Joint Privacy Investigation Finds TikTok Collected Children's Data for Algorithmic Profiling and Targeted Advertising

A joint investigation by four federal and provincial privacy commissioners found that TikTok collected personal information of Canadian children for ML-based algorithmic profiling, facial analytics, and targeted advertising without any legitimate purpose — making consent legally irrelevant.

The investigation, announced in February 2023 and published as PIPEDA Findings #2025-003 on September 23, 2025, was the largest coordinated privacy enforcement action against an AI system in Canada. The Office of the Privacy Commissioner of Canada led the investigation jointly with Quebec’s Commission d’accès à l’information, BC’s Office of the Information and Privacy Commissioner, and Alberta’s Office of the Information and Privacy Commissioner.

TikTok operates multiple interconnected ML systems that profiled its 14 million Canadian monthly active users, including children. Its content recommendation algorithm powers the “For You” feed using behavioural and inferred data. Convolutional neural networks analyze facial features for age and gender estimation. Audio analytics extract additional signals. Multiple age-estimation models — video-level, account-level, advertising, and TikTok LIVE — classify users into demographic segments. These systems collectively inferred users’ interests, location, age range, gender, spending power, and — critically — sensitive attributes including health data, political opinions, gender identity, and sexual orientation from content and behaviour patterns.

A central finding was that TikTok’s age assurance mechanisms were critically inadequate. TikTok relied on three weak measures: a voluntary age gate (easily circumvented by entering a false birthdate), minimal automated keyword scanning that only caught users who posted text, and human moderation triggered by user reports. Since 73.5% of TikTok users never post videos and 59.2% never comment, the vast majority of underage users — passive consumers of algorithmically recommended content — escaped detection entirely. TikTok removed approximately 500,000 underage Canadian accounts per year, but commissioners concluded the actual number of underage users was “likely much higher.” In Quebec, 40% of children aged 6–17 and 17% of children aged 6–12 had TikTok accounts.

The commissioners found that TikTok possessed sophisticated AI-based age-detection capabilities but did not deploy them to prevent underage access. BC Commissioner Michael Harvey noted the “elaborate profiling” involving facial and voice data combined with location data to “create inferences about spending power” — capabilities that demonstrated TikTok could identify children but chose not to use those tools for protection.

TikTok’s advertising targeting system exposed sensitive attributes. Hashtags like “#transgendergirl” and “#transgendersoftiktok” were available as ad targeting options, enabling advertisers to target users based on transgender status. TikTok was unable to explain why these hashtags had been available and later confirmed they “should not have been available.”

The commissioners also found that TikTok disclosed that affiliate companies and employees in China could access personal information collected from Canadian users — a finding with national security implications given the contemporaneous Investment Canada Act order (November 2024) to wind up TikTok Technology Canada Inc.

TikTok was directed to implement three new “demonstrably effective” age assurance mechanisms within six months, cease allowing advertisers to target users under 18, provide a youth-specific plain-language privacy summary, publish a privacy video for teen users, implement a “Privacy Settings Check-up” for all Canadian users, and submit monthly compliance updates. TikTok disagreed with the findings but committed to implementing all recommendations. The matter is conditionally resolved pending fulfilment.

A proposed privacy class action was commenced in the Supreme Court of British Columbia in October 2025 by Siskinds LLP against ByteDance and TikTok entities.