookman, 2025). The Office of the Privacy Commissioner of Canada led the investigation jointly with Quebec's Commission d'accès à l'information, BC's Office of the Information and Privacy Commissioner, and Alberta's Office of the Information and Privacy Commissioner (Office of the Privacy Commissioner of Canada, 2025).

TikTok operates multiple interconnected ML systems that profiled its 14 million Canadian monthly active users, including children (Office of the Privacy Commissioner of Canada, 2025). Its content recommendation algorithm powers the "For You" feed using behavioural and inferred data. Convolutional neural networks analyze facial features for age and gender estimation. Audio analytics extract additional signals. Multiple age-estimation models — video-level, account-level, advertising, and TikTok LIVE — classify users into demographic segments. These systems collectively inferred users' interests, location, age range, gender, spending power, and — critically — sensitive attributes including health data, political opinions, gender identity, and sexual orientation from content and behaviour patterns (Office of the Privacy Commissioner of Canada, 2025; Office of the Information and Privacy Commissioner of Alberta, 2025).

A central finding was that TikTok's age assurance mechanisms were inadequate (CBC News, 2025; Global News, 2025). TikTok relied on three weak measures: a voluntary age gate (easily circumvented by entering a false birthdate), minimal automated keyword scanning that only caught users who posted text, and human moderation triggered by user reports (Office of the Privacy Commissioner of Canada, 2025). Since 73.5% of TikTok users never post videos and 59.2% never comment, the vast majority of underage users — passive consumers of algorithmically recommended content — escaped detection entirely (Office of the Privacy Commissioner of Canada, 2025). TikTok removed approximately 500,000 underage Canadian accounts per year, but commissioners concluded the actual number of underage users was "likely much higher" (Office of the Privacy Commissioner of Canada, 2025). In Quebec, 40% of children aged 6–17 and 17% of children aged 6–12 had TikTok accounts (Office of the Privacy Commissioner of Canada, 2025).

The commissioners found that TikTok possessed sophisticated AI-based age-detection capabilities but did not deploy them to prevent underage access (Office of the Privacy Commissioner of Canada, 2025; Office of the Information and Privacy Commissioner of Alberta, 2025). BC Commissioner Michael Harvey noted the "elaborate profiling" involving facial and voice data combined with location data to "create inferences about spending power" — capabilities that demonstrated TikTok could identify children but did not deploy those tools for protection (CBC News, 2025).

TikTok's advertising targeting system exposed sensitive attributes. Hashtags like "#transgendergirl" and "#transgendersoftiktok" were available as ad targeting options, enabling advertisers to target users based on transgender status (Office of the Privacy Commissioner of Canada, 2025). TikTok was unable to explain why these hashtags had been available and later confirmed they "should not have been available" (Office of the Privacy Commissioner of Canada, 2025).

The commissioners also found that TikTok disclosed that affiliate companies and employees in China could access personal information collected from Canadian users — a finding that commentators noted had national security dimensions given the contemporaneous Investment Canada Act order (November 2024) to wind up TikTok Technology Canada Inc (Office of the Privacy Commissioner of Canada, 2025).

TikTok was directed to implement three new "demonstrably effective" age assurance mechanisms within six months, cease allowing advertisers to target users under 18, provide a youth-specific plain-language privacy summary, publish a privacy video for teen users, implement a "Privacy Settings Check-up" for all Canadian users, and submit monthly compliance updates (Office of the Privacy Commissioner of Canada, 2025; Office of the Information and Privacy Commissioner of Alberta, 2025). TikTok disagreed with the findings but committed to implementing all recommendations. The matter is conditionally resolved pending fulfilment.

A proposed privacy class action was commenced in the Supreme Court of British Columbia in October 2025 by Siskinds LLP against ByteDance and TikTok entities.