TikTok Hakkında Bağlayıcı Karar

Binding Decision 2/2023 on the dispute submitted by the
Irish SA regarding TikTok Technology Limited (Art. 65 GDPR)

Adopted on 2 August 2023

---

Table of contents
1 Summary of the dispute.................................................................................................................. 4
2 The Right to good administration ................................................................................................... 6
3 Conditions for adopting a binding decision .................................................................................... 7
Objection(s) expressed by CSA(s) in relation to a Draft Decision ........................................... 7
The IE SA does not follow the objections to the Draft Decision or is of the opinion that the
objections are not relevant or reasoned ............................................................................................ 7
Admissibility of the case ......................................................................................................... 8
Structure of the binding decision............................................................................................ 8
4 On the possible additional infringement of Article 5(1)(a) GDPR (the principle of fairness) ......... 9
Analysis by the LSA in the Draft Decision................................................................................ 9
Summary of the objection raised by the CSAs ...................................................................... 12
Position of the LSA on the objection..................................................................................... 15
Analysis of the EDPB ............................................................................................................. 15
4.4.1 Assessment of whether the objection was relevant and reasoned ............................. 15
4.4.2 Assessment on the merits ............................................................................................. 19
5 On the possible infringement of Article 25 GDPR regarding age verification .............................. 26
Analysis by the LSA in the Draft Decision.............................................................................. 26
Summary of the objection raised by the CSA ....................................................................... 30
Position of the LSA on the objection..................................................................................... 33
Analysis of the EDPB ............................................................................................................. 34
5.4.1 Assessment of whether the objection was relevant and reasoned ............................. 34
5.4.2 Assessment on the merits ............................................................................................. 37
6 On the corrective measures .......................................................................................................... 54
Analysis by the LSA in the Draft Decision.............................................................................. 54
Summary of the objections raised by the CSAs .................................................................... 55
Position of the LSA on the objections ................................................................................... 56
Analysis of the EDPB ............................................................................................................. 57
6.4.1 Assessment of whether the objections were relevant and reasoned .......................... 57
6.4.2 Assessment on the merits ............................................................................................. 59
7 Binding Decision ............................................................................................................................ 61
8 Final remarks ................................................................................................................................. 62

Adopted 2

---

The European Data Protection Board

Having regard to Article 63 and Article 65(1)(a) of the Regulation (EU) 2016/679 of the European
Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the
processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC
(hereinafter ‘GDPR’)1,

Having regard to the European Economic Area (hereinafter ‘EEA’) Agreement and in particular to
Annex XI and Protocol 37 thereof, as amended by the Decision of the EEA joint Committee No
154/2018 of 6 July 20182,

Having regard to Article 11 and Article 22 of its Rules of Procedure (hereinafter ‘EDPB RoP’)3,

Whereas:

(1) It follows from Article 60 GDPR that the lead supervisory authority (hereinafter ‘LSA’) shall
cooperate with the other supervisory authorities concerned (hereinafter ‘CSAs’) in an endeavour to
reach consensus, that the LSA and CSAs shall exchange all relevant information with each other, and
that the LSA shall, without delay, communicate the relevant information on the matter to the other
supervisory authorities concerned. The LSA shall without delay submit a draft decision to the other
CSAs for their opinion and take due account of their views.

(2) Where any of the CSAs expressed a reasoned and relevant objection on the draft decision in
accordance with Article 4(24) and Article 60(4) GDPR and the LSA does not intend to follow the
objection or considers that the objection is not reasoned and relevant, the LSA shall submit this matter
to the consistency mechanism referred to in Article 63 GDPR.

(3) The main role of the European Data Protection Board (hereinafter the ‘EDPB’) is to ensure the
consistent application of the GDPR throughout the EEA. Pursuant to Article 65(1)(a) GDPR, the EDPB
shall issue a binding decision concerning all the matters which are the subject of the relevant and
reasoned objections, in particular whether there is an infringement of the GDPR.

(4) The binding decision of the EDPB shall be adopted by a two-thirds majority of the members of the
EDPB, pursuant to Article 65(2) GDPR in conjunction with Article 11(4) EDPB RoP, within one month
after the Chair of the EDPB and the competent supervisory authority have decided that the file is
complete. The deadline may be extended by a further month, taking into account the complexity of
the subject-matter upon decision of the Chair of the EDPB on own initiative or at the request of at
least one third of the members of the EDPB.

(5) In accordance with Article 65(3) GDPR, if, in spite of such an extension, the EDPB has not been able
to adopt a decision within the timeframe, it shall do so within two weeks following the expiration of
the extension by a simple majority of its members.

(6) In accordance with Article 11(6) EDPB RoP, only the English text of the decision is authentic as it is
the language of the EDPB adoption procedure.

1
OJ L 119, 4.5.2016, p. 1.
2
References to ‘Member States’ made throughout this decision should be understood as references to ‘EEA
Member States’.
3
EDPB Rules of Procedure, adopted on 25 May 2018 (current version: adopted on 6 April 2022).

Adopted 3

---

HAS ADOPTED THE FOLLOWING BINDING DECISION

1 SUMMARY OF THE DISPUTE
1. This document contains a binding decision adopted by the EDPB in accordance with
Article 65(1)(a) GDPR. The decision concerns the dispute arisen following a draft decision
(hereinafter, ‘Draft Decision’) issued by the Irish supervisory authority (‘Data Protection
Commission’, hereinafter, the ‘IE SA’, also referred to in this context as the ‘LSA’) and the
subsequent objections expressed by the Italian Supervisory Authority (‘Garante per la protezione
dei dati personali’, hereinafter, the ‘IT SA’) and the German Supervisory Authorities of ‘Berliner
Beauftragte für Datenschutz und Informationsfreiheit’ and ‘Landesbeauftragtefür den Datenschutz
und die Informationsfreiheit Baden-Württemberg’4 (hereinafter, the ‘DE SAs’).

2. The Draft Decision at issue relates to an ‘own volition inquiry’ (IN-21-9-1) (hereinafter, the
‘Inquiry’), the commencement of which was notified by the IE SA to TikTok Technology Limited
(hereinafter, ‘TTL’) on 14 September 20215 and which concerns the compliance by TTL with its
obligations pursuant to Articles 5, 12, 13, 24 and 25 GDPR in the context of its TikTok platform6.

3. TTL is a company established in Dublin, Ireland. The IE SA stated in its Draft Decision that it was
satisfied that the IE SA is the LSA, within the meaning of the GDPR, for TTL, as controller, for the
processing which is the subject of its Inquiry7.

4. TikTok is a video-focused social media platform that allows registered users to create and share
videos of varying durations and to communicate with other users through messages8 (hereinafter,
‘TikTok platform’).

5. The Draft Decision concerns processing by TTL of personal data of registered TikTok platform users
who are aged between 13 and 17 years old, as well as certain issues regarding TTL’s processing of
personal data relating to children under the age of 139.

6. The temporal scope of the Inquiry covers the period between 31 July 2020 and 31 December 2020
(hereinafter, the ‘Relevant Period’)10.

7. The following table presents a summary timeline of the events part of the procedure leading to the
submission of the matter to the consistency mechanism.

7 June 2022 The IE SA issued a preliminary draft decision (hereinafter, the
‘Preliminary Draft Decision’) to TTL on 7 June 2022. The IE SA
invited TTL to provide its views on the Preliminary Draft Decision.

4
The objection was raised by the Berlin SA also on behalf of the Baden - Württemberg SA.
5
Draft Decision, paragraph 22.
6
Draft Decision, paragraphs 3, 32.
7
Draft Decision, paragraph 51.
8
Draft Decision, paragraph 5.
9
Draft Decision, paragraph 32. The term ‘Child Users’ in the Draft Decision is used as a reference to registered
TikTok platform users who are aged between 13 and 17 years old.
10
Draft Decision, paragraph 31.

Adopted 4

---

June - September 2022 On 2 August 2022, TTL provided its submissions on the
Preliminary Draft Decision (hereinafter, ‘TTL PDD
Submissions’)11.

On 11 August 2022, the IE SA made further queries to TTL in
relation to TTL’s submissions; TTL responded on 22 August 2022.

On 7 September 2022, TTL also submitted an expert report.
13 September 2022 The IE SA shared its Draft Decision with the CSAs in accordance
with Article 60(3) GDPR.
October 2022 IT SA and DE SAs raised objections in accordance with
Article 60(4) GDPR12.

Additionally, several CSAs raised comments13.
23 December 2022 The IE SA issued a response setting out its replies to such
objections and shared it with the CSAs (hereinafter, the
‘Composite Response’). The IE SA requested the relevant CSAs to
confirm by 11 January 2023 whether, having considered the
IE SA’s position in relation to the objections as set out in the
Composite Response, the CSAs intended to maintain their
objections. On request, the deadline has been extended until
20 January 2023.
January - March On 11 January 2023, the IT SA confirmed to the IE SA that they
2023 maintain their objection14.

On 20 January 2023, the DE SAs confirmed to the IE SA that they
maintain their objection15.
7 March 2023 The IE SA clarified to TTL its intention to refer the dispute to the
EDPB and invited TTL to exercise its right to be heard in respect
of the objections (and comments) that the IE SA proposed to
refer to the EDPB along with other relevant documents including
the Composite Response and the communications received from
the CSAs in reply to the Composite Response.
April 2023 On 18 April 2023, TTL provided the requested submissions,
including 4 annexes:

11
In addition, on 6 September 2022, TTL provided a table setting out the information in TTL PDD Submissions
which it considers to be confidential and/or commercially sensitive and the supporting reasoning.
12
IT SA Objection, dated 10 October 2022 and DE SAs Objection, dated 11 October 2022.
13
Comment of the Hungarian SA, dated 10 October 2022; comment of the Danish SA, dated 11 October 2022;
comment of the Dutch SA, dated 11 October 2022; comment of the French SA, dated 11 October 2022; and
comment of the Berlin SA, dated 11 October 2022. These comments are not part of this dispute resolution
procedure.
14
Response of the IT SA to the Composite Response, dated 11 January 2023.
15
Response of the DE SAs to the Composite Response, dated 20 January 2023.

Adopted 5

---

 Annex 1: Response to CSAs’ objections and comments
 Annexes 2-3-4: Expert Reports
(hereinafter, ‘TTL Art. 65 Submissions’)16

8. Following the facts set out above, on 10 May 2023, the IE SA submitted the dispute to the EDPB in
accordance with Article 60(4) GDPR, thus initiating the dispute resolution procedure under
Article 65(1)(a) GDPR using the Internal Market Information system (hereinafter, ‘IMI’), at which
time they also confirmed the completeness of the file.

9. Following the submission by the IE SA of this matter to the EDPB, the EDPB Secretariat assessed
the completeness of the file on behalf of the Chair of the EDPB in line with Article 11(2) EDPB RoP.

10.The EDPB Secretariat contacted the IE SA on 17 May 2023 and 24 May 2023 asking it to provide
additional documents and clarifications. The IE SA replied and provided the clarifications on
19 May 2023 and 2 June 2023 respectively. On 6 June 2023, the EDPB Secretariat confirmed its
request to the IE SA to provide additional documents originating from TTL or documents with
respect to which TTL already had an opportunity to exercise its right to be heard. Based on the
exchanges with the IE SA, the EDPB Secretariat asked the IE SA to take additional action to inform
TTL about the inclusion of such additional documents in the file of this dispute resolution procedure
before the EDPB. On 13 June 2023, the IE SA submitted the requested additional documents in IMI
and confirmed to the EDPB Secretariat that the additional action to inform TTL was completed.

11.A matter of particular importance that was scrutinised by the EDPB Secretariat was the
right to be heard, as required by Article 41(2)(a) of the Charter of Fundamental Rights of the
European Union (hereinafter, ‘CFR’). Further details on this are provided in Section 2 of this
Binding Decision.

12.On 14 June 2023, the decision on the completeness of the file was taken by the Chair of the EDPB,
and the file was circulated by the EDPB Secretariat to all the members of the EDPB.

13.The Chair of the EDPB decided, in compliance with Article 65(3) GDPR in conjunction with
Article 11(4) EDPB RoP, to extend the default timeline for adoption of one month by a further
month on account of the complexity of the subject-matter.

2 THE RIGHT TO GOOD ADMINISTRATION
14.The EDPB is subject to Article 41 of the CFR (right to good administration). This is also reflected in
Article 11(1) EDPB RoP. Further details were provided in the EDPB Guidelines 03/2021 on the
application of Article 65(1)(a) GDPR, version 1.0 for public consultation adopted on 13 April 2021
(hereinafter, ‘EDPB Guidelines on Article 65(1)(a) GDPR V1.0’) and version 2.0 after public
consultation adopted on 24 May 2023 (hereinafter, ‘EDPB Guidelines on Article 65(1)(a) GDPR
V2.0’)17.

16
On 25 April 2023, in addition, TTL provided a table setting out the information in TTL Art. 65 Submissions which
it considers to be confidential and/or commercially sensitive and the supporting reasoning.
17
EDPB Guidelines on Article 65(1)(a) GDPR V2.0, paragraphs 93-107 and EDPB Guidelines on
Article 65(1)(a) GDPR V1.0, paragraphs 94-108.

Adopted 6

---

15.The EDPB’s decision ‘shall be reasoned and addressed to the lead supervisory authority and all the
supervisory authorities concerned and binding on them’ (Article 65(2) GDPR). It is not aiming to
address directly any other third party, as clarified by the order of the General Court in case
T-709/2118.

16.Nevertheless, the EDPB assessed if TTL was offered the opportunity to exercise its right to be heard
in relation to all the documents it received containing the matters of facts and law to be used by
the EDPB to take its decision in this procedure.

17.The EDPB notes that TTL has received the opportunity to exercise its right to be heard regarding all
the documents containing the matters of facts and of law considered and addressed by the EDPB
in the context of this Binding Decision and provided its written observations19, which have been
shared with the EDPB by the IE SA.

3 CONDITIONS FOR ADOPTING A BINDING DECISION
18.The general conditions for the adoption of a binding decision by the EDPB are set forth in
Article 60(4) GDPR and Article 65(1)(a) GDPR20.

Objection(s) expressed by CSA(s) in relation to a Draft Decision
19.The EDPB notes that the IT SA and the DE SAs raised objections to the Draft Decision via IMI. The
objections were raised pursuant to Article 60(4) GDPR.

20.The IT SA confirmed that the part of its objection concerning the compliance order under
Article 58(2)(d) GDPR in relation to the potential infringement of Article 25 GDPR by TTL is
considered to be withdrawn. Therefore, this part of the IT SA’s objection is not taken into account
by the EDPB in this dispute resolution procedure and is not addressed in this Binding Decision.

The IE SA does not follow the objections to the Draft Decision or is of the opinion
that the objections are not relevant or reasoned
21.On 23 December 2022, the IE SA provided the CSAs with an analysis of its views on their objections
in its Composite Response. The IE SA stated that this analysis is provided ‘without prejudice to
IE SA’s position on whether any of the objections raised constitute “relevant and reasoned”
objections for the purpose of Article 4(24) GDPR’21. After setting out its position on the reasons for

18
The General Court found in its Order of 7 December 2022, WhatsApp v European Data Protection Board,
T-709/21, EU:T:2022:783 (hereinafter, ‘T-709/21 WhatsApp’) that the controller addressed by the final decision
of the LSA was not directly concerned by the EDPB Binding Decision 1/2021, adopted on 28 July 2021
(hereinafter, ‘Binding Decision 1/2021’) since it did not in itself bring a distinct change in the applicant’s legal
position and constituted a preparatory or intermediate act. The General Court also clarified the
Binding Decision 1/2021 had no legal effect vis-a-vis the controller that was independent of the final decision,
on which the LSA had a measure of discretion. As a consequence, the General Court dismissed the action for
annulment brought by WhatsApp Ireland Ltd as inadmissible, given that the conditions laid down in the fourth
paragraph of Art. 263 TFEU had not been met. See T-709/21 WhatsApp, paragraphs 41-61.
19
In particular, TTL PDD Submissions dated 2 August 2022 and TTL Art. 65 Submissions dated 18 April 2023.
20
According to Art. 65(1)(a) GDPR, the EDPB will issue a binding decision when a supervisory authority has raised
a relevant and reasoned objection to a draft decision of the LSA and the LSA has not followed the objection or
the LSA has rejected such an objection as being not relevant or reasoned.
21
Composite Response, p. 1.

Adopted 7

---

maintaining the Draft Decision unchanged, the IE SA concluded that it would not follow the
objections22.

22.The IE SA further explained that it considers that the objection raised by the IT SA is ‘relevant and
reasoned’ for the purpose of Article 4(24) GDPR, with the exception of the corrective action
elements that are not reasoned23 and that the objection raised by the DE SAs is not ‘relevant and
reasoned’24. The IE SA’s view is set out in its internal assessment of whether each of the objections
constitutes a ‘relevant and reasoned objection’ pursuant to the GDPR25.

23.The IE SA confirmed, when referring the dispute to the EDPB, that it does not propose to follow
the objections/does not consider them to be relevant and reasoned and that its efforts to reach
consensus on the issues arising were unsuccessful26.

Admissibility of the case
24.The case at issue fulfils, prima facie, all the elements listed by Article 65(1)(a) GDPR, since CSAs
raised objections to the Draft Decision within the deadline provided by Article 60(4) GDPR, and the
IE SA has not followed objections or rejected them for being, in its view, not relevant or reasoned.

25.Considering the above, in particular that the conditions of Article 65(1)(a) GDPR are met, the EDPB
is therefore competent to adopt a binding decision, which shall concern all the matters which are
the subject of the relevant and reasoned objection(s), in particular whether there is an
infringement of the GDPR or whether the envisaged action in relation to the controller or processor
complies with the GDPR27.

26.The EDPB recalls that its current decision is without any prejudice to any assessments the EDPB
may be called upon to make in other cases, including with the same parties, taking into account
the contents of the relevant Draft Decision and the objections raised by the CSA(s).

Structure of the binding decision
27.For each of the objections raised, the EDPB decides on their admissibility, by assessing first whether
they can be considered as a ‘relevant and reasoned objection’ within the meaning of
Article 4(24) GDPR as clarified in the EDPB Guidelines 9/2020 on the concept of relevant and
reasoned objection, Version 2.0, adopted on 9 March 2021 (hereinafter, ‘EDPB Guidelines on
RRO’)28.

28.Where the EDPB finds that an objection does not meet the requirements of Article 4(24) GDPR, the
EDPB does not take any position on the merit of any substantial issues raised by that objection in

22
Composite Response, p. 7.
23
IE SA’s internal assessment of whether each of the objections constitutes a ‘relevant and reasoned objection’,
undated, Annex to the IE SA’s letter to TTL dated 7 March 2023 (hereinafter, ‘IE SA’s assessment of the
objections’), p. 2.
24
IE SA’s assessment of the objections, p. 2.
25
IE SA’s assessment of the objections.
26
IE SA’s referral of objections to the EDPB pursuant to Art. 60(4) and 65(1)(a) GDPR, dated 10 May 2023, p. 2.
27
Art. 65(1)(a) GDPR and Art. 4(24) GDPR. Some CSAs raised comments and not per se objections, which were,
therefore, not taken into account by the EDPB.
28
EDPB Guidelines on RRO.

Adopted 8

---

this specific case. The EDPB will analyse the merits of the substantial issues raised by all objections
it deems relevant and reasoned29.

4 ON THE POSSIBLE ADDITIONAL INFRINGEMENT OF ARTICLE 5(1)(A)
GDPR (THE PRINCIPLE OF FAIRNESS)
Analysis by the LSA in the Draft Decision
29. The first type of processing examined by the IE SA in the Draft Decision (analysed within Issue 130)
relates to the processing of personal data of the registered TikTok platform users who are aged
between 13 and 17 years old (hereinafter, ‘Child Users’)31 in the context of the platform settings
of the TTL platform (both mobile application and website based), in particular public by default
processing of such platform settings32. In connection to Issue 1, the IE SA includes in the Draft
Decision two proposed findings, leading respectively to a breach of Article 25(1), Article 25(2) and
Article 5(1)(c) GDPR33 and to a breach of Article 24(1) GDPR in relation to the public-by-default
setting for Child Users34. For completeness, under Issue 1, the IE SA also proposes a finding of
infringement of Article 5(1)(f) and Article 25(1) GDPR in relation to a specified aspect of the “Family
Pairing” setting on TTL’s platform35.

30.Within Issue 3, the IE SA analyses TTL’s compliance with Articles 5, 12 and 13 GDPR in connection
with transparency, by reference to ‘whether or not Child Users were adequately informed of the
implications of registering as a User and adequately informed as to the implications of public-by-
default processing’36. In connection to Issue 3, the IE SA includes in the Draft Decision a proposed
finding leading to a breach of Article 13(1)(e) and Article 12(1) GDPR37.

29
‘The EDPB will assess, in relation to each objection raised, whether the objection meets the requirements of
Art. 4(24) GDPR and, if so, address the merits of the objection in the binding decision.’ See EDPB Guidelines on
Article 65(1)(a) GDPR, V2.0, paragraph 63 and EDPB Guidelines on Article 65(1)(a) GDPR, V1.0, paragraph 63.
30
Draft Decision, Section F.
31
Draft Decision, paragraph 32.
32
Draft Decision, paragraph 34. See also Draft Decision, paragraph 39.
33
More specifically, the wording of Finding 1 is: ‘At the time of Relevant Period, TTL implemented a default
account setting for Child Users which allowed anyone (on or off TikTok) to view social media content posted by
Child Users. In this regard, I am of the view that TTL failed to implement appropriate technical and organisational
measures to ensure that, by default, only personal data which were necessary for TTL’s purpose of processing
were processed. In particular, this processing was performed to a global extent, and in circumstances where TTL
did not implement measures to ensure that by default the social media content of Child Users was not made
accessible (without the user’s intervention) to an indefinite number of natural persons. I am therefore of the
view that the above processing by TTL was contrary to the principle of data protection by design and default
under Article 25(1) and 25(2) GDPR, and contrary to the data minimisation principle under Article 5(1)(c) GDPR’.
34
Draft Decision, Finding 2: ‘During the Relevant Period, TTL implemented a default account setting for Child
Users which allowed anyone (on or off TikTok) to view social media content posted by Child Users. The above
processing posed severe possible risks to the rights and freedoms of Child Users’.
In circumstances where TTL did not properly take into account the risks posed by the above processing, I am of
the view that TTL did not implement appropriate technical and organisational measures to ensure that the above
processing was performed in accordance with the GDPR, contrary to Article 24(1) GDPR”
35
Draft Decision, paragraph 184.
36
Draft Decision, paragraph 251.
37
Draft Decision, Finding 5: ‘In circumstances where TTL did not provide Child Users with information on the
categories of recipients or categories of recipients of personal data, I find on that TTL has not complied with its

Adopted 9

---

31.The IE SA explains in particular that among the platform settings there was one by which all new
TTL accounts, including Child User accounts, were set to public by default, and that at the stage of
registration ‘Child Users were presented with a pop-up notification inviting them to ‘Go Private’ or
to ‘Skip’38 (hereinafter, referred to as the ‘Registration Pop-Up’).

32.The Registration Pop-Up appears after ‘successfully passing through the age gate’39 and states:
‘With a private account, only approved followers can view your content on TikTok. Otherwise, your
videos can be viewed by anyone. You can change your preferences in the app settings at any
time’40.

33.The IE SA quotes TTL’s description of the Registration Pop-Up, i.e. this full-screen pop-up
notification provided at the stage of registration concerning the possibility of setting the account
to private41. More specifically, TTL describes that ‘Users between the ages of 13-17 (‘under 18
Users’) were presented with a full-screen pop-up notification highlighting account privacy,
explaining, at a high-level, what a private account involved, and the implications of having a public
account setting. This notice comprises a pro-privacy nudge containing a prominent button which
Users could press to ‘Go Private’, and also reminded under 18 Users that they could change their
privacy settings at any time in the app settings. Steps were therefore taken to empower younger
Users to make an informed decision about their account setting’42.

34.With respect to the Registration Pop-Up, the IE SA notes that opting for a private account is
something that users must positively opt to do: alternatively, they may ‘skip’ this decision and their
accounts are made public by default43.

obligations under 13(1)(e) GDPR. In circumstances where TTL did not provide Child Users with information on
the scope and consequences of the public-by-default processing (that is, operating a social media network
which, by default, allows the social media posts of Child Users to be seen by anyone) in a concise, transparent,
intelligible and easily accessible form, using clear and plain language, in particular insofar as the very limited
information provided did not make it clear at all that this would occur, I find that TTL has not complied with its
obligations under and 12(1) GDPR’.
In paragraphs 274-275 of the Draft Decision, the IE SA explains why in its view the breaches of transparency
obligations at stake do not constitute also a breach of the transparency principle in Art. 5(1)(a) GDPR.
38
Draft Decision, paragraph 128.
39
Draft Decision, paragraph 255.
40
Draft Decision, paragraph 128 and Image 1 in paragraph 255.
41
This description is placed in the Draft Decision before the assessment of Issue 1, within the ‘assessment of
certain matters concerning Art. 5, 24 and 25 GDPR’, including an assessment of the ‘context of processing’ as
required by Art. 24 and 25 GDPR. Draft Decision, Section E.1 and specifically paragraphs 68 and following. With
respect to the context in which accounts of Child Users are set to ‘public’ by default on registration, the IE SA
quotes TTL’s description at paragraph 70. The IE SA defines the ‘context of processing’ as ‘the circumstances
that form the setting of the processing’ (Draft Decision, paragraph 68). In the excerpt of TTL’s Response quoted
by the Draft Decision in paragraph 70, TTL states that under 18 users were presented with the Registration Pop-
Up ‘To promote the fact that Users could select a private account at any time’. Draft Decision, paragraph 70,
quoting TTL’s Response to Request for Information dated 26 October 2021.
42
Draft Decision, paragraph 70, quoting TTL’s Response to Request for Information dated 26 October 2021.
43
Draft Decision, paragraph 72. This is also reiterated in paragraph 76 (‘Users must positively opt for a private
account – this is a choice that they must make in order to avail of it or that may simply chose to ‘skip’ this decision
in which case their account is public-by-default’).
Importantly, the IE SA states that, regarding the public by default account settings, it is unclear why TTL
permitted the accounts of Child Users to be set public by default, in light of the risks of high severity connected
to this (Draft Decision, paragraph 160).

Adopted 10

---

35.Moreover, the IE SA highlights that, while during the registration process, the child is prompted to
select one of the two above-mentioned options, the Child User can choose to simply ‘Skip’ this
step44. In this regard, the IE SA states that ‘this use of language would seem to incentivise or even
trivialise the decision to opt for a private account’45. The IE SA further notes that the implications
of having a public account are ‘particularly severe and wide-ranging’, given that the published
content ‘could be accessed, viewed and otherwise processed beyond the control of the data
subject and TTL’46.

36.The IE SA also highlights the ‘cascading implications’ of the public-by-default account on the other
platform settings for the Child User (namely, videos and comments being posted publicly by default
too, and some features being enabled by default)47. The IE SA also highlights that the selection of
the button ‘Skip’ on the Registration Pop-Up by the Child User has a ‘cascading effect of allowing
many further platform settings be rendered public - including the accessibility of comments on
video content created by the Child User’48.

37.With respect to the implication that each video would be posted publicly by default, the IE SA also
explains that when ‘public account Users sought to publish a public video, a pop-up notification
explained the implications of doing so, asking the User to ‘Cancel’ or ‘Post Now’ (hereinafter,
referred to as the ‘Video Posting Pop-Up’).

38.In the Video Posting Pop-Up, the ‘Cancel’ button gradient colour was a light grey and the ‘Post
Now’ was black’49. In this regard, according to the IE SA, while ‘TTL notes that there are indeed
granular level setting for each individual video, and that when a video was to be posted publicly
for the first time, a Child User would be ‘nudged’ to select between ‘Post Now’ and ‘Cancel’, plainly
the platform settings incentivised the selection of the posting of videos publicly, given both the
phraseology used and the difference of colour gradient’50. According to the IE SA, where the video
is posted publicly and the user holds a public account, this had the effect of making it viewable and
accessible by an unlimited audience51.

39.The Video Posting Pop-Up included the text ‘Your account is public and your public videos will be
visible to everyone. You can make this video private, or switch to a private account in your privacy
settings’52.

40.The IE SA also notes, in the Draft Decision, that ‘the lack of transparency both in itself and in
relation to the use, or rather lack of use, of information relating to the processing of personal data
in a concise, transparent, intelligible and easily accessible form, in clear and plain language, adds
to the lack of appropriate technical and organisational measures employed by TTL with regard to
its platform settings and Child Users’53.

44
Draft Decision, paragraph 160.
45
Draft Decision, paragraph 160.
46
Draft Decision, paragraph 160.
47
Draft Decision, paragraphs 161-164.
48
Draft Decision, paragraph 173.
49
Draft Decision, paragraph 131 and image 6 in paragraph 257.
50
Draft Decision, paragraph 162.
51
Draft Decision, paragraph 162.
52
Draft Decision, image 6 in paragraph 257.
53
Draft Decision, paragraph 165.

Adopted 11

---

41.The IE SA states that the Registration Pop-Up did not indicate whether the fact that videos posted
with a public account could be viewed by anyone referred only to other registered TTL users or
indeed anyone at all54. The IE SA further explains that the Registration Pop-Up did not allow a User
to navigate to the Privacy Policy or the Summary for Users U18 in order to determine who ‘anyone’
referred to, and that, in any event, both of the documents did not clearly explain that a public
account’s content would be accessible to an indefinite audience, including unregistered users’55.

42.Similarly, with respect to the Video Posting Pop-Up, according to the IE SA’s analysis, it is not clear
that public accounts and publicly posted videos could be viewable by non-registered persons56.

43.The IE SA states that the information provided by TTL, including both the Registration Pop-Up and
the Video Posting Pop-Up, the references to the terms ‘third parties’, ‘anyone’ and ‘everyone’ are
‘vague and opaque’.57 The IE SA also rejects TTL’s submissions that the relevant references to the
terms ‘public’ ‘anyone’ and ‘everyone’ are ‘concise, transparent, intelligible and easily accessible’
stating that such terms ‘are ambiguous insofar as they are capable of referring to both registered
Users and those not registered’58. The IE SA further finds that ‘TTL failed to provide Child Users
with information as to that public-by-default processing of accounts meant that an indefinite
audience, including non-registered users, would be able to view their personal data’59.
44.Concerning Issue 3, the IE SA concludes in its Finding 5, that TTL did not comply with its obligations
under Article 12(1) and Article 13(1)(e) GDPR60. In the context of its conclusions, the IE SA also
states that TTL’s informational deficits do not constitute an infringement of the transparency
principle pursuant to Article 5(1)(a) GDPR61.

Summary of the objection raised by the CSAs
45.The DE SAs raise an objection pursuant to Article 4(24) and Article 60(4) GDPR, regarding the
existence of an additional infringement of the principle of fairness enshrined in Article 5(1)(a)
GDPR62. They consider that, taking into account the facts presented by the IE SA in its Draft
Decision, TTL has implemented dark patterns and thus committed a breach of the fairness
principle63.

46.Pursuant to the DE SAs, the IE SA’s assessment of TTL’s registration process for Child Users and
public by default settings ‘misses the assessment and statement that in this processing dark

54
Draft Decision, paragraph 256.
55
Draft Decision, paragraph 256 and paragraphs 272-273.
56
Draft Decision, paragraph 257-259 and paragraphs 272-273.
57
Draft Decision, paragraph 272.
58
Draft Decision, paragraph 259 (‘I do not accept TTL’s submissions that it used ‘simple, clear terminology that
could be readily understood by all Users’ and that the relevant references to the terms ‘public’, ‘anyone’ and
‘everyone’ are ‘concise, transparent, intelligible and easily accessible’. Such terms are ambiguous insofar as they
are capable of referring to both registered Users and those not registered and this distinction could have been
specified succinctly and easily. Indeed, per [7.20] of the Response to the PDD, TTL refers to image 9 which states
‘Anyone will be able to see your contents and likes. You will no longer need to approve followers’. This additional
context would suggest that TTL was only referring to registered Users, rather than anyone at all’).
59
Draft Decision, paragraph 273.
60
Draft Decision, Finding 5.
61
Draft Decision, paragraph 275.
62
DE SAs Objection, p. 3.
63
DE SAs Objection, p. 4.

Adopted 12

---

patterns are implemented’, constituting a breach of the fairness principle64. Consequently, the DE
SAs highlight that, if the IE SA followed their objection, the Draft Decision would contain the
additional finding that TTL in the Relevant Period has breached Article 5(1)(a) GDPR by using dark
patterns to nudge Child Users to not make use of their option whether to set their account as public
or not65.

47.According to the DE SAs, the infringement of Article 5(1)(a) GDPR and in particular of the principle
of fairness was committed by TTL in two situations, which, in the DE SAs opinion, ‘constitute dark
patterns on a social media platform by nudging the user to a certain decision’66.

48.The first of such situations relates to the registration process for Child Users and the Registration
Pop-Up that appears to users for them to decide between a private and a public account67; in this
regard, the DE SA makes reference to paragraphs 72, 128, 160, 173 and 255 of the Draft Decision,
which are described above in paragraphs 31-36 of this Binding Decision.

49.The DE SAs in their objection argue that, in paragraph 160 of the Draft Decision, with the word
‘prompted’, as well as with the use of the words ‘incentivise’ and ‘trivialise’, the IE SA indicates the
use of nudging during the registration process68.

50.In respect of this, the DE SAs claim that the following conclusion is missing from the IE SA’s analysis
of the screenshot with the selection between ‘Go Private’ or ‘Skip’: the placement of the option
‘Skip’ on the right side will lead a majority of users to select ‘Skip’, ‘as internet and social media
users are used to the button on the right side leading them to fulfil a step and go further (muscle
memory)’69.

51.The second situation relates to the Video Posting Pop-Up, i.e. the pop-up window asking users to
confirm whether they want to post a video online by giving them a choice between ‘Cancel’ and
‘Post Now’70. As underlined by the DE SAs, the option ‘Post Now’ is written in bold71. Specifically,
the DE SAs are of the view that in this situation the nudging used by TTL is ‘even graver’72.

52.In this respect, the DE SAs highlight that the ‘Post Now’ choice is placed at the right side, making it
a lot more likely for users to choose this option rather than ‘Cancel’ placed on the left side73. The
DE SAs argue that the nudging effect is amplified by the fact that the option ‘Post Now’ is written
in bold text, whereas ‘Cancel’ is displayed normally74.

53.Pursuant to the DE SAs, this means that the ‘Post Now’ option will appear more visible and
prominent to users, which again raises the likelihood of users choosing this option75.

64
DE SAs Objection, p. 3.
65
DE SAs Objection, p. 3.
66
DE SAs Objection, p. 4.
67
DE SAs Objection, p.4.
68
DE SAs Objection, p. 5.
69
DE SAs Objection, p. 5.
70
DE SAs Objection, p. 5-6 (referring to Image 6, Notification pop-up prior to posting a public video, Draft
Decision, paragraph 257).
71
DE SAs Objection, p. 6.
72
DE SAs Objection, p. 5.
73
DE SAs Objection, p. 6.
74
DE SAs Objection, p. 6 (referring to Image 6, Notification pop-up prior to posting a public video, Draft Decision,
paragraph 257).
75
DE SAs Objection, p. 6.

Adopted 13

---

54.Moreover, the DE SAs argue that ‘the pop-in window makes it unnecessarily hard for users to
change the default settings at this point’76. This is because the information in the window mentions
‘privacy settings’, but lacks a direct link to said settings77. The DE SAs argue that this means that
users who wish to change the settings will first need to select ‘Cancel’ and then go through the
trouble of looking for the privacy settings, where they will then need to find the exact setting that
concerns the visibility of the account/switching to a private account78.

55.Based on the above argumentation, the DE SAs consider that this lowers the likelihood of users
changing their settings, whereas the likelihood that users will go along with posting the video with
the pre-set settings is high79. Furthermore, the DE SAs mention that, in paragraph 162 of the Draft
Decision, the IE SA analyses that this practice qualifies as nudging80.

56.In the opinion of the DE SAs, making it harder for data subjects to make a choice in favour of the
protection of their personal data, rather than to the detriment of their data protection, constitutes
an unfair practice and processing81. The DE SAs therefore state that the IE SA fails to assess and to
find an infringement of the fairness principle under Article 5 (1)(a) GDPR82, due to the
implementation dark patterns83.

57.Consequently, the DE SAs claim that, based on IE SA’s assessment, TTL implemented dark patterns
and thereby infringed the principle of fairness according to Article 5(1)(a) GDPR. In addition, the
DE SAs refer to paragraph 8 of the EDPB Guidelines 03/202284, in particular to the point made by
the EDPB in its Guidelines that the ‘fairness principle has an umbrella function and all dark patterns
would not comply with it, irrespectively of compliance with other data protection principles’85. The
DE SAs also recall the definition of dark patterns provided by the EDPB86.

58.Furthermore, the DE SAs argue that the failure by the IE SA to find an infringement of the fairness
principle poses a significant risk for the fundamental rights and freedoms of the TTL child users.
According to the DE SAs, nudging by dark patterns leads them to make decisions with negative
impact on the protection of their personal data87.

59.The DE SAs affirm that TTL is used by millions of users in Europe, including millions of child users
and refer to Recital 38 GDPR, which envisages specific protection when the processing involves
personal data of children. Pursuant to the DE SAs, children are more likely to be subject to dark
patterns88. In addition, the Draft Decision focuses on the processing of personal data of Child Users,
and according to the DE SAs, the IE SA’s failing to find an infringement of the fairness principle has

76
DE SAs Objection, p. 6.
77
DE SAs Objection, p. 6.
78
DE SAs Objection, p. 6.
79
DE SAs Objection, p. 6.
80
See this Binding Decision, paragraph 49 above.
81
DE SAs Objection, p. 6-7.
82
DE SAs Objection, p. 6.
83
DE SAs Objection, p. 3.
84
Guidelines 03/2022 on Dark patterns in social media platform interfaces: how to recognise and avoid them,
adopted on 12 March 2022 (version of public consultation)(hereinafter “EDPB Guidelines on deceptive design
patterns”).
85
DE SAs Objection, p. 4, referring to EDPB Guidelines on deceptive design patterns, paragraph 8.
86
DE SAs Objection, p. 4, referring to EDPB Guidelines on deceptive design patterns, paragraph 8.
87
DE SAs Objection, p.7.
88
In this regard, the DE SAs refer to EDPB Guidelines on deceptive design patterns, paragraph 7.

Adopted 14

---

considerable significance to fundamental rights and freedoms of children. The DE SAs highlight that
this is all the more relevant as the IE SA mentions and analyses nudging in the Draft Decision, but
fails to name the consequences, i.e. the infringement of Article 5 (1)(a) GDPR. The DE SAs further
state that TTL, as well as other social media providers, in case of a publication of the decision, could
view this as a, at least partial, ‘carte blanche’ for using nudging and dark patterns89.

60.The fact that the IE SA has not found an infringement of Article 5 (1)(a) GDPR, according to the DE
SAs, poses a risk on users to continuous confrontation with dark patterns that lead them
subconsciously to decisions violating their privacy interests90.

Position of the LSA on the objection
61.The IE SA considers that the objection raised by DE SAs concerning the absence of a finding of
infringement of the fairness principle set out in Article 5(1)(a) GDPR does not constitute a relevant
and reasoned objection91.

62.In its Composite Response, the IE SA notes that the DE SAs are the only CSAs that have raised this
matter and the IE SA questions whether an amendment if its Draft Decision, based on the DE SAs’
objection ‘would respect the consensus position of the CSAs on this matter’92.

63.In addition, the IE SA highlights that they cannot introduce a finding of an infringement, the subject
matter of which was not examined in the context of the Inquiry at hand and regarding which TTL
was never provided with the right to be heard93.

64.The IE SA has further indicated that it does not intend to follow this objection94.

Analysis of the EDPB

4.4.1 Assessment of whether the objection was relevant and reasoned
65.The objection raised by the DE SAs concerns ‘whether there is an additional infringement of the
GDPR’95, as it argues that the IE SA, based on the facts stated in the Draft Decision, should have
found an infringement of fairness principle under Article 5(1)(a) GDPR and included such additional
finding in its final decision96.

66.The EDPB takes note of TTL’s view that the DE SAs’ objection does not meet the threshold set by
Article 4(24) GDPR and should be thus rejected at the outset97.

67.In particular, TTL’s view is that the DE SAs’ objection fails to be relevant because it raises a new
issue, which is not within the scope of the Inquiry98. TTL argues that, even if the IE SA’s investigation
took into account certain factors of Article 5(1)(a) GDPR, the allegation of the DE SAs that TTL used

89
DE SAs Objection, p. 7.
90
DE SAs Objection, p. 8.
91
IE SA’s assessment of the objections, p. 2.
92
Composite Response, p. 6.
93
Composite Response, p. 6.
94
Composite Response, p. 6-7.
95
EDPB Guidelines on RRO, paragraph 24.
96
DE SAs Objection, p. 3.
97
TTL Art.65 Submissions, paragraphs 5.3, 7.2.
98
TTL Art. 65 Submissions, paragraph 7.3.

Adopted 15

---

dark patterns which equal to a breach of the fairness principle was not considered nor investigated
and put to TTL99. In this regard, the EDPB highlights that, contrary to TTL’s position100, objections
can be directly connected to the substance of the LSA’s draft decision despite not aligning with the
scope of the inquiry defined by the LSA. Regarding whether an objection is ‘relevant’ or not, the
EDPB recalls that an objection as to whether there is an infringement of the GDPR may also include
a disagreement as to the conclusions to be drawn from the findings of the investigation and for
instance may state that the findings amount to an additional infringement of a provision of the
GDPR than those already found by the LSA in its draft decision101. Indeed, the DE SAs’ objection
relies upon the content and the findings in the Draft Decision102 to highlight that the IE SA failed to
conclude in the context of its Draft Decision that TTL infringed the principle of fairness, under
Article 5(1)(a) GDPR103.

68.The EDPB notes that the DE SAs’ objection has a direct connection with the Draft Decision and
makes many references to its factual and legal content104. The DE SAs objection, if followed, would
entail a change leading to a different conclusion as to ‘whether there is an infringement of the
GDPR’105 since taking it on board would mean including the additional finding that TTL during the
Relevant Period has breached Article 5(1)(a) GDPR (particularly, the principle of fairness)106.

69.In consequence, the EDPB finds that objection to be relevant.

70.With respect to whether an objection is ‘reasoned’ or not, the EDPB recalls that the objection needs
to include clarifications and arguments (i.e. the legal / factual mistakes of the LSA’s draft decision)
as to why an amendment of the decision is proposed107.

71.TTL claims that the DE SAs’ objection is not sufficiently reasoned as it only refers to EDPB guidelines
in a vague way and relies upon a reasoning that is neither detailed nor precise108. TTL also argues

99
TTL Art.65 Submissions, paragraphs 7.4-7.5.
100
TTL Art.65 Submissions, paragraph 7.6 (where TTL argues that ‘It is clear that, by going beyond the Defined
Scope of the Inquiry, the Berlin SAs’s Objection is therefore not directly related to any finding of the Draft
Decision – instead, the Berlin SA is proposing a new finding altogether. Accordingly, this Objection is not capable
of being considered ‘relevant’).
101
EDPB Guidelines on RRO, paragraph 26.
102
The DE SAs refers e.g. to paragraphs 72, 128, 160, 162, 173, 255 of the Draft Decision.
Concerning the Registration Pop-Up, the DE SAs rely upon paragraphs 72, 138 and 255 of the Draft Decision to
describe the alternative between ’Go Private’ or ‘Skip’ (leading to their account being made public by default),
and to the analysis made by the IE SA of the language of this pop-up, which ‘would seem to incentivise or even
trivialise the decision to opt for a private account’. Furthermore, the DE SAs rely on paragraph 173 of the Draft
Decision to describe the ‘cascading effect’ that the decision of the users to ‘Skip’ can have on further platforms
settings.
Furthermore, regarding the ‘Video Posting Pop-Up’, the DE SAs refer directly to paragraph 162 of the Draft
Decision and in particular to the statement of the IE SA that the two options provided to the users (i.e. ‘Cancel’
or ‘Post Now’) would nudge the Child User and the fact that ‘plainly the platform incentivised the selection of
posting of videos publicly, given both the phraseology used and the difference in colour gradient’.
103
DE SAs Objection, p. 8 (‘the DPC in its analyses has shown that TTL has implemented dark patterns and
nudging in its user interface, but has not drawn the legal consequences, i.e. has not found an infringement of
Art. 5 (1) a GDPR’).
104
See this Binding Decision, section 4.2 above.
105
EDPB Guidelines on RRO, paragraph 13.
106
DE SAs Objection, p. 3, 8.
107
EDPB Guidelines on RRO, paragraph 16.
108
TTL Art. 65 Submissions, paragraph 7.13.

Adopted 16

---

that the DE SAs failed to provide adequate reasoning in respect of TTLs use of dark patterns as they
did not specify the precise type of dark pattern(s) allegedly present during the Relevant Period109.

72.The EDPB is not swayed by these views by TTL, as on the contrary, the DE SAs put forward several
legal and factual arguments as to why on the basis of the findings included in the Draft Decision
the IE SA should have found an additional infringement of the principle of fairness110.

73.More specifically, the DE SAs analyse in their objection that, considering the facts presented by the
IE SA in the Draft Decision regarding the Registration Pop-Up and the Video Posting Pop-Up, that
TTL implemented dark patterns and as a result the principle of fairness pursuant to Article 5(1)(a)
GDPR is infringed111. According to the DE SAs, both pop-ups constitute dark patterns on a social
media platform due to the fact that they are nudging the user to a certain decision112.

74.In their reasoning, the DE SAs describe in detail the Registration Pop-Up and the Video Posting Pop-
Up and explain the aspects on the basis of which the IE SA should have found a breach of the
fairness principle.

75.More specifically, with respect to the Registration Pop-Up113 the DE SAs agree with the statement
of the IE SA that the users were prompted, during the registration process, to select between ‘Go
Private’ and ‘Skip’ (i.e. remaining public) and that Child Users could simply opt to ‘Skip’114.
Moreover, the DE SAs highlight, as acknowledged by the IE SA115, the fact that the use of the
language by TTL seems to ‘incentivise’ or even ‘trivialise’ the decision of the users to opt for a
private account116. Pursuant to the DE SA, the use of these terms by the IE SA in the Draft Decision
demonstrates that the IE SA is of the opinion that the users were nudged by the TTL during the
registration process117. Moreover, concerning the same pop-up, the DE SAs highlight the IE SA’s
statement, according to which users’ decision to ‘Skip’ can have the cascading effect of ‘allowing
many further platform settings be rendered public - including the accessibility of comments on
video content created by the Child User’118. In addition, the DE SAs state that the fact that the
option ‘Skip’ is placed on the right, will lead the majority of users to select this option as ‘they are
used to the button on the right side leading them to fulfil a step and go further (muscle
memory)’119.

76.As regards to the ‘Video Posting Pop-Up’120 the DE SAs argue that nudging is even graver when the
users want to post a video on the TTL platform121. In particular, they argue that placing the ‘Post
Now’ on the right side increases the chances that the users select this option, while the fact that
‘Post Now’ is in bold, whereas ‘Cancel’ is displayed normally amplifies the nudging effect’122.

109
TTL Art. 65 Submissions, paragraph 7.14.
110
See this Binding Decision, section 4.2 above.
111
DE SAs Objection, p. 3.
112
DE SAs Objection, p. 4.
113
See this Binding Decision, paragraph 49 above.
114
DE SAs Objection, p. 5.
115
Draft Decision, paragraph 160.
116
DE SAs Objection, p. 5.
117
DE SAs Objection, p. 5.
118
DE SAs Objection, p 5.
119
DE SAs Objection, p. 5.
120
See this Binding Decision, paragraph 37 above.
121
DE SAs Objection, p. 5.
122
DE SAs Objection, p. 6.

Adopted 17

---

Additionally, the DE SA note that the information in the pop-up mentions ‘privacy settings’ but
lacks a direct link to the settings, arguing that this lowers the likelihood of changing the settings,
leading them to opt to post a video with the pre-set settings123.

77.The DE SAs also raise legal arguments by making reference to the fairness principle enshrined in
Article 5(1)(a) GDPR and to the definition of ‘dark patterns’ in the EDPB Guidelines 3/2022 (with
particular focus on paragraph 8)124.

78.Based on the above, the EDPB finds the objection to be reasoned.

79.In order for an objection to meet the threshold set by Article 4(24) GDPR, it also needs to clearly
demonstrate the significance of the risks posed by the draft decision125.

80.TTL argues in its submission that the DE SAs do not sufficiently specify the risks which would be
posed to Younger Users should the objection not be followed126.

81.The EDPB takes note of this position but also notes that, according to the DE SAs, the IE SA’s failure
to find an infringement of fairness principle poses a significant risk for fundamental rights and
freedoms of TTL Child Users127. The use of dark patterns by TTL to nudge the users has a result the
making of decisions with negative impact for the protection of their personal data, and eventually
for their fundamental rights and freedoms128. In addition, the DE SAs put forward the argument
that, as the Draft Decision states, TTL is used by ‘millions of users in Europe including Child Users’129.

82.Moreover, the DE SAs argue that this all is even more relevant considering the fact that the IE SA
mentions and analysing in the Draft Decision the nudging conducted by TTL, so if an infringement
of the fairness principle is not identified, other social media providers, could interpret this as a ‘at
least partial, carte blanche for nudging using nudging and dark patterns’130. Along the same lines
and considering the analysis of the IE SA, the DE SAs are of the view that, the lack of identification
of an additional infringement, poses a risk on users to continuously facing dark patterns and being
subconsciously led to decisions violating their privacy interests131.

83.Considering the above, the EDPB finds that the objection of the DE SAs, requesting the IE SA to find
an infringement of the principle of fairness under Article 5(1)(a) GDPR, in addition to the
infringements proposed in the Draft Decision, is relevant and reasoned pursuant to Article 4(24)
GDPR.

84.Finally, the EDPB takes note of TTL’s position that to introduce a finding of infringement which has
not been examined during the Inquiry, would be breach of fair procedures under Irish and EU law

123
DE SAs Objection, p. 6.
124
DE SAs Objection, p. 3-4
125
EDPB Guidelines on RRO, paragraph 36.
126
TTL Art. 65 Submissions, paragraphs 7.16-7.17.
127
DE SAs Objection, p.7.
128
DE SAs Objection, p. 7.
129
In this context, the DE SAs refer to Recital 38 of the GDPR, which envisages specific protection when the
processing involves children’s persona data, as they are less aware of the risks, consequences and safeguards
related to the processing of their personal data. In addition, referring to the EDPB Guidelines on Dark Patterns,
the DE SAs mention that children are also more likely to be subject to dark patterns.
130
DE SAs Objection, p. 7.
131
DE SAs Objection, p. 8.

Adopted 18

---

including TikTok’s right to be heard132. The EDPB considers that TTL has been provided the right to
be heard on this issue, contrary to its claims, since it had the opportunity to express its point of
view on the objection raised by the CSA on this matter133.

4.4.2 Assessment on the merits
85.In accordance with Article 65(1)(a) GDPR, the EDPB shall take a binding decision concerning all the
matters which are the subject of the relevant and reasoned objections, in particular whether there
is an infringement of the GDPR.

86.The EDPB considers that the objection found to be relevant and reasoned in this section, raised by
the DE SAs, requested the IE SA to find an infringement of the principle of fairness under Article
5(1)(a) GDPR in addition to the infringements proposed in the Draft Decision. When assessing the
merits of the objection raised, the EDPB also takes into account TTL’s position on the objection and
its submissions.

87.On a preliminary note, the EDPB recalls that the EU legislature decided that a single relevant and
reasoned objection is sufficient to trigger the dispute resolution mechanism134. Indeed, the EU
legislature purposefully decided to set a qualitative threshold, i.e. the objection needing to be
relevant and reasoned, and not a quantitative threshold135. Therefore, the argument provided by
the IE SA, that the lack of similar objections by other CSAs indicates a consensus with these CSAs,
has no impact on the EDPB’s assessment of the merits in the case at hand.

TTL’s position on the objection and its submissions

88.As previously mentioned, the EDPB takes note of TTL’s view that the DE SAs’ objection is not
relevant and reasoned136. The EDPB also notes that TTL is of the opinion that the DE SAs’ objection
lacks of merit137.

89.In particular, TTL puts forward the argument that the DE SAs’ objection referred to the EDPB
Guidelines on Deceptive Design Patterns138, which were published in March 2022 and finalised in
February 2023139. In this regard, TTL states that the Guidelines were public ‘well after the Relevant
Period of this Inquiry’140 and that the DE SAs’ objection ‘was submitted prior to the finalisation of
the Deceptive Design Pattern Guidelines141. Additionally, TTL objects to the reliance of the EDPB on
the Guidelines on Deceptive Design Patterns142.

132
TTL Art. 65 Submissions, paragraphs 7.7-7.11.
133
See, in particular, TTL Art. 65 Submissions, paragraphs 7.24-7.47 where TTL argues that the DE SAs’ objection
should be rejected as lacking merit and explains the reasons.
134
Art. 60(4) GDPR.
135
See Presidency’s Discussion note on possible thresholds for submitting cases to the EDPB, 5331/2015,
Interinstitutional File: 2012/0011(COD) paragraph 6, https://data.consilium.europa.eu/doc/document/ST-5331-
2015-INIT/en/pdf
136
See this Binding Decision, paragraph 67 above.
137
TTL Art. 65 Submissions, paragraph 7.24.
138
EDPB Guidelines on Deceptive Design Patterns.
139
TTL Art. 65 Submissions, paragraph 7.29.
140
Draft Decision, paragraph 31: the period of IE SA’s Inquiry was between 31 July and 31 December 2020.
141
TTL Art. 65 Submissions, paragraph 7.29.
142
TTL Art. 65 Submissions, paragraph 7.30. In particular, TTL’s statement relies upon the following three
reasons: a) it is not procedurally appropriate or lawful for the IE SA or the CSAs to assess TTL’s GDPR compliance

Adopted 19

---

90.The EDPB issues guidelines to clarify and provide guidance on the existing laws and to promote a
common understanding of EU data protection laws. The Guidelines on Deceptive Design Patterns
provide important practical guidance that can aid controllers and processors in their compliance
with the GDPR. These guidelines built upon and are aligned with previous guidance already
provided by the EDPB on the principle of fairness: even prior to the Relevant Period, the EDPB had
already adopted guidance clarifying that the principle of fairness includes inter alia the avoidance
of deception (deceptive or manipulative language or design), being truthful and not misleading the
data subjects143.

91.In this context, the EDPB emphasises that the obligation to comply with the principle of fairness
stems directly from the GDPR144 and from the CFR145, and applies to all controllers and processors,
even in the absence of EDPB guidance.

92.Therefore, the EDPB underlines that the obligation to comply with the principle of fairness stems
from the law and applies to all the controllers and therefore does not depend on the existence of
EDPB Guidelines. It is the task of the EDPB under Article 65 GDPR and Article 70(1)(a) GDPR to
ensure the correct and consistent application of the GDPR in individual cases.

93.Furthermore, the EDPB takes note that, with respect to the additional infringement requested by
the DE SAs in their objection, TTL is of the opinion that there are no facts in the Draft Decision
warranting the finding of such additional infringement146.

94.In addition, TTL states that the DE SAs’ objection regarding the violation of the fairness principle,
pursuant to Article 5(1)(a) GDPR, with respect to the processing of personal data relating to
younger users is unfounded147. TTL motivates this, first, stating that ‘the Account Information Pop-
Up and the First Post Pop-Up were not unduly detrimental, unexpected, misleading or deceptive
to Younger Users and complied with the principle of fair processing’148. In addition, TTL states that
there are no dark patterns implemented in the account information pop-up and the video posting
pop-up, since they were not deceptive149. The EDPB will assess this key question below.

95.Moreover, TTL states that ‘TikTok had detailed transparency information in place for Younger Users
to support the principle of fair processing’150. On this particular point, the EDPB recalls what was
established in the Draft Decision with respect to the transparency breaches identified by the IE SA

retrospectively, based on Guidelines that were not adopted during the relevant period, b) such reliance would
equal to an impermissible retrospective application of regulatory standards and to a clear breach of fair
procedures, and c) if this approach would adopted, it would oppose to the principle of legal certainty and the
right to fair procedures pursuant to Article 41 of the CFR.
143
EDPB Guidelines 4/2019 on Article 25 Data Protection by Design and by Default, adopted on 13 November
2019 (hereinafter, ‘EDPB Guidelines on Data Protection by Design and by Default, V1.0’) and adopted after
public consultation on 20 October 2020 (hereinafter, ‘EDPB Guidelines on Data Protection by Design and by
Default, V2.0’). In particular, see EDPB Guidelines on Data Protection by Design and by Default, V2.0, paragraphs
69-70, and EDPB Guidelines on Data Protection by Design and by Default, V1.0, paragraphs 64-65.
144
Art. 5(1)(a) GDPR.
145
Art. 8(2) CFR.
146
TTL Art. 65 Submissions, paragraph 7.33.
147
TTL Art. 65 Submissions, paragraph 7.35.
148
TTL Art. 65 Submissions, paragraph 7.35.
149
TTL Art. 65 Submissions , paragraph 7.38, TTL included a summary of expert report
(hereinafter the Report’), addressing the allegation made by the DE SAs that certain information pop-ups
used by TTL during the Relevant Period involved implementation by TTL of dark patterns.
150
TTL Art. 65 Submissions, paragraph 7.35.

Adopted 20

---

within Issue 3 and the relevant Finding 5151. In particular, the EDPB recalls that TTL was found to
have infringed its transparency obligations under Article 12(1) and Article 13(1)(e) GDPR in relation
to the processing specified in Finding 5 of the Draft Decision152, but not under the general principle
of transparency pursuant to Article 5(1)(a) GDPR153. In this context, the EDPB emphasises that such
findings were not the subject of any objection raised by CSAs and therefore amount to final
determinations by the LSA.

96.Furthermore, TTL argues that the younger users were informed of the consequences of their
decision154. The IE SA stated that TTL provided various ‘vague’ and ‘opaque’ references to ‘third
parties’, ‘everyone’, ‘anyone’, and thus this cannot be regarded as having provided information in
a ‘concise, transparent, intelligible’ way155. The IE SA finds that TTL failed to provide Child Users
with information as to the fact that ‘public-by-default processing of accounts meant that an
indefinite audience, including non-registered users, would be able to view their personal data’156.

97.Finally, TTL is of the view that the DE SAs in their objection failed to identify or to specify any precise
deceptive design patterns, and instead only pointed out the existence of deceptive design
patterns157.

EDPB’s assessment on the merits

98.Moving forward with the assessment of the question raised by the DE SAs objection, the EDPB
recalls that the basic principles relating to the processing listed in Article 5 GDPR can, as such, be
infringed158. This is apparent from the text of Article 83(5)(a) GDPR which subjects the infringement
of the basic principles for processing to administrative fines up to 20 million euros, or in the case
of undertaking, up to 4% of the total worldwide annual turnover of the preceding financial year,
whichever is higher159.

99.The EDPB underlines that the principles of fairness, lawfulness and transparency, all three
enshrined in Article 5(1)(a) GDPR, are three distinct but intrinsically linked and interdependent
principles that every controller should respect when processing personal data. The link between
these principles is evident from a number of GDPR provisions: Recitals 39 and 42, Article 6(2) and
Article 6(3)(b) GDPR refer to lawful and fair processing, while Recitals 60 and 71 GDPR, as well as
Article 13(2), Article 14(2) and Article 40(2)(a) GDPR refer to fair and transparent processing160.

100. The EDPB highlights that the fairness principle has an independent meaning and stresses that
the assessment conducted by the IE SA on TTL’s compliance with the principle of transparency

151
Draft Decision, Finding 5.
152
Draft Decision, Finding 5.
153
Draft Decision, paragraph 275.
154
In TTL Art. 65 Submissions, paragraph 7.40, TTL included a summary of expert report
(hereinafter ‘Second Report’), relevant to the DE SAs’ allegations of the presence of dark patterns.
155
Draft Decision, paragraph 272.
156
Draft Decision, paragraph 273.
157
TTL Art. 65 Submissions, paragraph 7.47.
158
EDPB Binding Decision 3/2022, paragraph 218; Binding Decision 4/2022, paragraph 223; Binding Decision
5/2022, paragraph 141. See also Binding Decision 1/2021, paragraph 191.
159
EDPB Binding Decision 3/2022, paragraph 218; Binding Decision 4/2022, paragraph 223; Binding Decision
5/2022, paragraph 141.
160
EDPB Binding Decision 3/2022, paragraph 219; Binding Decision 4/2022, paragraph 224; Binding Decision
5/2022, paragraph 145.

Adopted 21

---

(leading to Finding 5 where the IE SA concluded that Article 13(1)(e) and Article 12(1) GDPR were
breached, but the principle of transparency, pursuant to Article 5(1)(a) GDPR was not breached161)
does not automatically rule out the need for an assessment of TTL’s compliance with the principle
of fairness too162.

101. The EDPB has already provided some elements as to the meaning and effect of the principle
of fairness in the context of processing personal data. For example, the EDPB has previously opined
in its Guidelines on Data Protection by Design and by Default that ‘[f]airness is an overarching
principle which requires that personal data should not be processed in a way that is unjustifiably
detrimental, unlawfully discriminatory, unexpected or misleading to the data subject’163.

102. This definition, which was referred to by the IE SA when outlining ‘the context of the
processing’ in the course of assessing TTL’s compliance with Articles 24 and 25 GDPR including
regarding the public-by-default processing of Child Users’ social media content in the Draft
Decision164, highlights the importance of taking into account certain key elements in the practical
implementation of the principle of fairness165. In particular, the elements of autonomy of data
subjects, avoidance of deception, power balance, and truthful processing166 are relevant in the case
at hand.

103. Additionally, the EDPB has previously explained that ‘the principle of fairness includes, inter
alia, recognising the reasonable expectations of the data subjects, considering possible adverse
consequences processing may have on them, and having regard to the relationship and potential
effects of imbalance between them and the controller’167.

104. The GDPR includes multiple references to the need for individuals to have control over their
own personal data168. In this respect, the EDPB clarified that data subjects ‘should be granted the
highest degree of autonomy possible to determine the use made of their personal data, as well as
over the scope and conditions of that use or processing’169 and that controllers ‘cannot present the
processing options in such a manner that makes it difficult for data subjects to abstain from sharing
their data, or make it difficult for the data subjects to adjust their privacy settings and limit the
processing’170.

105. In addition, the EDPB noted in the past that the controller, in line with the fairness principle,
must not present the data subjects with options in a way that ‘nudges the data subject in the
direction of allowing the controller to collect more personal data than if the options were

161
Draft Decision, paragraph 275.
162
EDPB Binding Decision 3/2022, paragraph 220; Binding Decision 4/2022, paragraph 225; Binding Decision
5/2022, paragraph 147.
163
EDPB Guidelines on Data Protection by Design and by Default, V2.0, paragraph 69, and EDPB Guidelines on
Data Protection by Design and by Default, V1.0, paragraph 64.
164
Draft Decision, paragraphs 77, referring to the EDPB Guidelines on Data Protection by Design and by Default,
V2.0, paragraphs 69-70.
165
EDPB Guidelines on Data Protection by Design and by Default, V2.0, paragraph 70.
166
EDPB Guidelines on Data Protection by Design and by Default, V2.0, paragraph 70.
167
EDPB Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the
provision of online services to data subjects Version 2.0, adopted on 8 October 2019 (hereinafter, ‘EDPB
Guidelines 2/2019 on Article 6(1)(b) GDPR’), paragraph 12.
168
See the multiple references in GDPR, in particular in Recitals 7, 68, 75 and 85.
169
EDPB Guidelines on Data Protection by Design and by Default, V2.0, paragraph 70.
170
EDPB Guidelines on Data Protection by Design and by Default, V1.0, example 1 and V2.0, example 1.

Adopted 22

---

presented in an equal and neutral way’171. The options to provide consent or abstain should be
equally visible, and accurately representing the ramifications of each choice to the data subject172.

106. It is also key to bear in mind that avoiding deception of the data subject means that ‘Data
processing information and options should be provided in an objective and neutral way, avoiding
any deceptive or manipulative language or design’, while the element of truthfulness requires that
‘The controller must make available information about how they process personal data, they
should act as they declare they will and not mislead the data subjects’173.

107. Another important element of the fairness principle is linked to power balance174, since the
principle of fairness under Article 5(1)(a) GDPR underpins the entire data protection framework
and seeks to address power asymmetries between the controllers and the data subjects in order
to cancel out the negative effects of such asymmetries and ensure the effective exercise of the
data subjects’ rights175. It is relevant to recall that ‘the personal data at issue related to a
particularly vulnerable cohort of data subjects – children176, who ‘merit specific protection with
regard to their personal data, as they may be less aware of the risks, consequences and safeguards
concerned and their rights in relation to the processing of personal data’177. Recital 75 GDPR
explicitly includes the processing of individual’s data particularly those of children, to be among
the situations where the risk for the fundamental rights and freedoms of varying likelihood and
severity, may result from data processing that could lead to physical, material or non-material
damage. Along the same lines, children may qualify as ‘vulnerable’ data subjects, as they can be
considered to not be able to knowingly and thoughtfully oppose or consent to the processing of
their personal data178.

108. It is therefore necessary for the EDPB to assess whether the two practices (i.e. the Registration
Pop-Up and the Video Posting Pop-Up), which are the subject of the DE SAs’ objection, are in line
with the principle of fairness pursuant to Article 5(1)(a) GDPR.

109. The EDPB notes that, as detailed in the Draft Decision, all new TTL accounts, including Child
User accounts, were set by default public179, and that the IE SA considered that the information
provided by TTL (which included the two pop-ups) did not allow Child Users to understand that
their personal data would be visible to an indefinite audience (including non-registered users)180.
More specifically, the EDPB finds it relevant that, according to the Draft Decision, the references
to ‘everyone’ and ‘anyone’ in the information provided by TTL, which includes the Registration Pop-

171
EDPB Guidelines on Data Protection by Design and by Default, V1.0, example 1 and V2.0, example 1.
172
EDPB Guidelines on Data Protection by Design and by Default, V2.0, example 1.
173
EDPB Guidelines on Data Protection by Design and by Default, V2.0, paragraph 70, and EDPB Guidelines on
Data Protection by Design and by Default, V1.0, paragraph 65.
174
EDPB Guidelines on Data Protection by Design and by Default, V2.0, paragraph 70, and EDPB Guidelines on
Data Protection by Design and by Default, V1.0, paragraph 65.
175
EDPB Binding Decision 3/2022, paragraph 222; Binding Decision 4/2022, paragraph 227; Binding Decision
5/2022, paragraph 148.
176
Draft Decision, paragraph 316.
177
GDPR, Recital 38. See also Draft Decision, paragraph 69.
178
Article 29 Working Party, Guidelines on Data Protection Impact Assessment (DPIA) and determining whether
processing is “likely to result in high risk” for the purposes of Regulation 2016/679 on 4 April 2017, WP 248
rev.1, (hereinafter “WP29 Guidelines on DPIA”) endorsed by the EDPB on 25 May 2018, p. 10.
179
Draft Decision, paragraph 128.
180
Draft Decision, paragraph 273.

Adopted 23

---

Up and the Video Posting Pop-Up, are ‘vague and opaque’181. Moreover, the IE SA noted that the
ambiguous terms of ‘public’, ‘anyone’ and ‘everyone’ were ‘capable of referring to both registered
Users and those not registered’182. This means that the consequences arising from choosing one or
the other option in the two pop-up notifications were not clear to Child Users183.

110. This is all the more relevant considering that the IE SA acknowledged that ‘where a Child User
were to avail of the relevant public features of the TikTok platform there could lead in the first
instance to Child Users losing autonomy and control over their data’184. In addition, the IE SA,
stated that TTL ‘failed to explain and/or to explain clearly the scope and consequences of public-
by-default account settings’ and moreover that ‘TTL failed to provide Child Users with information
as to that public by default processing of accounts meant indefinite audience, including not
registered, would be able to view their personal data’185.

111. Concerning, specifically, the Registration Pop-Up, the EDPB notes that, the IE SA’s note that,
this pop-up entailed the need for users to positively opt to choose a private account, since the
option ‘Skip’ led to the account being set to public by default186. The consequence of omitting the
decision by choosing ‘Skip’187 was to render the account public (as per the default setting) and thus
to render the content viewable to an unlimited audience.

112. Moreover, as the IE SA states and as underlined by the DE SAs, the chosen language (‘Skip’)
seems to ‘incentivise or even trivialise the decision to opt for a private account’ that the Child User
was ‘prompted’ to make188. The DE SAs highlight that already this finding in the Draft Decision
showed the use of ‘nudging’ during the registration process189. In addition, the IE SA also notes in
its Draft Decision the fact that the decision to ‘Skip’ opting for a private account, has a cascading
effect, in the sense that this would allow further platform settings to be rendered public190.
According to a report of the Norwegian consumer authority, ‘when the default settings allow
widespread collection and use of personal data, users are nudged toward giving away their data’191.
The DE SAs argue that ‘Making it harder for data subjects to make a choice in favour of the
protection of their personal data, rather than to the detriment of their data protection, constitutes
an unfair practice and processing’192. The EDPB recalls that ‘Data processing information and

181
Draft Decision, paragraph 272.
182
Draft Decision, paragraph 259.
183
Draft Decision, Finding 5, second part (‘In circumstances where TTL did not provide Child Users with
information on the scope and consequences of the public-by-default processing (that is, operating a social media
network which, by default, allows the social media posts of Child Users to be seen by anyone) in a concise,
transparent, intelligible and easily accessible form, using clear and plain language, in particular insofar as the
very limited information provided did not make it clear at all that this would occur, I find that TTL has not
complied with its obligations under and 12(1) GDPR’).
184
Draft Decision, paragraph 93.
185
Draft Decision, paragraph 173.
186
Draft Decision, paragraphs 72 and 76.
187
Draft Decision, paragraph 79.
188
Draft Decision, paragraph 160. DE SAs Objection, p. 5.
189
DE SAs Objection, p. 5
190
Draft Decision, paragraph 173.
191
Forbrukeradet, Report on deceived by design - How tech companies use dark patterns to discourage us from
exercising our rights to privacy, dated on 27 June 2018, available at: https://fil.forbrukerradet.no/wp-
content/uploads/2018/06/2018-06-27-deceived-by-design-final.pdf, p. 13.
192
DE SAs Objection p. 6-7.

Adopted 24

---

options should be provided in an objective and neutral way, avoiding any deceptive or manipulative
language or design’193.

113. The EDPB also highlights another feature of the Registration Pop-Up, namely the location of
the option ‘Skip’ on the right side194. The DE SAs argue that the placement of an option on the right
side will lead a majority of users to choose it, ‘as internet and social media users are used to the
button on the right side leading them to fulfil a step and go further (muscle memory)’195.

114. Concerning the Video Posting Pop-Up, the EDPB agrees with the DE SAs that the ‘nudging
effect is amplified’ by the fact that the option to post the video publicly is not only displayed on
the right side, which has the effects mentioned above, but also shown in a bold darker text196.
Consequently, as acknowledged by the IE SA, the settings plainly incentivised the selection of the
posting of videos publicly, given both the phraseology used and the difference of colour
gradient’197. In particular, the fact that the option to post the video publicly appears ‘more visible
and prominent’ increases the likelihood for the user to choose it198. As noted by the DE SAs, also
the ‘muscle memory’ and the location of the button leading to the ‘more public’ option raised the
likelihood of the user choosing it199. This is essential, also considering the fact, that individuals,
using digital services nowadays, on their phones while on the go, so forcing individuals to choose
between several actions on the spot, is already a type of ‘nudging’200, which can be even more
efficient when the controllers ‘emphasise; one of the two provided options.

115. As stated above, the EDPB recalls that ‘options should be provided in an objective and neutral
way’ 201 and controllers should not ‘present the processing options in such a manner that makes it
difficult for data subjects to abstain from sharing their data’202 or ‘nudges the data subject in the
direction of allowing the controller to collect more personal data than if the options were
presented in an equal and neutral way’203.

116. Additionally, the Video Posting Pop-Up refers to the possibility of changing preferences in the
Privacy settings204. The EDPB considers it relevant to highlight that this pop-up ‘lacks a direct link
to said settings’, as mentioned by the DE SAs205. More specifically, this means that users who wish
to change the settings will first need to select ‘Cancel’ and then go through the trouble of looking
for the privacy settings, where they will then need to find the exact setting that concerns the

193
EDPB Guidelines on Data Protection by Design and by Default, V2.0, paragraph 70; also EDPB Guidelines on
Data Protection by Design and by Default, V1.0, paragraph 65.
194
Draft Decision, Image 1.
195
DE SAs Objection, p. 5.
196
DE SAs Objection, p. 6. Draft Decision, paragraph 131 and Image 6 in paragraph 257.
197
Draft Decision, paragraph 162.
198
DE SAs Objection, p. 6.
199
DE SAs Objection, p 5.
200
Forbrukeradet, Report on deceived by design - How tech companies use dark patterns to discourage us from
exercising our rights to privacy, dated on 27 June 2018, available at: https://fil.forbrukerradet.no/wp-
content/uploads/2018/06/2018-06-27-deceived-by-design-final.pdf, p. 27.
201
EDPB Guidelines on Data Protection by Design and by Default, V2.0, paragraph 70; also EDPB Guidelines on
Data Protection by Design and by Default, V1.0, paragraph 65.
202
EDPB Guidelines on Data Protection by Design and by Default, V1.0, example 1 and V2.0, example 1.
203
EDPB Guidelines on Data Protection by Design and by Default, V1.0, example 1 and V2.0, example 1.
204
Draft Decision, paragraph 257.
205
DE SAs Objection, p. 6.

Adopted 25

---

visibility of the account/switching to a ‘private account’206. The EDPB agrees, with the DE SAs, that
this lowers the likelihood that data subjects change their settings, while there is a high likelihood
that users will ‘go along with posting the video with their pre-set settings’207. As mentioned above,
controllers should not ‘make it difficult for the data subjects to adjust their privacy settings and
limit the processing’208.

117. Based on all the above, the EDPB agrees with the DE SAs that the Registration Pop-Up and the
Video Posting Pop-Ups were ‘nudging the user to a certain decision’209 and leading them
‘subconsciously to decisions violating their privacy interest’210. It is relevant to consider, in this
regard, that such decision towards which the users were encouraged is the ‘public-by-default
setting’, which ‘appears to be a deliberate choice on the part of TTL intended to maximise user
engagement and sharing on the platform’211. The EDPB also concurs with the DE SAs that ‘Making
it harder for data subjects to make a choice in favour of the protection of their personal data, rather
than to the detriment of their data protection, constitutes an unfair practice and processing’212.
This is, in this case, combined with the fact that data subjects are children, who ‘merit specific
protection with regard to their personal data’213, and with the lack of clarity as to the consequences
of the different options particularly with regard to the audience of the future content of their
account.

118. On the basis of the findings of the IE SA in its Draft Decision and considering the arguments
provided by the DE SAs in their objection, the EDPB finds that TTL has infringed the principle of
fairness, pursuant to Article 5(1)(a) GDPR, in the context of the practices described above, namely
the Registration Pop-Up and the Video Posting Pop Up.

119. Accordingly, the EDPB instructs the IE SA to include in its final decision a finding of an
infringement of the principle of fairness principle pursuant to Article 5(1)(a) GDPR by TTL.

5 ON THE POSSIBLE INFRINGEMENT OF ARTICLE 25 GDPR REGARDING
AGE VERIFICATION
Analysis by the LSA in the Draft Decision
120. Within Issue 2, the IE SA analyses TTL’s compliance with Article 24(1), Article 25(1) and
Article 25(2) GDPR with respect to its age verification measures for persons under 13 and the
assessment of the risks for this specific category of data subjects214. In Finding 4, the IE SA
concludes that TTL infringed Article 24(1) GDPR in respect of failure to properly take into account
the risks posed to children below the age of 13 by processing related to a default account setting
for Child Users which allowed anyone (on or off TikTok) to view social media content posted by

206
DE SAs Objection, p. 6.
207
DE SAs Objection, p. 6.
208
EDPB Guidelines on Data Protection by Design and by Default, V1.0, example 1 and V2.0, example 1.
209
DE SAs Objection, p. 4.
210
DE SAs Objection, p. 8.
211
Draft Decision, paragraph 72.
212
DE SAs Objection p. 6-7.
213
GDPR, Recital 38.
214
Draft Decision, paragraphs 185-221.

Adopted 26

---

Child Users215. This finding does not consider the age verification system as such. With respect to
age verification measures, the IE SA concludes that the measures implemented by TTL concerning
age verification are compliant with Articles 24 and 25 GDPR216, on the basis of the reasoning
outlined below.

121. For the purpose of assessing if the age verification mechanism implemented by TTL complied
with TTL’s obligations under Articles 24 and 25 GDPR, the IE SA first analyses the nature, scope,
context and purpose of the processing217. Additionally, the IE SA addresses the risks of varying
likelihood and severity resulting from the processing218. In that respect the IE SA finds that ‘a
number of clear risks within the rubric of Recital 75 GDPR arise which could lead to physical,
material or non-material damage’219. One of these risks, as identified above, is that the processing
concerns public-by-default processing of personal data of vulnerable natural persons, that is
children, and where such children are below the age of 13220. The processing of their data, given
the high numbers of affected and potential affected users, constitutes processing involving a large
amount of personal data and affecting a large number of data subjects221. The Draft Decision
identifies

222
.

122. In the Draft Decision, the IE SA recalls that as a controller, TTL is obliged to identify risks, which
are posed by processing, as a requirement of the principle of accountability and Articles 24 and
25 GDPR223. Accordingly, after having had regard to the nature, scope, context and purposes of
processing, as well as TTL’s own risk assessment set out in the DPIA which accepts that its
processing activities pose a number of high ‘inherent’ risks224, the IE SA finds that, having regard to
the nature, scope, context, and purposes of processing, both types of processing which are the
subject of the Inquiry pose high risks to the rights and freedoms of Child Users, for the purposes of
Articles 24 and 25 GDPR225. The IE SA concludes that the risks associated with the processing at
stake were high both in terms of likelihood and severity226.

215
Draft Decision, Finding 4, available after paragraph 216.
216
Draft Decision, paragraph 220 and 221.
217
Draft Decision, paragraphs 60-82.
218
Draft Decision, paragraphs 83-105.
219
Draft Decision, paragraph 103.
220
Draft Decision, paragraph 103 (referring to TTL Children’s Data and Age Appropriate Design DPIA of 8 October
2020, hereinafter ‘TTL Children’s Data and Age Appropriate Design DPIA’).
221
Draft Decision, paragraph 103. TTL Children’s Data and Age Appropriate Design DPIA lists additionally in
Schedule 2 Part B

.
222
Draft Decision, paragraph 103.
223
Draft Decision, paragraph 104.
224
TTL Children’s Data and Age Appropriate Design DPIA, Schedule 2, p. 31.
225
Draft Decision, paragraph 104.
226
Draft Decision, paragraph 104.

Adopted 27

---

123. The Draft Decision provides for an overview of the measures taken by TTL during the Relevant
Period with regards to age verification, considering the requirement for users of the TikTok
platform to be aged 13 and above227. These measures can be categorised as being either measures
taken prior to the user’s registration or measures taken after the user’s registration.

124. The measures taken prior to the user’s registration are described in the Draft Decision as
follows:

a. During the period from 29 July 2020 to 31 December 2020, TikTok was rated in the
Apple App store as ‘12+’ and in the Google Play store as ‘Parental Guidance
Recommended’228.

b. Individuals who wish to use the TikTok platform must also confirm their date of birth
via an age gate. Individuals are asked to insert their date of birth. No indication is
provided for why this is necessary nor does the selection default to an age over 13229.

c. When individuals insert a date of birth below 13 years of age, the registration process
ceases230 and they were blocked from the app231. Users were not informed that their
input date of birth was the reason for them being blocked from registration.

232
. A pop-up notification states the individual is not
eligible for the TikTok platform. Individuals who seek to re-enter a date of birth,
whether above or below 13, are shown the same notification, and those who re-install
the platform app on their device233.

d. Individuals under the age of 13 who entered a date of birth above 13, 16 or 18 years
gained access to the age-relevant platform settings234.

e. TTL does not require the provision of identity verification documentation in the
registration process (for example, passport, national identity card, etc.)235.

125. Additionally, TTL employed a number of measures applicable after user’s registration, i.e.
aimed to remove users under the age of 13 who accessed the platform in case TTL believed a user
was under 13236:

f. Users and non-users could report a user under 13 using a web form and via the app.
This web form was called ‘Request Privacy Information’, accessible via the ‘TikTok
Help Centre’ and the ‘TikTok Safety Centre’ on both the website and the app.
Reported accounts were referred to moderators237.

227
Draft Decision, paragraphs 190-203.
228
Draft Decision, paragraph 190.
229
Draft Decision, paragraph 191.
230
Draft Decision, paragraph 192.
231
Draft Decision, paragraph 203.
232
Draft Decision, paragraph 203.
233
Draft Decision, paragraph 192.
234
Draft Decision, paragraph 193.
235
Draft Decision, paragraph 199.
236
Draft Decision, paragraph 194.
237
Draft Decision, paragraph 195.

Adopted 28

---

g. TTL also used to identify if an account was held by a user under
13 where such . Where an account did,
it was referred to moderation238.

h. If a moderator in another area considered a user was under 13, ‘they would refer the
account for moderation or could action removal or the account themselves'239.

i. Any accounts flagged for moderation, as suspected to be operated by a user under
the age of 13, was assessed by a moderator,

240
.

j. For accounts deleted this way,
241
.

126. TTL also clarified that it does not require the provision of hard identifiers (identity verification
documentation) in the registration process (for example, passport, national identity card, etc.)242.

127. During the period from 29 July 2020 to 31 December 2020 the approximate total average
243
number of registered EU Child Users on the TikTok platform under the age of 18 was .
TTL does not retain data to determine the approximate number of the TikTok platform users that
were identified as being under the age of 13 when attempting to register during the period from
29 July 2020 to 31 December 2020; however, TTL believes that the approximate number of
individuals in the EU who were failed registration on the basis of their identifying as an individual
below 13 years of age during the equivalent number of days from 14 April to 16 September 2021
244
was . During the period from 29 July 2020 to 31 December 2020, the approximate
number of EU TikTok platform users that were detected as being under 13 subsequent to their
245
registration and removed from the TikTok platform was . In this respect, the IE SA
highlights that this means that during the Relevant Period, in spite of the efforts undertaken by
TTL, approximately of TTL’s approximate average Child Users were detected as being under 13,
and that the number of children under 13 who evaded, and may continue to evade, detection is
unclear246.

128. When assessing the age verification processes that TTL implemented during the Relevant
Period, the IE SA notes that TTL has made extensive efforts to ensure its platform is only accessible
to those over the age of 13247. The IE SA notes that this included the implementation of a neutral
age gate, , utilising the age rating
of the relevant applications stores in order to avail of age-gating device settings on individual
devices, both general and specialist moderation teams to identify those under 13 who had passed
through the age gate, in- and extra-app reporting functions, and

238
Draft Decision, paragraph 196.
239
Draft Decision, paragraph 197.
240
Draft Decision, paragraph 198.
241
Draft decision, paragraph 203.
242
Draft Decision, paragraph 199.
243
Draft Decision, paragraph 200.
244
Draft Decision, paragraph 200.
245
Draft Decision, paragraph 200.
246
Draft Decision, paragraph 211.
247
Draft Decision, paragraph 217.

Adopted 29

---

where those personal data had been used to create an account of a user identified as
under-13248.

129. As mentioned249, the IE SA notes that TTL did not employ the use of hard identifiers in order
to determine the age of children accessing the platform; however, the IE SA accepts TTL’s
submission that such a requirement would be disproportionate. This is because children,
particularly the younger the child, are unlikely to hold or have access to such hard identifiers and
this would act to excluding or locking out Child Users who would otherwise be able to utilise the
platform; also, such a requirement would likely disproportionately affect Child Users from minority
backgrounds250.

130. The IE SA observes that Articles 24 and 25 GDPR do not themselves specify any particular
measure that should be utilised in order to ensure age verification or prevent those for whom a
platform is not intended to gain access to it, and that the area of age verification remains under
development and there are yet to be accepted or stipulated industry or regulatory standards in
this regard. The IE SA further notes that there is certainly no absolute method of age verification
and that, according to the IE SA, it only falls to it to determine if the measures employed were
appropriate with regard to the state of the art, the cost of implementation and the nature, scope,
context and purposes of processing as well as the risks of varying likelihood and severity for rights
and freedoms of natural persons posed by the processing251.

131. Finally, as mentioned above, the IE SA concludes that ‘the technical and organisational
measures in respect of the age verification processes themselves undertaken by TTL complied with
the GDPR in light of the measures undertaken and the extent to which TTL sought to ensure its
platform remained accessible only to those above the age of 13’252.

Summary of the objection raised by the CSA
132. The IT SA raises an objection pursuant to Article 4(24) GDPR and Article 60(4) GDPR with
regards to the conclusion reached by the IE SA in the Draft Decision253 that the technical and
organisational measures deployed by TTL for age verification purposes are compliant with
Article 25 GDPR. The IT SA considers that the LSA should have instead found an infringement of
Article 25 GDPR in that respect254.

133. The IT SA presents several different arguments on why it disagrees with the conclusion
regarding Article 25 GDPR in the Draft Decision.

134. The IT SA generally agrees that there is as yet no age verification method such as to prevent,
in all cases, access to the platform by below-13 users255. However, taking into account the state of
the art and the severity of the risks related to the access to the social network in question by users
below the age of 13, the IT SA disagrees with the finding of compliance made by the LSA256. The

248
Draft Decision, paragraph 217.
249
See paragraph 126 of this Binding Decision.
250
Draft Decision, paragraph 219.
251
Draft Decision, paragraph 220.
252
Draft Decision, paragraph 221.
253
IT SA Objection, p. 2 referring to Draft Decision, paragraphs 189-221.
254
IT SA Objection, p. 2.
255
IT SA Objection, p. 4.
256
IT SA Objection, p. 4.

Adopted 30

---

IT SA refers to news reports indicating the considerable number of the TikTok platform users aged
under 13, as well as to the finding 4 in the Draft Decision concerning the infringement of
Article 24 GDPR257.

135. The IT SA considers that the age verification methods implemented by TTL are ‘seriously
flawed’ and this is also shown by the figures provided by TTL concerning the number of failed
registrations by users declaring to be below the age of 13 during the period from 29 July 2020 to
31 December 2020 and the number of profiles that were removed after being detected to belong
to users below the age of 13258. According to the IT SA, the number of profiles that were removed
means that at least that amount of users below the age of 13 managed to easily access the TikTok
platform and they used it for an unspecified period (and there can be users of the platform who
are below the age of 13 that have remained as yet undetected)259.

136. The IT SA thus argues that the above figures show that the age verification measures
implemented by TTL are inadequate and poorly effective and it is not admissible, in the light of the
relevant legal obligations, such as those arising out of Article 8 GDPR and the corresponding
national laws, that such a high number of users aged below 13 is able to use the TikTok platform260.

137. The IT SA also refers to the age verification system implemented by TTL that blocks the
registration of a user if they select a date of birth showing that they are younger than 13 years old.
The IT SA points out that users can easily dodge the age gate,
– given that no check is performed at this
stage261. The IT SA further argues that the Draft Decision does not specify TTL blocks
the user who entered a date of birth showing that they are younger than 13, since the Draft
262
Decision only refers to the . The IT SA
notes that no information is available as to whether the
263
. According to the IT SA, is not to
be regarded as an effective deterrent measure264.

138. According to the IT SA, the remaining measures referred to by TTL – including, where
appropriate, the implementation as envisaged allegedly by TTL – relate to
blocking mechanisms that are triggered after a child user has entered the TikTok platform. They
fail to do away upstream, prior to the starting of any data processing operation, with the risks
arising from that child user’s exposure on the web and the sharing of their data265.

139. The IT SA recalls Article 24(2) of the CFR and that, according to Recital 38 GDPR, children need
special protection with regards to their personal data as they may be less aware of the risks,
consequences and safeguards concerned and of their rights. In the IT SA’s opinion, this is especially

257
IT SA Objection, p. 4.
258
IT SA Objection, p. 4-5 (referring to Draft Decision, paragraph 211).
259
IT SA Objection, p. 4-5.
260
IT SA Objection, p. 5.
261
IT SA Objection, p. 5.
262
IT SA Objection, p. 5.
263
IT SA Objection, p. 5.
264
Draft Decision, paragraph 203, point ii.
265
IT SA Objection, p. 5.

Adopted 31

---

the case if the collection of personal data with regard to children takes place when using services
offered directly to a child – as it is the case with the TikTok platform266.

140. The IT SA finds that, taking into consideration the peculiar risks arising from the online
processing of data relating to below-13 child users in the specific context of the social network
platform at issue, and by having regard to statistics and media reports, the measures deployed by
TTL cannot be considered to be ‘suitable and appropriate’267.

141. The IT SA further disagrees that the implementation of such measures is grounded merely in
their ‘reasonableness’ rather than in a much more demanding, stringent evaluation regarding the
factual effectiveness of the measures at issue also over time (as also recalled in Recital 74 GDPR).
Moreover, the IT SA states that the consideration that there is a factually high level of danger for
child users, should translate into an equally high level of commitment by TTL, which should not
leave any feasible measure out of the scope of the tools to be implemented268.

142. The IT SA in its objection refers to alternative means for the age verification269. The IT SA
argues that TTL should implement more complex measures that can bring about more effective
safeguards – possibly without relying on hard verification measures: captcha, asking age-targeted
questions, requiring another registered member acting as ‘trusted third party’ to step in and
confirm the registering user’s age, etc.270 The IT SA further suggests that one option could be age
verification via a public or private trusted third party entity, which could certify individual features
(here, the age or the fact of the person being above a certain age) without the need for disclosing
the person’s identity271. Additionally, the IT SA refers to the standard BSI PAS 1296:2018272.

143. The IT SA argues that, considering the serious risks child users are exposed to, as well as the
nature, scope, context (social networks) and purposes of the processing, TTL should have at least
made the effort to implement all known state of the art solutions to avert the risks related to the
processing for below-13 child users273.

144. According to the IT SA, from the accountability perspective, one cannot accept that a leading-
edge technologically innovative company such as TTL – which is addressing its services
overwhelmingly to young or very young users – has not even attempted to develop more effective

266
IT SA Objection, p. 5-6. IT SA further states: ‘On top of these legal provisions, one should take account
unfortunately of the aforementioned cases as reported by the media. These go to show, on the one hand, that
below-13 Child Users are unable to fully and appropriately realise the dangers lurking behind a social network
platform; on the other hand, they require factually more stringent, targeted assessment exercises regarding the
measures deployed by the controllers of such platforms to prevent unauthorised accesses. The facts at issue
have shown that the likelihood for below-13 Child Users to easily access and readily use social networks remains
worryingly high if the technical and organisational measures for age verification are not strengthened
adequately, which ultimately carries the risk not only that equally tragical events take place but, more generally,
that such users are exposed to dangers’ (IT SA Objection, p. 6).
267
IT SA Objection, p. 6.
268
IT SA Objection, p. 6.
269
IT SA Objection, p. 6-7.
270
IT SA Objection, p. 6.
271
IT SA Objection, p. 6.
272
The British Standards Institution, PAS 1296:2018: Online age checking. Provision and use of online age check
services. Code of Practice, published on 31 March 2018: https://knowledge.bsigroup.com/products/online-age-
checking-provision-and-use-of-online-age-check-services-code-of-practice/standard, (hereinafter ‘BSI PAS
1296:2018’) (referred to in the IT SA Objection, p. 6).
273
IT SA Objection, p. 7.

Adopted 32

---

measures compared to the
, and that it has not envisaged any measures in case of untrue
declarations by that user except for the reporting by other users274. The IT SA further recalls that
in the case at hand the ban on access for below-13 child users is a fundamental precondition the
company is required to fulfil with a view to carrying on its business and, if the company is unable
to ensure appropriate safeguards, it would have to discontinue its core business with all the related
processing of personal data275.

145. Based on the above, the IT SA finds that the age verification measures deployed by TTL with
regard to below-13 child users are insufficient and accordingly Article 25 GDPR has been infringed
in this respect, since TTL failed to implement appropriate technical and organisational measures to
ensure and to be able to demonstrate compliance with the GDPR; this is especially so by having
regard to the likelihood and severity of the risks for the rights and freedoms of natural persons, to
the data subjects’ age, and to the state of the art276.

146. Finally, the IT SA states that were the Draft Decision left unchanged in this connection, this
would entail significant risks for the protection of the rights of the data subjects277. According to
the IT SA, the failure to find the infringement in question would set a dangerous precedent, since
one would fail to flag the need for the controller’s processing activities to be amended and would
endanger the data subjects in this respect278. This could also encourage other controllers from the
social networking sector to implement inadequate age verification measures and as a consequence
enhance the risks for below-13 Child Users279.

Position of the LSA on the objection
147. The IE SA considers that the objection raised by the IT SA concerning the infringement of
Article 25 GDPR constitutes a relevant and reasoned objection280. The IE SA however states that it
does not intend to follow the IT SA’s objection281.

148. In its Composite Response, the IE SA firstly observes that the IT SA is the only CSA to have
expressed concern with the proposed outcome of IE SA’s assessment of the extent to which TTL
has achieved compliance with its obligations pursuant to Article 25 GDPR. Based on this, the IE SA
asserts that the consensus position, shared amongst all other CSAs, supports the retention of the
analysis and conclusion in the Draft Decision282.

149. The IE SA further notes the IT SA’s position that, in finding an infringement of Article 25 GDPR,
a controller could be ordered to ‘rely on public or private trusted third parties “certifying”
individual features’283. While, as stated above at paragraph 20 of this Binding Decision, the IT SA
withdrew the part of its objection concerning the request for a compliance order under
Article 58(2)(d) GDPR in relation to the possible infringement of Article 25 GDPR, the IT SA referred

274
IT SA Objection, p. 7.
275
IT SA Objection, p. 7.
276
IT SA Objection, p. 7.
277
IT SA Objection, p. 8.
278
IT SA Objection, p. 8.
279
IT SA Objection, p. 8.
280
IE SA’s assessment of the objections, p. 2.
281
Composite Response, p. 7.
282
Composite Response, p. 5.
283
Composite Response, p. 5.

Adopted 33

---

to third party certification mechanisms in support of its proposed infringement of Article 25 GDPR
in its objection284 and the IE SA expressed its position on those mechanisms in this context also.
The IE SA states that, leaving aside the question of whether such services (as they pertain to
children) might even be available in each Member State, the IE SA notes that this particular
methodology is just one of a range of possible methods outlined by the BSI PAS 1296:2018 that a
controller might elect to utilise, either by itself or in combination with other methods, for ‘age-
gating’ purposes285.

150. With respect to the envisaged outcome, the IE SA notes that, if the IT SA’s objection regarding
the infringement of Article 25 GDPR were followed, the obligations placed upon controllers by
the GDPR require the controller itself to determine, by reference to its unique knowledge of its
own business and data processing activities, the methods by which it will achieve compliance with
its obligations286.

151. The IE SA further observes the risk of an unintended consequence of limiting the guidelines
that are currently being prepared, at EDPB level, on the subject of children’s data287.

Analysis of the EDPB

5.4.1 Assessment of whether the objection was relevant and reasoned
152. The objection raised by the IT SA concerns ‘whether there is an infringement of the GDPR’288.

153. The IT SA in its objection disagrees289 with the IE SA’s finding in the Draft Decision that the
technical and organisational measures implemented by TTL during the Relevant Period in respect
of age verification processes themselves complied with Article 25 GDPR290. The IT SA requests the
IE SA to overturn this finding and to conclude that Article 25 GDPR was infringed291. The EDPB
considers that there is a clear connection between the IT SA’s objection and the Draft Decision292,
since the IT SA’s objection relates to specific legal and factual content of the Draft Decision293 and,
if followed, it would lead to a different conclusion as to whether there is an infringement of
Article 25 GDPR294. In consequence, the EDPB finds the objection to be relevant.

154. The EDPB takes note of TTL’s view that the IT SA’s objection fails to meet the ‘Adequately
Reasoned Threshold’ as it does not provide any sound or substantiated reasoning for the position
that TTL age verification measures in place during the Relevant Period did not align with the
relevant state of the art during the Relevant Period, or even identify what the relevant ‘state of the

284
IT SA Objection, p. 6 and 7.
285
Composite Response, p. 5.
286
Composite Response, p. 5.
287
Composite Response, p. 5
288
EDPB Guidelines on RRO, paragraph 24.
289
IT SA Objection, p. 2, 4, 7.
290
Draft Decision, paragraphs 210-221, in particular paragraph 221.
291
IT SA Objection, p. 2, 7.
292
EDPB Guidelines on RRO, paragraph 12.
293
EDPB Guidelines on RRO, paragraph 14. Specifically, the IT SA’s objection refers to the Inquiry carried out by
the LSA on age verification measures as set out in paragraphs 189-221 of the Draft Decision (IT SA Objection,
p. 2) and to the conclusion reached by the IE SA in paragraph 221 of the Draft Decision.
294
EDPB Guidelines on RRO, paragraph 13.

Adopted 34

---

art’ was295. Further, TTL claims that the IT SA fails to identify the specific legal error in the Draft
Decision regarding compliance with Article 25(1) GDPR and contradicts itself when assessing the
relevant legal standard296. The EDPB observes that TTL’s position relates to the content of the
objection, which concerns its merits and not its admissibility. The EDPB assesses in the following
paragraphs if the IT SA’s objection meets the threshold of being ‘reasoned’ in accordance with
Article 4(24) GDPR.

155. The EDPB notes that the IT SA puts forward several legal and factual arguments in its objection
in order to demonstrate why Article 25 GDPR was infringed by TTL in this particular case297.

156. First, the IT SA presents arguments demonstrating why, based on the numbers provided by
TTL and referred to in the Draft Decision298, the age verification methods implemented by TTL are
‘seriously flawed’299. For example, according to the IT SA, these numbers point to the inadequacy
and poor effectiveness of the measures implemented by TTL and such a high number of below-13
child users is inadmissible in the light of the relevant obligations under the law300. With regard to
the age gate implemented by TTL, the IT SA notes that it can be ‘easily dodged’301 and that the
system based on self-declarations does not appear to entail any ‘reasonable likelihood’ of
effectiveness such as to justify its implementation in the first place302. The IT SA also considers that
TTL failed to fulfil its obligation to demonstrate the effectiveness of the measures it has
deployed303. Furthermore, the IT SA argues why all the remaining measures referred to by TTL fail
to address the risks arising for child users in this case304.

157. Next, the IT SA recalls that children merit specific protection with regard to the processing of
their data by referring to Article 24(4) CFR and Recital 38 GDPR305. The IT SA puts forward the
argument that this should be considered when assessing the measures implemented by the
controller306. The IT SA contends that, taking into consideration the peculiar risks arising from the
online processing of data relating to below-13 child users in the specific context of the social
network platform at issue, and by having regard to statistics and media reports, the measures
deployed by TTL cannot be considered to be ‘suitable and appropriate’307.

295
TTL Art. 65 Submissions, paragraphs 6.2, 6.6, 6.7.
296
TTL Art. 65 Submissions, paragraph 6.8.
297
See as well Section 5.2 above.
298
In particular, the IT SA refers to the number of failed registrations and the number of profiles that were
removed after being detected to belong to users below the age of 13 during the period from 29 July 2020 to 31
December 2020 (IT SA Objection, p. 4-5).
299
IT SA Objection, p. 4-5 (referring to Draft Decision, paragraph 211).
300
IT SA Objection, p. 5.
301
IT SA Objection, p. 5: ‘since it is enough for a user to enter any date of birth in order to register with the
platform – given that no check is performed at this stage’.
302
The IT SA also refers to the fact that is blocked after a failed registration and questions the
relevance of this element for the assessment made in the Draft Decision (IT SA Objection, p. 5). The IT SA further
argues that is not to be regarded as an effective deterrent measure’ (IT SA
Objection, p. 6).
303
IT SA Objection, p. 5.
304
IT SA Objection, p. 5.
305
IT SA Objection, p. 5.
306
IT SA Objection, p. 6.
307
IT SA Objection, p. 6. The IT SA also notes that the consideration that there is a factually high level of danger
for Child Users, should translate into an equally high level of commitment by TTL, which should not leave any
feasible measure out of the scope of the tools to be implemented (IT SA Objection, p. 6).

Adopted 35

---

158. Furthermore, the IT SA points out to other available measures for age verification308 and states
that, ‘taking account of the serious risks child users are exposed to as well as of the nature, scope,
context (social networks) and purposes of the processing, the platform should have at least made
the effort to implement all known state-of-the-art solutions to avert the risks related to the
processing for below-13 child users’309. The IT SA argues that from the accountability perspective
it is not acceptable that TTL has not even attempted to develop more effective measures310.

159. Finally, the IT SA clearly indicates how its requested change would leave to a different
conclusion311, i.e. the IT SA asks the IE SA to find that Article 25 GDPR has been infringed since the
controller failed to implement appropriate technical and organisational measures to ensure and
be able to demonstrate compliance with the GDPR312.

160. In consequence, the EDPB finds the objection to be reasoned.

161. In order for an objection to meet the threshold set by Article 4(24) GDPR, it also needs to
clearly demonstrate the significance of the risks posed by the Draft Decision313.

162. The EDPB takes note of TTL’s view that the IT SA’s objection does not meet the ‘Significant
Risk Threshold regarding the alleged risk to the fundamental rights and freedoms of data subjects’
as the IT SA’s objection lacks specificity in this respect314.

163. The EDPB is not swayed by TTL’s argument and finds that the IT SA’s objection clearly
demonstrates the risk to the rights for the data subjects if the Draft Decision were left unchanged.
The IT SA states that the likelihood for below-13 child users to easily access and readily use social
networks remains worryingly high if the technical and organisational measures for age verification
are not strengthened adequately, which ultimately carries the risk that such users are exposed to
dangers315. The IT SA further notes that the failure to find the infringement of Article 25 GDPR with
respect to the measures implemented by TTL and the resulting endorsement of the practices
followed so far by TTL would give rise to a dangerous precedent, since this would fail to flag the
need for TTL’s processing activities to be amended and would endanger the data subjects whose
data are and will be processed by that controller316. Moreover, the IT SA points out that other
controllers from the social networking sector might decide to implement inadequate age
verification measures and this would in turn enhance the risks for below-13 child users317.

164. Considering the above, the EDPB finds that the objection of the IT SA regarding the existence
of the infringement of Article 25 GDPR is relevant and reasoned pursuant to Article 4(24) GDPR.

308
IT SA Objection, p. 6-7.
309
IT SA Objection, p. 7.
310
IT SA Objection, p. 7.
311
EDPB Guidelines on RRO, paragraph 16.
312
IT SA Objection, p. 7.
313
EDPB Guidelines on RRO, paragraph 35.
314
TTL Art. 65 Submissions, paragraph 6.12.
315
IT SA Objection, p. 6.
316
IT SA Objection, p. 8.
317
IT SA Objection, p. 8.

Adopted 36

---

5.4.2 Assessment on the merits
165. In accordance with Article 65(1)(a) GDPR, the EDPB shall take a binding decision concerning
all the matters which are the subject of the relevant and reasoned objections, in particular whether
there is an infringement of the GDPR.

166. The EDPB notes that the IT SA’s objection, found to be relevant and reasoned in section 5.4.1,
requests the IE SA to change the Draft Decision in order to find an infringement of Article 25 GDPR
insofar it relates to the age verification measures implemented by TTL in the TikTok platform.

167. The EDPB considers that, while the IT SA does not differentiate in its objection between
specific parts of Article 25 GDPR, on the basis of its wording and content, the IT SA’s objection is
targeting specifically an alleged lack of compliance by TTL with Article 25(1) GDPR. Therefore, the
scope of the EDPB’s analysis in this section covers whether TTL has infringed Article 25(1) GDPR
(‘data protection by design’) with regard to the age verification measures implemented by TTL in
the context of the TikTok platform during the Relevant Period.

168. When assessing the merits of the IT SA’s objection, the EDPB also takes into account TTL’s
position on the objection and its submissions.

169. On a preliminary note, the EDPB recalls that, as stated in paragraph 87 of this Binding Decision,
the argument of the IE SA318, that the lack of similar objections by other CSAs indicates a consensus
with these CSAs, has no impact on the EDPB’s assessment of the merits in the case at hand.

TTL’s position on the objection and its submissions

170. TTL submits that the IE SA finding in the Draft Decision that TTL age verification measures
deployed during the Relevant Period complied with the GDPR was correct and supported by the
evidence before the IE SA319.

171. First, TTL claims that IT SA in its objection fails to establish the ‘state of the art’ during the
Relevant Period and to demonstrate how TTL fell below that standard320. In particular, TTL argues
that there was no universally established or accepted ‘state of the art’ for internet platforms of this
type during the Relevant Period and there was no regulatory guidance in place during the Relevant
Period – or even today – specifying what constitutes appropriate and effective age verification
mechanisms321. TTL asserts that the lack of concrete guidance regarding the processing of
children’s data under the GDPR is also demonstrated by the fact that various SAs have recently
been conducting public consultations on this topic and that the EDPB is preparing guidelines on the
processing of children’s data322. TTL further refers to the expert evidence of (the
‘Expert Report of ’, at Annex 2 of TTL Art. 65 Submissions, hereinafter Report’),
which finds that TTL age verification measures during the Relevant Period compared favourably
with the practices of industry peers and other age-restricted sectors323. TTL also refers to the
statement by the IE SA in the Composite Response that the CSAs (with the exception of the IT SA)

318
See paragraph 148 of this Binding Decision above.
319
TTL Art. 65 Submissions, paragraph 6.16.
320
TTL Art. 65 Submissions, paragraph 6.29.
321
TTL Art. 65 Submissions, paragraphs 6.20-6.23.
322
TTL Art. 65 Submissions, paragraphs 6.24-6.25.
323
TTL Art. 65 Submissions, paragraphs 6.27-6.28; Report, sections 6.2.1 and 6.2.3.

Adopted 37

---

are in consensus that TTL age verification measures were appropriate during the Relevant
Period324.

172. Second, TTL argues that Article 25(1) GDPR only require controllers to implement
‘appropriate’ measures and these have to be interpreted in the context of the regulatory landscape
and industry practice at the time325. TTL asserts that the standard of ‘appropriateness’ means that
a controller is required to implement measures to determine the age of users with an appropriate
level of certainty (having regard to the various factors set out in Articles 24 and 25 GDPR including
the risks presented by the processing) not with an absolute level of certainty326.

173. According to TTL, the IT SA seeks to incorrectly introduce a standard of factual effectiveness
rather than appropriateness, when arguing that an infringement of Article 25 GDPR is evidenced
because TTL identified individuals suspected to be under the age of 13 on the TikTok Platform
through its various age verification measures327. TTL argues that the neutral age-gate and
supplementary measures that were implemented satisfied TTL’s Article 25 GDPR obligations,
compared favourably to contemporary industry practice and were ’appropriate’328.

174. Finally, TTL insists that the age verification measures implemented by TTL during the Relevant
Period reflected the best practice at the time in terms of balancing their effectiveness against
considerations of data minimisation under Article 5(1)(c) GDPR329.

EDPB’s assessment on the merits

175. The EDPB recalls that Article 25(1) GDPR requires controllers to have data protection designed
into their processing of personal data and that applies throughout the processing lifecycle. The
core of the provision is to ensure appropriate and effective data protection by design, which means
that controllers should be able to demonstrate that they have implemented the appropriate
measures and safeguards in the processing of personal data to ensure that the requirements of the

324
TTL Art. 65 Submissions, paragraph 6.29.
325
TTL Art. 65 Submissions, paragraph 6.31.
326
TTL further argues that this view is ‘supported by guidance issued by supervisory authorities. For example,
the ICO states that the level of certainty for age verification needs to be “appropriate to the risks to the rights
and freedoms of children”, rather than an absolute threshold’ (TTL Art. 65 Submissions, paragraph 6.32).
327
TTL Art. 65 Submissions, paragraphs 6.32-6.33. TTL further argues in paragraphs 6.34-6.35 of its Submissions:
‘No age verification method is 100% effective and the Italian SA’s Objection should properly consider that, as
explained in paragraph 6.32 above, the standard of “appropriateness” means that a controller is required to
implement measures to determine the age of users with an appropriate level of certainty (having regard to the
various factors set out in Art. 24 and 25 GDPR including the risks presented by the processing), not with an
absolute level of certainty. The GDPR does not require the absolute exclusion of underage users from the
Platform; rather, it requires appropriate measures to be implemented. If anything, the fact that TikTok actively
detects and removes underage accounts, as reflected by the removal figures cited in the Italian SA’s Objection,
is evidence of TikTok's reasonable, diligent efforts to keep individuals under the age of 13 off of the Platform.’
328
TTL Art. 65 Submissions, paragraphs 6.37-6.43. With respect to the measure of block, TTL contends
that it ‘is in line with the ICO’s AADC, which provides that self-declaration may be suitable when used in
conjunction with other techniques, such as
’ (TTL Art. 65 Submissions, paragraph
6.42).
329
TTL Art. 65 Submissions, paragraphs 6.44-6.48.

Adopted 38

---

GDPR are met and that the data protection principles330 and the rights and freedoms of data
subjects are effective331.

176. As a preliminary remark, the EDPB notes that the measures implemented by TTL (as described
in paragraphs 124-125 of this Binding Decision above) constitute of an ex ante part and an ex post
part. The ex ante part is comprised of the steps a) - c), whereas the ex post part constitutes f) - i).
The points d), e) and j) merely provide additional information about the circumstances of the
measures. Further, it must be noted that, while in the context of the Draft Decision the IE SA and
TTL refer to ‘age verification’, indeed, little verification, i.e. the confirmation as true or proofing by
good evidence, is taking place332. Only one aspect of the ex post measures, the identifying users
that in their profile description state to be- below 13, is verifying the age of the user. The remaining
measures do not aim at collecting any form of reliable evidence that would allow indeed to verify
the age. TTL in this regard acknowledges this by calling its solution under point a) an Age Gate,
rather than an age verification process. However, for the sake of consistency, the EDPB will below
refer to the ex ante and ex post measures as ‘age verification’ measures.

177. The EDPB underlines that, in the context of Article 25(1) GDPR, the requirement for the
measures to be ‘appropriate’ means that the measures and necessary safeguards implemented by
a controller should be suited to achieve the intended purpose, i.e. they must implement the data
protection principles and secure the rights of data subjects ‘effectively’333. The EDPB notes that the
concept of ‘effectiveness’ in the context of data protection law stems from the objective of
the GDPR to ensure ‘effective protection of personal data throughout the Union’334.

178. The EDPB thus disagrees with TTL’s assertion that the IT SA seeks to introduce a standard of
‘factual effectiveness’ rather than ‘appropriateness’ when assessing TTL’s compliance with
Article 25 GDPR and that the IT SA’s objection incorrectly considers the effectiveness of the age
verification measures implemented by TTL335.

179. The EDPB also underlines that, in line with the accountability principle, TTL as the controller is
liable to demonstrate its compliance with the data protection principles and its other obligations
under GDPR in relation to the processing at stake336.

180. While Article 25(1) GDPR does not require the implementation of any specific technical and
organisational measures, and the controller has discretion in respect of the choice of the measures
and safeguards, the measures and safeguards chosen by the controller have to be designed to be
robust taking into account the risks associated with the processing. The EDPB considers that under
Article 25(1) GDPR the requirement of appropriateness is therefore closely related to the

330
The data protection principles as listed in Art. 5 GDPR.
331
EDPB Guidelines on Data Protection by Design and by Default, V1.0, paragraph 2 and EDPB Guidelines on
Data Protection by Design and by Default, V2.0, paragraph 2.
332
See definition in Oxford English Dictionary
https://www.oed.com/view/Entry/222511?redirectedFrom=verify.
333
EDPB Guidelines on Data Protection by Design and by Default, V2.0, paragraphs 7 and 8.
334
Recital 11 GDPR. See also CJEU case law, e.g. Judgement of the Court of Justice of 13 May 2014, Google Spain,
C-131/12, ECLI:EU:C:2014:317, paragraphs 38, 53, 58.
335
TTL Art. 65 Submissions, paragraphs 6.32-6.33. The EDPB notes that the notion of ‘factual effectiveness’ is
introduced by TTL in its submissions and is not referred to as such in the IT SA’s objection.
336
Art. 5(2) and Art. 24 GDPR, also Recital 74 GDPR.

Adopted 39

---

requirement of effectiveness337. Whether or not the measures chosen by the controller in the
particular case are appropriate depends on the assessment of the elements listed in
Article 25(1) GDPR338.

181. The EDPB therefore proceeds below with an analysis of those elements, in order to assess if
the age verification measures implemented by TTL in the present case comply with
Article 25(1) GDPR. The analysis will address, in turn: ‘nature, scope, context and purpose of
processing’, ‘risks of varying likelihood and severity for rights and freedoms of natural persons
posed by the processing’, the ‘state of the art’, the ‘cost of implementation’ and the effectiveness
of the measures implemented by TTL in light of the requirements of Article 25(1) GDPR339. This will
be carried out for both the ex ante and the ex post measures implemented by the controller. Finally,
based on the elements available to the EDPB in the context of this procedure, the EDPB will assess
whether, in accordance with Article 25(1) GDPR, the measures implemented by TTL were
appropriate in this particular case.

‘nature, scope, context and purpose of processing’

182. The EDPB recalls that the concept of nature relates to the inherent characteristics of the
processing340. As stated in the Draft Decision, this case relates to the processing of personal data
of children under the age of 13 in the context of the TikTok platform, both mobile application- and
website-based, in particular age verification341. As noted in the IT SA’s objection, the TikTok
platform is a service that is offered directly to children342.

183. The scope refers to the size and range of the processing343. As described above, TTL does not
retain data to determine the approximate number of the TikTok platform users that were identified
as being under the age of 13 when attempting to register during the period from 29 July 2020 to
31 December 2020 and therefore provides an assumed approximate number of prevented
registrations by users under the age of 13 ( ) and an assumed number of accounts of users
under the age of 13 being closed proactively by TTL itself ( )344. The Draft Decision further
notes that during the Relevant Period, in spite of the efforts undertaken by TTL, approximately
of TTL’s approximate average Child Users were detected as being under 13, and that the number
of children under 13 who evaded, and may continue to evade, detection is unclear345.

184. As noted in the IT SA’s objection, the fact that such an amount of profiles was removed means
that as many below-13 child users managed to easily access the platform and used it for an
unspecified period – not to mention all the below-13 child users of the platform that have remained
as yet undetected346. The Draft Decision also establishes that TTL processed the personal data of

337
EDPB Guidelines on Data Protection by Design and by Default, V1.0, paragraph 8 and EDPB Guidelines on
Data Protection by Design and by Default, V2.0, paragraph 8.
338
EDPB Guidelines on Data Protection by Design and by Default, V2.0, paragraphs 14, 17.
339
Art. 25(1) GDPR.
340
EDPB Guidelines on Data Protection by Design and by Default, V1.0, paragraph 27 and EDPB Guidelines on
Data Protection by Design and by Default, V2.0, paragraph 28.
341
Draft Decision, paragraph 61.
342
IT SA Objection, p. 6.
343
EDPB Guidelines on Data Protection by Design and by Default, V1.0, paragraph 27 and EDPB Guidelines on
Data Protection by Design and by Default, V2.0, paragraph 28.
344
See paragraph 127 of this Binding Decision above.
345
Draft Decision, paragraphs 67 and 211.
346
IT SA Objection, p. 5.

Adopted 40

---

at least those children under 13 whose account was detected, and by setting accounts to public by
default, TTL ensured that the scope of processing of social media content of those children under
13 was potentially very extensive, being made accessible without restriction to an indeterminate
global audience347.

185. As established in the Draft Decision, the accounts of registered TikTok platform users were
public-by-default348. This meant that, for example, a public account was viewable not only by both
every single TikTok platform user via the app and every single TikTok platform user via the website,
but also by an effectively indeterminate number of persons who were not registered TikTok
platform users on the website349. The implications of this are particularly severe and wide-ranging
– the content published by Child Users, including those under the age of 13 who remained
undetected, on the TikTok platform where the account was public-by-default and not otherwise
restricted by individual video-settings, could be accessed, viewed and otherwise processed beyond
the control of the data subject and TTL350.

186. The processing at stake therefore affected a large number of vulnerable persons351 and the
extent of the processing of their personal data was potentially very large.

187. The EDPB recalls that the concept of context relates to the circumstances of the processing352.
The EDPB underlines that the processing at stake concerns personal data of a high number of
particularly young children, i.e. children under 13 years old, in the context of their use of a social
media platform.

188. Article 24(2) CFR provides that ‘in all actions relating to children, whether taken by public
authorities or private institutions, the child's best interests must be a primary consideration’353.
The EDPB also recalls that, in accordance with Article 3(1) of the United Nations Convention on the
Rights of the Child, ‘the best interests of the child shall be a primary consideration’354. As pointed
out both by the IE SA in the Draft Decision and by the IT SA in its objection, the GDPR recognises
children as a vulnerable category of natural persons. This is displayed by a number of provisions in
the GDPR355. In particular, Recital 38 GDPR states that children ‘merit specific protection with
regard to their personal data, as they may be less aware of the risks, consequences and safeguards
concerned and their rights in relation to the processing of personal data’356. Moreover, as raised

347
Draft Decision, paragraph 67.
348
Draft Decision, paragraphs 80, 128.
349
Draft Decision, paragraph 160.
350
Draft Decision, paragraph 160.
351
See this Binding Decision, paragraphs 127 and 183-184 above.
352
EDPB Guidelines on Data Protection by Design and by Default, V1.0, paragraph 27 and EDPB Guidelines on
Data Protection by Design and by Default, V2.0, paragraph 28.
353
Art. 24(2) CFR, also as referred to in the IT SA Objection, p. 5.
354
Art. 3(1) of the United Nations Convention on the Rights of the Child (adopted by a resolution 44/25 of the
General Assembly of the United Nations on 20 November 1989) stating that: ‘In all actions concerning children,
whether undertaken by public or private social welfare institutions, courts of law, administrative authorities or
legislative bodies, the best interests of the child shall be a primary consideration’.
355
See also Judgment of the Court of Justice of 4 July 2023 in case Meta Platforms et al v Bundeskartellamt,
C‑252/21, ECLI:EU:C:2023:537, paragraph 111.
356
Draft Decision, paragraph 69; IT SA objection, p. 5.

Adopted 41

---

by the IT SA357, the GDPR, for instance its Article 8358, envisages enhanced requirements for the
processing of personal data of children under the age of 13 and in some cases, depending on
Member State law, even for children of up to 16 years of age359.

189. The consideration of the special protection guaranteed for children is particularly relevant in
the present case as the TikTok platform is a social media service that is offered directly to
children360 - i.e. there is an offer of information society services directly to a child361.

190. The EDPB also observes that the processing of personal data is at the core of the TTL business
and the ban on access for below-13 child users to the TikTok platform is a fundamental
precondition TTL is required to fulfil with a view to carrying out its business362. As the IT SA
highlights, the company would have to otherwise discontinue its core business with all the related
processing of personal data363.

191. Moreover, as observed by the IT SA in its objection364, there have been numerous reports
indicating possible dangers to children related to their use of the TikTok platform. These risks were
also acknowledged by TTL in its DPIA (

365
).

192. The purpose pertains to the aims of the processing366. TTL provides the TikTok platform367.
The Draft Decision states that ‘TikTok is a video-focused social media platform that allows
registered users to create and share videos of varying durations and to communicate with other
users through messages’368. As submitted by TTL, it ‘provided a global entertainment platform that,
at its core, was designed to enable Users to create and share video content, enjoy videos from a
variety of creators, and otherwise express their creativity, such as by interacting with videos to
express new perspectives and ideas’369.

357
IT SA Objection, p. 5. The IT SA refers to Art. 8 GDPR.
358
Art. 8 (1) GDPR. The EDPB also recalls that Art. 6(1)(f) GDPR, referring to the legal basis for processing
consisting in the necessity for the purposes of the legitimate interests of the controller or a third party, raises in
particular the case where the data subject is a child in the context of the balancing exercise to be carried out by
the controller. The EDPB further recalls that, if a data subject is a child, this is also a relevant factor for the
controller to take into account when relying on Art. 6(1)(b) GDPR, see EDPB Guidelines 2/2019 on
Art. 6(1)(b) GDPR, paragraph 13.
359
Art. 8(1) GDPR.
360
IT SA Objection, p. 6.
361
The EDPB recalls that, as TTL explicitly acknowledges, it offers the TikTok platform to users under 18 years of
age (Draft Decision, paragraphs 12 and 13).
362
IT SA Objection, p. 7.
363
IT SA Objection, p. 7.
364
IT SA Objection, p. 6.
365
TTL Children’s Data and Age Appropriate Design DPIA, Risk n. 1 on p. 31 and Risk n. 6 on p. 38 (on p. 32 and
39, TTL describes the measures taken to mitigate these risks).
366
EDPB Guidelines on Data Protection by Design and by Default, V1.0, paragraph 27 and EDPB Guidelines on
Data Protection by Design and by Default, V2.0, paragraph 28.
367
Draft Decision, paragraphs 7 and 10.
368
Draft Decision, paragraph 5.
369
Draft Decision, paragraph 5, referring to TTL PDD Submissions, paragraphs 3.1-3.2.

Adopted 42

---

193. This primary purpose informed the way in which the TikTok platform operated370, while TTL,
as a private company, is pursuing commercial interest by carrying out the processing in the context
of its services. In this respect, the EDPB observes that the number of users of the TikTok platform
and the level of their engagement in the TikTok platform in relation to the processing at stake has
relevance for commercial interests of TTL.

‘risks of varying likelihood and severity for rights and freedoms of natural persons posed by the
processing’

194. As a general remark, the EDPB recalls that, when performing the risk analysis for compliance
with Article 25(1) GDPR, the controller has to identify the risks to the rights of data subjects and
determine their likelihood and severity in order to implement measures to effectively mitigate the
identified risks371. A systematic and thorough evaluation of the processing is crucial when doing
risk assessments. The controller must always carry out a data protection risk assessment on a case
by case basis for the processing activity at hand and verify the effectiveness of the appropriate
measures and safeguards envisaged372.

195. Therefore, in complying with the requirements of Article 25(1) GDPR, in the first instance, it is
necessary to identify the risks to the rights and freedoms of data subjects that a violation of the
data protection principles presents. The controller must have regard to the likelihood and severity
of those risks and must implement measures to effectively mitigate them.

196. Recital 75 GDPR provides examples of risks to the rights and freedoms of natural persons.
These risks may include physical, material or non-material damage to natural persons373.
Recital 76 GDPR provides guidance as to how risk should be evaluated, i.e. by reference to the
nature, scope, context and purposes of the processing and on the basis of an objective
assessment374. The EDPB recalls that the GDPR adopts a coherent risk based approach in many of
its provisions, in Articles 24, 25, 32 and 35 GDPR, with a view to identifying appropriate technical

370
TTL PDD Submissions, paragraph 3.2.
371
EDPB Guidelines on Data Protection by Design and by Default, V1.0, paragraph 29 and EDPB Guidelines on
Data Protection by Design and by Default, V2.0, paragraph 30.
372
EDPB Guidelines on Data Protection by Design and by Default, V1.0, paragraph 31 and EDPB Guidelines on
Data Protection by Design and by Default, V2.0, paragraph 32.
373
Recital 75 GDPR:
‘The risk to the rights and freedoms of natural persons, of varying likelihood and severity, may result from
personal data processing which could lead to physical, material or non-material damage, in particular: where
the processing may give rise to discrimination, identity theft or fraud, financial loss, damage to the reputation,
loss of confidentiality of personal data protected by professional secrecy, unauthorised reversal of
pseudonymisation, or any other significant economic or social disadvantage; where data subjects might be
deprived of their rights and freedoms or prevented from exercising control over their personal data; where
personal data are processed which reveal racial or ethnic origin, political opinions, religion or philosophical
beliefs, trade union membership, and the processing of genetic data, data concerning health or data concerning
sex life or criminal convictions and offences or related security measures; where personal aspects are evaluated,
in particular analysing or predicting aspects concerning performance at work, economic situation, health,
personal preferences or interests, reliability or behaviour, location or movements, in order to create or use
personal profiles; where personal data of vulnerable natural persons, in particular of children, are processed; or
where processing involves a large amount of personal data and affects a large number of data subjects’
(emphasis added).
374
Recital 76 GDPR.

Adopted 43

---

and organisational measures to protect individuals, their personal data and complying with the
requirements of the GDPR375.

197. The EDPB takes note that TTL has conducted the risk assessment with regard to the use of the
TikTok platform by Child Users. Schedule 2 to the TTL Children’s Data and Age Appropriate Design
DPIA376 sets out the risks identified, a description of the risk, an assessment of the risk level before
any mitigations are put in place (‘Inherent Risk’), the proposed mitigation measures to be put in
place, and an assessment of the risk level after the relevant mitigations have been put in place
(‘Residual Risk’). The methodology for calculating the overall risk score for each risk is as follows:
. This is applied for both the Inherent Risk
377
and the Residual Risk .

198. The TTL Children’s Data and Age Appropriate Design DPIA identifies thirteen risks to Child
Users378. These are:

375
EDPB Guidelines on Data Protection by Design and by Default, V1.0, paragraph 28 and EDPB Guidelines on
Data Protection by Design and by Default, V2.0, paragraph 29, also stating that: ‘[t]he assets to protect are
always the same (the individuals, via the protection of their personal data), against the same risks (to individuals’
rights), taking into account the same conditions (nature, scope, context and purposes of processing)’.
376
TTL Children’s Data and Age Appropriate Design DPIA, Schedule 2.
377
TTL Children’s Data and Age Appropriate Design DPIA, Schedule 2, Part A.
378
TTL Children’s Data and Age Appropriate Design DPIA at Part B, Schedule 2; Draft Decision, paragraph 90.

Adopted 44

---

199. As stated in the Draft Decision, TTL identifies
379
. In relation to its mitigation measures, TTL determines that
380
. However, the IE SA in the Draft Decision indicates that there
is still a high risk in terms of likelihood and severity381.

200. The EDPB takes note that TTL disagrees with that categorisation of the risk, as TTL considers
that the risks outlined by the IE SA are potential and hypothetical risks at best and some of them
are outside the scope of data protection law382. However, first, the EDPB notes that the IE SA’s
assessment of the level of the risk is not disputed by any of the CSAs and, secondly, the EDPB agrees
with the IE SA’s assessment in this respect and is not swayed by the arguments of TTL.

201. At the outset, the EDPB observes that in the Draft Decision the IE SA notes that TTL Children’s
Data and Age Appropriate Design DPIA identifies neither the risk of children under the age of 13
accessing the TikTok platform, nor the further risks to them that may arise from this383. The EDPB
considers that TTL’s failure to specifically assess the risks for children under the age of 13 were
they to get access to the TikTok platform has clear implications for TTL’s ability to implement
appropriate technical and organisational measures in accordance with Article 25(1) GDPR. As
recalled above384, the risk assessment is necessary in order to verify the required effectiveness and
the appropriateness of the measures and safeguards envisaged.

202. The EDPB recalls that children are recognised as vulnerable persons under GDPR385 and this
case concerns processing of the personal data of particularly young children, i.e. under the age of
13. Further, the EDPB observes that TTL itself determines that even for users above 13 covered by
TTL Children’s Data and Age Appropriate Design DPIA,

388
.

203. The EDPB agrees with the IE SA’s remark that, with respect to Child Users, including children
under the age of 13 who were to gain access to the TikTok platform, due to the relevant public
features of the TikTok platform, the risks for Child Users include: loss of autonomy and control over
their data, and possibly becoming targets for bad actors, given the public nature of their use of the
TikTok platform; them becoming subject to a wide range of potentially deleterious activities,

379
Draft Decision, paragraph 91.
380
Draft Decision, paragraph 91.
381
Draft Decision, paragraph 102
382
TTL PDD Submissions, paragraphs 4.18-4.25.
383
Draft Decision, paragraph 96.
384
See paragraph 195 of this Binding Decision above.
385
Recitals 38 and 75 GDPR. See also WP29 Guidelines on DPIA, p. 9 stating that the processing of personal data
of vulnerable data subjects, which may include children, is to be considered when assessing the existence of
inherit high risk.
386
Draft Decision, paragraph 91. Also, Part B of the TTL Children’s Data and Age Appropriate Design DPIA.
387
The Residual Risk is defined by TTL as being ‘an assessment of the risk level after the relevant mitigations
have been put in place’. TTL Children’s Data and Age Appropriate Design DPIA, p. 31.
388
TTL Children’s Data and Age Appropriate Design DPIA, p. 32, 34, 36.

Adopted 45

---

including online exploitation or grooming, or further physical, material or non-material damage
where they inherently or advertently reveal identifying personal data; risk of social anxiety, self-
esteem issues, bullying or peer pressure389.

204. The EDPB also agrees with the IE SA’s assessment that, while the risks identified in the TTL
Children’s Data and Age Appropriate Design DPIA apply equally to children under the age of 13 as
those over the age of 13, the risks associated with these users are exacerbated and particularly
severe given their young age and that the TikTok platform is expressly not intended for those under
the age of 13390. Indeed, TTL explained that it offers the TikTok platform to users, who are 13 years
old or older391. The TikTok platform has a content rating on the Apple App store of ‘12+’ and on the
Google Play store of ‘Parental Guidance Recommended’392.

205. Furthermore, the EDPB concurs with the IE SA regarding the risks identified in the Draft
Decision specifically for children under the age of 13 who were to gain access to the TikTok
platform393, in particular the risk of viewing and accessing materials that are harmful or
inappropriate for a child of such youth, particularly given that the TikTok platform is not intended
for children under 13394.

206. The EDPB also recalls that in the Draft Decision the IE SA found that the public-by-default
account setting exposes social media posts by Child Users to an indeterminate audience and that
this presents a severe risk for Child Users395. This is even more pertinent in relation to a significant
number of children under the age of 13 who had access to the TikTok Platform for an undetermined
period396.

207. Considering the above and taking into account the nature, scope, context, and purposes of
processing, the EDPB shares the conclusion of the IE SA in its Draft Decision that the processing at
stake poses high risks and that those risks associated with the processing analysed in the Draft
Decision were high both in terms of likelihood and severity397.

208. The above assessment is applicable both for the ex ante and the ex post measures.

’State of the art’ and ‘cost of implementation’

209. Under Article 25(1) GDPR, the reference to ‘state of the art’ imposes an obligation on
controllers, when determining the appropriate technical and organisational measures, to take
account of the current progress in technology that is available in the market398. In this respect, the

389
Draft Decision, paragraph 93-94.
390
Draft Decision, paragraph 96.
391
Draft Decision, paragraph 12.
392
Draft Decision, paragraph 12.
393
As evident from paragraphs 183-184 above, a high number of children under 13 years old indeed had access
to the TikTok platform during the Relevant Period.
394
Draft Decision, paragraph 94.
395
Draft Decision, paragraph 95.
396
See paragraphs 183-184 of this Binding Decision.
397
Draft Decision, paragraph 104.
398
EDPB Guidelines on Data Protection by Design and by Default, V1.0, paragraph 19 and EDPB Guidelines on
Data Protection by Design and by Default, V2.0, paragraph 19.

Adopted 46

---

EDPB underlines that the principle of accountability is an overarching one and requires the
controller to take up its responsibility in choosing the measures to be applied399.

210. In line with TTL’s accountability obligations, TTL had an obligation to consider and assess the
measures available in the market when choosing the age verification measures that it considered
to be appropriate technical and organisational measures400 in accordance with Article 25(1) GDPR.
When it comes to the evaluation of the state of the art, therefore, TTL has to be able to
demonstrate in the particular case that it has assessed and takes into account the state of art
measures regarding age verification in order to secure effective implementation of the data
protection principles and rights of data subjects.

211. First, the EDPB wishes to reply to TTL’s submission that during the Relevant Period there was
no regulatory guidance in place specifying what constitutes appropriate and effective age
verification mechanisms401. In this regard, the EDPB refers to paragraphs 91-92 of this Binding
Decision and recalls that the obligations of controllers stem directly from the GDPR. The application
of controllers’ obligations under Article 25(1) GDPR to take into consideration the state of the art
is not conditional upon existence of any further regulatory guidance regarding the measures to be
implemented in a particular case402. In addition, the fact that the supervisory authorities or the
EDPB are working on the future guidelines in a relevant field does not affect the need for the
controller to comply from the outset with its obligations stemming from the GDPR.

212. In any case, the EDPB highlights that there was relevant guidance by the EDPB on age
verification in its Guidelines 05/2020 on Consent403.

213. The IT SA describes in its objection the concept of requiring a trusted third party to verify the
identity and age of the user and makes reference to the BSI PAS 1296:2018 standard404. The EDPB
highlights that the concept of requiring a trusted third party to verify the identity and age of the
user is long established in some Member States 405 and that the BSI PAS 1296:2018406 existed during
the Relevant Period. This standard of the British Standards Institution has provided a framework
for age check systems and is relevant to assess the available measures for age verification during
the Relevant Period.

399
EDPB Guidelines on Data Protection by Design and by Default, V2.0, paragraph 64.
400
Art. 5(2) and Art. 24 GDPR, Recital 74 GDPR.
401
TLL Art. 65 Submissions, paragraphs 6.20-6.25.
402
As the obligation stems directly from the GDPR. See also EDPB Guidelines on Data Protection by Design and
by Default, V2.0, paragraph 10.
403
EDPB Guidelines 05/2020 on Consent under Regulation 2016/679, Version 1.1. published on 11 May 2020
(hereinafter, the ‘EDPB Guidelines on Consent’), see section 7.1.3. Further, the EDPB Guidelines on Data
Protection by Design and by Default, V1.0 were adopted on 13 November 2019, i.e. prior to the Relevant Period,
and EDPB Guidelines on Data Protection by Design and by Default, V2.0 were adopted on 20 October 2020.
404
IT SA Objection, p. 6.
405
For example, the German Postident service has been available at least since 2010:
https://web.archive.org/web/20100314082647/http://www.deutschepost.de/dpag?tab=1&skin=hi&check=ye
s&lang=de_DE&xmlFile=link1015473_1014871.
406
The British Standards Institution, PAS 1296:2018: Online age checking. Provision and use of online age check
services. Code of Practice, published on 31 March 2018: https://knowledge.bsigroup.com/products/online-age-
checking-provision-and-use-of-online-age-check-services-code-of-practice/standard.

Adopted 47

---

214. Furthermore, the EDPB underlines that the issue of age verification is not a new issue nor an
issue limited to the context of the protection of personal data407. The practices with regard to age
verification in other fields have to be taken into account when assessing the question of what
constitutes the ‘state of the art’ in the context of Article 25(1) GDPR408. By way of clarification, the
elements identified by the EDPB are not meant to be exhaustive.

215. The EDPB also points out that the state of the art is not statically defined at a fixed point in
time, but should be assessed continuously in the context of technological progress. If a controller
fails to keep up to date with technological changes, this could result in a lack of compliance with
Article 25 (1) GDPR409.

216. In reply to TTL’s assertion that the age verification measures implemented by TTL during the
Relevant Period compare, according to the expert report submitted by TTL, favourably to those of
its competitors410, the EDPB points out that a particular controller’s compliance with
Article 25 GDPR is assessed on a case-by-case basis, taking into account the nature, context, scope
and purpose of the processing at stake, as well as the risk to fundamental rights and freedoms of
individuals in each specific case. Moreover, the potential infringement of the law by another party
does not legitimise one’s own infringement of the law. The EDPB is therefore not swayed by this
argument.

217. Taking into account the elements available to the EDPB in the context of this procedure the
EDPB considers that, in this particular case, it does not have sufficient information to conclusively
assess, pursuant to Article 25(1) GDPR, the state of art element in relation to measures
implemented by TTL for the age verification of children as young as 13 years old during the Relevant
Period.

218. Finally, regarding the ‘cost’ element in Article 25(1) GDPR, the EDPB recalls that the controller
is not required to spend a disproportionate amount of resources when alternative, less resource-
demanding, yet effective measures exist. However, the chosen measures need to ensure that the
processing activity foreseen by the data controller does not process personal data in violation of
the data protection principles, regardless of cost411.

219. The EDPB observes that in the present case TTL has not made any submissions demonstrating
disproportionate cost for the implementation of the possible additional or alternative measures
with regard to age verification on the TikTok platform. In any case, the EDPB agrees with the IT SA
that a leading-edge technologically innovative company such as TTL that is addressing its social
media services to children should be in a position to consider all available measures to ensure its
compliance with Article 25 GDPR in an effective manner412.

407
See Directive 2010/13/EU of the European Parliament and of the Council of 10 March 2010 on the
coordination of certain provisions laid down by law, regulation or administrative action in Member States
concerning the provision of audiovisual media services (Audiovisual Media Services Directive) amended by
Directive (EU) 2018/1808, in particular Art. 28b thereof which obliges the video-sharing platforms to, along the
other things, establishing and operating age verification systems for users of video-sharing platforms with
respect to content which may impair the physical, mental or moral development of minors.
408
EDPB Guidelines on Data Protection by Design and by Default, V2.0, paragraph 22.
409
EDPB Guidelines on Data Protection by Design and by Default, V2.0, paragraph 20.
410
TTL Art. 65 Submissions, paragraph 6.28.
411
EDPB Guidelines on Data Protection by Design and by Default, V2.0, paragraphs 23-25.
412
IT SA Objection, p. 7.

Adopted 48

---

Whether the technical and organisational measures implemented by TTL with regard to age
verification were ‘effective’

220. The EDPB recalls that, as established in the Draft Decision413, TTL implemented the technical
and organisational measures for age verification during the registration process to prevent children
under the age of 13 from accessing the TikTok platform as described in paragraphs 124-125 of this
Binding Decision above.

221. The EDPB notes that under Article 25(1) GDPR the requirement for the measures to be
‘appropriate’ means that the measures and necessary safeguards implemented by a data controller
should be suited to achieve the intended purpose, i.e. they must implement the data protection
principles enumerated in Article 5(1) GDPR ‘in an effective manner’414.

222. In light of the above, the EDPB proceeds to evaluate the effectiveness or contribution to the
effectiveness of the technical and organisational measures implemented by TTL in the case at hand.

223. The EDPB recalls the principle of accountability and notes that TTL as the data controller in
the present case is responsible for and has to be able to demonstrate its compliance with the data
protection principles under Article 5(1) GDPR and other provisions of the GDPR415. The
accountability principle requires the controller to ‘demonstrate the effects of the measures taken
to protect the data subjects’ rights, and why the measures are considered to be appropriate and
effective’416, thus it puts focus on the element of demonstration. With regard to the protection of
children’s rights under the GDPR and determining whether children are actually affected, the
controller needs to be able to demonstrate effective measures for ensuring that the processing of
their personal data is in compliance with the data protection principles as discussed in detail
subsequently.

224. Therefore, TTL is responsible to demonstrate that it has assessed the feasible alternatives and
chosen appropriate measures for age verification taking into account all the elements listed in
Article 25(1) GDPR. In particular, TTL is liable to demonstrate the effectiveness of the measures
chosen in the particular case. This is particularly important when the demonstration of compliance
is linked to the protection of vulnerable data subjects such as children.

225. As mentioned above, the analysis of effectiveness under Article 25(1) GDPR refers to the
implementation of data protection principles, i.e. all the principles enshrined in Article 5 GDPR. The
IT SA’s objection mentions in particular the principle of data minimisation417. In this regard, the
EDPB recalls that Article 5(1)(c) GDPR requires TTL to ensure that it only processes personal data
that is adequate, relevant and limited to what is necessary in relation to the purpose for which they
are processed. Per TTL’s Terms of Service, users of the TikTok platform418 must be at least 13 years
of age419. Therefore, for the purpose of providing its service, i.e. the TikTok platform420, TTL could

413
Draft Decision, paragraphs 190-203.
414
EDPB Guidelines on Data Protection by Design and by Default, V2.0, paragraph 8.
415
Art. 5(2) GDPR and Recital 74 GDPR.
416
EDPB Guidelines on Data Protection by Design and by Default, V2.0, paragraph 87.
417
IT SA Objection, p. 7.
418
Regarding the purpose of the TikTok platform, see paragraphs 192-193 of this Binding Decision above.
419
Draft Decision, paragraph 12.
420
Draft Decision, paragraph 5, referring to TTL PDD Submissions, paragraphs 3.1-3.2. TTL PDD Submissions,
paragraph 3.2: ‘TikTok provided a global entertainment platform that, at its core, was designed to enable Users

Adopted 49

---

only process personal data of users of at least 13 years of age421. TTL should have implemented
technical and organisational measures to this end.

226. As noted above422, a particularly high number of users below the age of 13 was able to gain
access to the TikTok platform, therefore TTL processed a high volume of personal data of
vulnerable data subjects, i.e. children under the age of 13, during the Relevant Period, even though
it was not necessary for the purpose of providing its service. Considering such high volume of
personal data accidentally processed by TTL, the EDPB shares the concerns of the IT SA423 regarding
the lack of effective implementation by TTL of the principle of data minimisation in the present
case.

227. As outlined in paragraphs 182-208 of this Binding Decision above, in particular due to the
nature of the processing that concerns children under 13 and the context being the accessibility of
a social media platform for a high number of such children, who constitute particularly vulnerable
data subjects requiring specific protection and considering the high risk posed by the processing at
stake, the EDPB is of the view that a particularly high level of effectiveness424 is necessary to meet
the requirements of Article 25(1) GDPR. Taking this into account, the EDPB does not find that the
situation analysed in the present case is such where a reduced level of effectiveness would be
appropriate. The measures implemented by TTL need to be analysed bearing this in mind.

228. When considering the level of ‘effectiveness’ of the measures implemented by TTL, the EDPB
first notes the view of the IT SA that the age gate can be ‘easily dodged’425. The EDPB agrees that
the factor that an age verification system can be ‘easily circumvented’ constitutes a relevant factor
considering the effectiveness of the measures in place426.

229. Second, the EDPB takes account of TTL’s indication that ‘if an individual entered a birth date
which indicated that they were under 13, they were simply told they were ineligible for an account.
By not explaining the reason for either presenting the age-gate or for preventing a potential user
from creating an account, this ensured that individuals were not encouraged to provide an
inaccurate birthdate’427. While the EDPB takes note of the age gate was presented in a neutral
manner, it observes that such measure in itself does not ensure sufficient discouragement of
individuals to not enter an inaccurate date of birth. As described above428, the date of birth
constitutes the only information a user needs to provide before receiving the prompt of non-
eligibility. Therefore, it is not inconceivable that an individual younger than 13 could conclude that
the date of birth would constitute the sole factor for assessing their eligibility to access the TikTok
platform.

to create and share video content, enjoy videos from a variety of creators, and otherwise express their creativity,
such as by interacting with videos to express new perspectives and ideas’.
421
Insofar as such processing of personal data is compatible with GDPR.
422
See paragraphs 183-184 of this Binding Decision above.
423
IT SA Objection, p. 7.
424
The German Bundesgerichtshof held in I ZR 102/05 based on Döring/Günter, MMR 2004, 231, 234; that ‘[t]he
reliability of an age verification system presupposed that it eliminates simple, manifest and obvious possibilities
for circumvention’.
425
IT SA objection, p. 5 and 7.
426
See footnote 424 above.
427
TTL Art. 65 Submissions, paragraph 6.39.
428
Paragraph 124 of this Binding Decision above.

Adopted 50

---

230. Additionally, as with methods based on obscurity, once a way of circumvention is known, this
method can be easily shared with peers to facilitate them circumventing the measure in place.
Lastly, the EDPB takes note of the fact that the TikTok app was rated as 12+ in the Apple store429,
therefore an individual interested in getting access to the TikTok platform could easily infer that in
order to access the TikTok platform they needed to enter a date of birth indicating that their age
is higher than 12 years old.

231. The EDPB also takes into account the blocking mechanism employed by TTL in combination
with self-declaration. The mechanism in place in practice any device
. Without prejudice to the impact
of the in place on the considered effectiveness, the mechanism
. Therefore, it is not inconceivable that data subjects
under the age of 13 concluded that their lack of eligibility
and to conclude that an attempt from .

232. Additionally, , according to TTL Children’s Data and Age Appropriate
430
Design DPIA, constitutes , which in practice means a below 13 year old could
. Additionally,
. Once a user has signed up, for example,
, it would therefore not be relevant anymore. Therefore, the EDPB considers that
the blocking mechanism does not substantially enhance the effectiveness of the ex ante age
verification process.

233. The EDPB further points out that the Report submitted by TTL itself notes431 that the
EDPB Guidelines on Consent indicate that ‘[i]n some low-risk situations, it may be appropriate to
require a new subscriber to a service to disclose their year of birth or to fill out a form stating they
are (not) a minor’432. However, TTL’s own risk assessment clearly indicates
433
. The Report does not take note,
however, of the following paragraphs of the EDPB Guidelines on Consent stating that: ‘In low-risk
cases, verification of parental responsibility via email may be sufficient. Conversely, in high-risk
cases, it may be appropriate to ask for more proof, so that the controller is able to verify and retain
the information pursuant to Article 7(1) GDPR. Trusted third party verification services may offer
solutions, which minimise the amount of personal data the controller has to process itself’ 434.
Therefore, the EDPB Guidelines on Consent make it clear that more proof or proof of a higher
quality is appropriate in high-risks cases and refer to trusted third party verification services in this
respect (a solution indicated by the IT SA in its objection435).

234. Taking into account the above436, with respect to ‘effectiveness’ of the ex ante measures
implemented by TTL, the EDPB expresses serious doubts as to whether the self-verification by the
user (even in combination with the blocking mechanism) was a sufficiently effective solution for
such high risk processing. Additionally, the EDPB expresses serious doubts as to whether TTL has

429
Draft Decision, paragraph 190.
430
TTL Children’s Data and Age Appropriate Design DPIA, p. 19, 3.a.iii. The EDPB notes that the DPIA in question
is dated 8 October 2020, therefore this duration seems to be applicable at least as of that moment.
431
Report, section 5.1.1.
432
EDPB Guidelines on Consent, paragraph 135.
433
See paragraph 125 of this Binding Decision.
434
EDPB Guidelines on Consent, paragraph 137.
435
IT SA Objection, p. 6.
436
Paragraphs 194-208 of this Binding Decision.

Adopted 51

---

demonstrated, as required by the accountability principle, measurable effectiveness of the
implemented ex ante measures.

235. Concerning the ex post measures, the EDPB notes that the reporting system
. It is to be further noted that this is not a systematic
measure

.

236. The other ex post measure relies on the matching of
437
. This mechanism hinges on users under 13 years of age
438
. In cases where , such content moderation
tools will not be effective. TTL also did not provide information that allowed it to demonstrate that
the majority of matches indeed identified a user below 13 years of age or whether the system is
susceptible for false positives, i.e. to demonstrate the accuracy of the algorithm.

237. Further, in line with the accountability principle, the EDPB notes that within the available
materials and submissions TTL did not demonstrate that either of these checks and the
are done often and timely enough to minimise the time such accounts stay active
on the TikTok platform, as could have been done with statistics of the duration between the
creation of an account by a user under 13 years of age and the subsequent deletion of that
account439.

238. Considering the above analysis, the EDPB expresses doubts as to whether the ex post
measures implemented by TTL during the Relevant Period ensured a high level of effectiveness.

Whether the technical and organisational measures implemented by TTL were ‘appropriate’ pursuant
to Article 25(1) GDPR

239. As a final step for the analysis, the EDPB will consider whether the age verification measures
implemented by TTL during the Relevant Period were appropriate in accordance with
Article 25(1) GDPR440.

240. The EDPB further notes that, in order to be considered ‘appropriate’, the technical and
organisational measures for age verification chosen by controllers have to be compliant with the
data protection principles under Article 5 GDPR, for example the principle of data minimisation
under Article 5(1)(c) GDPR, and need to fulfil other requirements of the GDPR.

241. When assessing whether the ex ante and ex post measures employed by the controller were,
taking together and as a whole, appropriate for attaining the aim of preventing the children below

437
See paragraph 125 of this Binding Decision.
438
Draft Decision, paragraphs 196-198.
439
The EDPB notes as well that some time could be needed to perform the human review in line with
Art. 22 GDPR, where relevant, which could be not due to an issue under Art. 22 GDPR, but the result of the ex
post use of content moderation measures to remedy a shortcoming, i.e. the registration of a user with age below
13, of the ex ante measures.
440
In this regard the EDPB takes note of TTL’s view that the measures implemented need to lead to an
appropriate level of effectiveness and certainty of assessing the age, and not an absolute level of certainty (TTL
Art. 65 Submissions, paragraph 6.32). However, as evident from the assessment in the sub-section 5.4.2 of this
Binding Decision, the EDPB is assessing the measures implemented by TTL not against an absolute level of
certainty and effectiveness, but against an ‘appropriate’ level as envisaged in Article 25(1) GDPR.

Adopted 52

---

13 years of age to use TikTok platform, the EDPB takes into account the standard set by the CJEU.
While measures may not be sufficiently reliable to prevent all persons under the permitted age
from being accepted, the measures needs to significantly reduce the likelihood of such acceptance
that would exist if that method were not used441. The EDPB expresses serious doubts in relation to
whether TTL provided sufficient evidence as required by Article 5(2) GDPR for the measures in place
to demonstrate that it did ‘significantly reduce’ the likelihood of children under the age of 13 from
accessing and using the TikTok platform.

242. For the purposes of its assessment, the EDPB considers that the additional ex post measures
in place by TTL do not as such prevent the registration of children under 13 years of age but instead
mitigate shortcomings of the ex ante measures by removing accounts belonging to children under
13 years of age when they are identified as such. In this regard, theoretically an ex post measure
with a high enough level of accuracy and short enough delay in the removal of identified users
could exist442. However, the EDPB has serious doubts if in the case at hand the ex post measures in
place provide for such a level of effectiveness that would mitigate the shortcomings indicated
above of the ex ante measures443.

Conclusion

243. Taking into account the above, the EDPB expresses its serious doubts regarding the
effectiveness of the age verification measures put in place by TTL during the Relevant Period, and
more specifically regarding whether the combination of the ex ante and ex post measures
implemented by TTL were sufficient to bring the effectiveness to the level required in this specific
case, considering the severity of the risks and the high number of vulnerable data subjects affected.

244. However, taking into account the elements available to the EDPB in the context of this
procedure, the EDPB recalls that it lacks conclusive information regarding the state of the art
element in relation to age verification during the Relevant Period444. Therefore, the EDPB does not
have sufficient information, in particular in relation to the state of the art element, to conclusively
assess TTL’s compliance with Article 25(1) GDPR. Consequently, the EDPB is not in a position to
conclude that TTL infringed Article 25(1) GDPR.

245. In light of the serious doubts expressed regarding the effectiveness of the measures chosen
by TTL, the EDPB requires the IE SA to modify the conclusion set out in paragraph 221 of the Draft
Decision in the IE SA’s final decision in the present case, by stating that it cannot be concluded in
this case that the technical and organisational measures in respect of the age verification processes
themselves undertaken by TTL during the Relevant Period infringed the GDPR in light of the
measures undertaken and the extent to which TTL sought to ensure its platform remained
accessible only to those above the age of 13.

246. As a final remark, the EDPB recalls that the appropriateness of the technical and organisational
measures that need to be implemented to comply with Article 25(1) GDPR is, due to their link to
the state of the art and the possible changes of the relevant risks, regularly changing over time.
This is particularly relevant in the field of age verification. A controller therefore has to periodically

441
Judgement of the Court of Justice 17 October 2013 in case Michael Schwarz v Stadt Bochum, C‑291/12,
ECLI:EU:C:2013:670, paragraphs 42 and 43.
442
Without prejudice to future work of the EDPB or national SAs, such a method may in turn create risks for
other fundamental rights.
443
See paragraphs 225-234 of this Binding Decision above.
444
See paragraph 217 of this Binding Decision above.

Adopted 53

---

review whether the measures applied are still appropriate at the current moment, taking into
account all the factors under Article 25(1) GDPR, considering their specific case at hand, in
particular the level of risk. In addition, controllers need to ensure that any measure chosen is
compliant with EU and Member State law, in particular the GDPR.

6 ON THE CORRECTIVE MEASURES
Analysis by the LSA in the Draft Decision
247. In the Draft Decision the IE SA envisages the imposition of corrective powers in connection to
the infringements identified445, in particular: an order to bring processing operations into
compliance pursuant to Article 58(2)(d) GDPR, a reprimand pursuant to Article 58(2)(b) GDPR, and
administrative fines446.

248. More specifically, concerning the envisaged order, the IE SA imposes an order to TTL to bring
the relevant processing into compliance with Article 5(1)(c), Article 5(1)(f) and Article 25(1) and (2),
and Articles 12(1) and Article13(1)(e) GDPR insofar as is still necessary within three months of the
date of notification of any final decision447. The IE SA states that the relevant provisions do not
prescribe a particular form or manner of processing and it is incumbent on TTL to ensure
compliance448.

249. Concerning the envisaged reprimand, the IE SA specifies that it is ‘necessary and
proportionate in addition to the order’ as it ‘formally recognises the serious nature of the
infringements’ and ‘deter future similar non-compliance’449.

250. As to the administrative fines, the IE SA includes in the Draft Decision a range for the envisaged
administrative fines to be imposed, respectively, for the infringement of Articles 5(1)(c) and 25(1)
and (2) GDPR450, for the infringement of Articles 5(1)(f) and Articles 25(1) GDPR451, and for the
infringement of Articles 12(1) and 13(1)(e) GDPR452.

445
In particular, the Draft Decision envisages the imposition of corrective powers in respect of the identified
infringements of the following provisions:
 in respect of TTL’s data protection by design and default in respect of its processing of the personal
data of Child Users: Articles 5(1)(c), 5(1)(f), 24(1), 25(1) and 25(2) GDPR (Draft Decision, paragraph 276);
 in respect of TTL’s age verification measures: Article 24(1) GDPR (Draft Decision, paragraph 277);
 in respect of TTL’s Transparency obligations: Articles 12(1) and 13(1)(e) GDPR (Draft Decision,
paragraph 278)
446
Draft Decision, paragraph 413.
447
Draft Decision, paragraphs 284-286, 294-297 and 413.
448
Draft Decision, paragraph 296.
449
Draft Decision, paragraphs 300-301.
450
The IE SA proposes the imposition of a fine between 55 million and 100 million euros for this infringement.
(Draft Decision, paragraphs 281, 371, 413).
451
The IE SA proposes the imposition of a fine between 55 million and 100 million euros for this infringement.
(Draft Decision, paragraphs 281, 371, 413).
452
The IE SA proposes the imposition of a fine between 110 million and 180 million euros for this infringement.
(Draft Decision, paragraphs 281, 371, 413).

Adopted 54

---

251. The EDPB notes that the compliance order and the reprimand already envisaged in the Draft
Decision are not subject to objections of the CSAs and as such are not addressed in this Binding
Decision.

Summary of the objections raised by the CSAs
252. The DE SAs raise the need to extend the compliance order envisaged by the IE SA in the Draft
Decision to the additional infringement of the principle of fairness under Article 5(1)(a) GDPR453. In
the view of the DE SAs, the additional finding that TTL has breached Article 5(1)(a) GDPR by using
dark patterns to nudge Child Users during the Relevant Period454 has a direct impact on the
necessary administrative measures455.

253. The DE SAs further explain the manner to bring the TTL’s processing into compliance, such as
by underlying that TTL ‘has to eliminate all dark patterns and situations that nudge Child Users to
decisions that violate their privacy, especially those named [in the DE SAs’ objection]’456. According
to the DE SAs, this would protect a considerable number of data subjects from (further)
infringements of their rights457.

254. Finally, the DE SAs state that leaving the Draft Decision unchanged poses a significant risk for
the fundamental rights and freedoms of Child Users of the TikTok platform, as ‘the nudging by dark
patterns leads them to make decisions with negative impact for the protection of their personal
data (and therefore their fundamental rights and freedoms)’458. The DE SAs further raise that there
are significant risks, considering TTL ‘is used by millions of users in Europe, including millions of
children’459. The DE SAs recall that, as indicated in Recital 38 GDPR, ‘children merit specific
protection with regard to their personal data, as they may be less aware of the risks, consequences
and safeguards concerned and their rights in relation to the processing of their personal data’460
and ‘they are also more likely to be subject to dark patterns’461.

255. The DE SAs further raise an objection on the need to adjust the administrative fine, which
would need to be reassessed and set higher, due to the finding of an additional infringement of
the principle of fairness under Article 5(1)(a) GDPR462. According to the DE SAs, this is needed to
ensure that the fine remains effective, proportionate and dissuasive463.

***

256. The IT SA in its objection requests to adapt the administrative fine, in connection with the
alleged additional infringement of Article 25 GDPR464. The IT SA reasons that its objection relating
to this additional infringement should clearly impact the corrective measures envisaged465. The

453
DE SAs Objection, p. 8. See section 4 above.
454
For the summary of the DE SAs’ objection in that respect see section 4.2 above.
455
DE SAs Objection, p. 3
456
DE SAs Objection, p. 8
457
DE SAs Objection, p. 8.
458
DE SAs Objection, p. 7.
459
DE SAs Objection, p. 7
460
DE SAs Objection, p. 7.
461
DE SAs Objection, p. 7.
462
DE SAs Objection, p. 8.
463
DE SAs Objection, p. 3.
464
IT SA Objection, p. 8. See section 5 above.
465
IT SA Objection, p. 2.

Adopted 55

---

IT SA considers it necessary to impose an administrative fine, as referred to in Article 83(4)(a) GDPR
for this additional infringement and in accordance with the criteria set out in Article 83(3) GDPR466.
According to the IT SA, this fine would need to be on top of the fines already envisaged in the Draft
Decision467.

257. The IT SA argues that the assessment leading to the calculation of the fine needs to make it
truly effective and dissuasive468. According to the IT SA, if the Draft Decision were left unchanged
it would entail significant risks for the protection of the rights of the data subjects469. If the
measures currently envisaged were retained, a high number of data subjects below the age of 13,
would be exposed to risks of various nature470. In the view of the IT SA, this means that the rights
of the data subjects would not be effectively protected and would incentivise the controller and
other companies to continue committing such infringements471.

Position of the LSA on the objections
258. Regarding the DE SAs’ objection insofar as it concerns the compliance order, the IE SA
questions if ‘the proposed order to bring processing into compliance would satisfy the
requirements of Recital 129 GDPR, for binding measures to be ‘clear and unambiguous’472. The
IE SA argues that ‘the terms of the order proposed by the DE SAs are highly generalised in nature
and do not identify, with any degree of specificity, what action the controller is required to take’473.
Further, the IE SA questions the possibility ‘to enforce such an order against the controller in the
event of perceived default’474.

259. Regarding the DE SAs’ objection insofar as it concerns the administrative fine, the IE SA
highlights that ‘the DE SAs only indicate that “the” fine should be “reassessed and set higher”,
however, the DE SAs’ objection does not indicate which of the three existing fining ranges should
be reassessed’475. Further, it does not provide indications on how the criteria of Article 83(2) GDPR
should be considered476. Therefore, in the view of the IE SA, ‘it is impossible to envisage how the
IE SA could follow the objection, whether it be on its own volition or following a binding decision
by the EDPB’477.

260. Additionally, the IE SA argues that the DE SAs’ objection (in relation to both the additional
compliance order and the administrative fine) is not ‘relevant and reasoned’ because ‘the
corrective action element has not been adequately rationalised and does not address the risks to
the fundamental rights and freedoms of data subjects’478.

466
IT SA Objection, p. 8.
467
IT SA Objection, p. 8.
468
IT SA Objection, p. 8.
469
IT SA Objection, p. 8.
470
IT SA Objection, p. 8.
471
IT SA Objection, p. 8
472
Composite Response, p. 6.
473
Composite Response, p. 6-7.
474
Composite Response, p. 7.
475
Composite Response, p. 7.
476
Composite Response, p. 7.
477
Composite Response, p. 7.
478
IE SA’s assessment of the objections, p. 2.

Adopted 56

---

261. Concerning the IT SA’s objection on the administrative fine, the IE SA is of the view that the
IT SA failed to sufficiently engage with the criteria that should be considered for the imposition of
a fine479. Instead, the IT SA limits itself to the nature of the infringement and the level of damages
that was and may be suffered480. The IE SA considers further that, considering all the extensive
detail on a range of matters that might be considered relevant for the purpose of Article 83(2)
GDPR in the Draft Decision, ‘it is unclear why the IT SA did not provide sufficient reasoning to
support this aspect of its objection’481. Lastly, according to the IE SA, such a high level approach
makes it difficult to imagine how the IE SA could follow this aspect of the objection, whether it be
on its own volition or based on a binding decision of the EDPB482. Additionally, the IE SA argues that
the corrective action elements in the IT SA’s objection are not meeting the threshold set by Article
4(24) GDPR as they have ‘not been adequately rationalised and do not adequately address the risks
to the fundamental rights and freedoms of data subjects’483.

Analysis of the EDPB

6.4.1 Assessment of whether the objections were relevant and reasoned
262. The EDPB considers that the objections of the IT SA and the DE SAs relating to the
administrative fine do not sufficiently elaborate the legal or factual arguments that would justify
such a change in the Draft Decision. Additionally, concerning the DE SAs’ objection regarding the
administrative fine, the EDPB is of the view that it does not sufficiently clearly demonstrate the
significance of the risks that the Draft Decision poses to the fundamental rights and freedoms of
the data subjects or the free flow of data within the EEA. Consequently, the EDPB finds that the
objections of the IT SA and DE SAs concerning the administrative fine are not sufficiently reasoned
and thus do not meet the threshold stipulated by Article 4(24) GDPR.

***

263. With regard to the DE SAs’ objection concerning the need to adjust the compliance order, it
concerns ‘whether the envisaged action in relation to the controller complies with the GDPR’484.

264. The DE SAs’ objection regarding the compliance order and its underlying reasoning is closely
linked to the DE SAs’ objection requesting the IE SA to find the additional infringement of the
principle of fairness under Article 5(1)(a) GDPR485.

265. The EDPB considers that the DE SAs’ objection has a direct connection with the Draft Decision.
Indeed, for the demonstration that, in the context of the Registration Pop-Up and the Video Posting
Pop-Up, TTL implemented dark patterns resulting in non-compliance with Article 5(1)(a) GDPR, the
DE SAs’ objection relies upon the content and analysis included in the Draft Decision486. If followed,
the DE SAs’ objection would lead to a different conclusion487, since the proposed order to bring

479
Composite Response, p. 6.
480
Composite Response, p. 6.
481
Composite Response, p. 6.
482
Composite Response, p. 6.
483
IE SA’s assessment of the objections, p. 2.
484
Art. 4(24) GDPR.
485
See section 4 of this Binding Decision.
486
The DE SAs refer to e.g., paragraphs 72, 128, 160, 162, 173, 255 of the Draft Decision (DE SAs Objection,
p. 4-6).
487
EDPB Guidelines on RRO, paragraph 13.

Adopted 57

---

processing into compliance488 would be extended to encompass the infringement of Article 5(1)(a)
GDPR. Therefore, the EDPB finds that the objection is relevant.

266. The EDPB recalls the TTL’s general view that the DE SAs’ objection relating to the breach of
the principle of fairness does not meet the threshold set by Article 4(24) GDPR as it raises a new
issue, which is not within the scope of the Inquiry and should thus be rejected at the outset489. On
this matter, the EDPB refers to its analysis in paragraph 67 above, where the EDPB also takes into
account TTL’s views on this matter490.

267. The EDPB takes note that TTL refers to the view that the DE SAs’ objection, insofar it concerns
the compliance order, is formulated in vague terms and lacks specificity on what action the
controller is required to take, thus it does not satisfy the requirements of Recital 129 GDPR for
binding measures to be ‘clear and unambiguous’491. The EDPB will assess below if the DE SAs’
objection is adequately reasoned. In addition, the EDPB observes that TTL’s position also relates to
the content of the objection, which concerns its merits and not its admissibility.

268. In their objection, the DE SAs put forward their reasoning, in addition to their reasoning on
the existence of the additional infringement of fairness principle under Article 5(1)(a) GDPR492, as
to why the compliance order should be imposed in the case at hand. In particular, the DE SAs state
that the legal consequences of the finding that TTL has implemented dark patterns have to be
drawn and the compliance order envisaged in the Draft Decision should be amended, as ‘to
eliminate all dark patterns and situations that nudge Child Users to decisions that violate their
privacy’493. According to the DE SAs, it is needed to protect a considerable number of data subjects
from (further) infringements of their rights494. Moreover, the DE SAs explain in their objection, as
set out in paragraph 252 above, how the Draft Decision would need to be amended if the objection
is followed495, i.e. the proposed order to bring processing into compliance would be extended to
encompass the infringement of Article 5(1)(a) GDPR.

269. In consequence, the EDPB finds that the objection is sufficiently reasoned in respect of the
request for the additional corrective measure requested in the DE SAs’ objection in this particular
case, i.e. the order to bring processing into compliance under Article 58(2)(d) GDPR.

270. Lastly, the DE SAs’ objection indicates the significance of the risks posed by the Draft Decision
if it were not to be amended. More specifically, the DE SAs state that leaving the Draft Decision
unchanged poses a significant risk for the fundamental rights and freedoms of Child Users of the
TikTok platform, as ‘the nudging by dark patterns leads them to make decisions with negative
impact for the protection of their personal data (and therefore their fundamental rights and
freedoms)’496. The DE SAs also highlight that including this corrective measure would protect a
considerable number of data subjects from (further) infringements of their rights, that children
merit specific protection in light of Recital 38 GDPR and that they are more likely to be subject to

488
Draft Decision, paragraphs 284-286, 294-297 and 413.
489
TTL Art. 65 Submissions, paragraphs 5.3, 7.2.
490
Section 4.4.1 above, in particular paragraph 67 of this Binding Decision.
491
TTL Art. 65 Submissions, paragraph 7.15.
492
See this Binding Decision, section 4.2.
493
DE SAs Objection, p. 8.
494
DE SAs Objection, p. 8.
495
DE SAs Objection, p. 8.
496
DE SAs Objection, p. 7.

Adopted 58

---

dark patterns497. Lastly, the DE SAs argue that ‘there is a risk that other social media providers, in
case of the publication of the Draft Decision in its current version, could view this a, at least partial
carte blanche for using nudging and dark patterns’498. In this respect, the EDPB finds that the
DE SAs’ objection clearly demonstrate the significance of the risks for the rights and freedoms of
data subjects.

271. Considering the above, the EDPB finds that the DE SAs’ objection concerning the compliance
order in relation to the infringement by TTL of the principle of fairness under Article 5(1)(a) GDPR
is relevant and reasoned and therefore meets the threshold stipulated by Article 4(24) GDPR.

6.4.2 Assessment on the merits
272. The EDPB considers that the DE SAs’ objection found to be relevant and reasoned in this
subsection499 require an assessment of whether the Draft Decision needs to be changed in respect
of the corrective measures proposed. More specifically, the EDPB needs to assess the request to
expand the compliance order on TTL500 in order to include the infringement of the principle of
fairness under Article 5(1)(a) GDPR established above in Section 4.4.2501. When assessing the merits
of the objection raised, the EDPB also takes into account TTL’s position on the objection and its
submissions.

273. The EDPB notes that TTL submits that the DE SAs’ objection regarding the additional
infringement lacks merit502 and that, in relation to the DE SAs’ request for the compliance order,
TTL states that the objection is vague and lacks specificity on what action the controller is required
to take503. TTL further submits that ‘the EDPB cannot direct the [LSA] to adopt specific corrective
measures where the CSA has not particularised its direction’504.

274. The EDPB recalls that when a violation of the GDPR has been established, competent
supervisory authorities are required to react appropriately to remedy this infringement in
accordance with the means provided to them by Article 58(2) GDPR505. According to Recital 129
GDPR, every corrective measure applied by a supervisory authority under Article 58(2) GDPR
should be ‘appropriate, necessary and proportionate in view of ensuring compliance with the
Regulation’ in light of all the circumstances of each individual case. CSAs can propose in their
relevant and reasoned objections alternative or additional corrective measures to those envisaged
in the Draft Decision, when they consider that the envisaged measures do not meet these
requirements506.

497
DE SAs Objection, p. 7. See also paragraph 254 of this Binding Decision (section 6.2 of this Binding Decision).
498
DE SAs Objection, p. 7.
499
See paragraph 270 of this Binding Decision.
500
Draft Decision, paragraphs 284-286, 294-297 and 413.
501
See in particular paragraph 118 of this Binding Decision.
502
See paragraphs 93-97 of this Binding Decision (in section 4.4.2), as well TTL Art. 65 Submissions, paragraph
7.56.
503
TTL Art. 65 Submissions, paragraph 7.15 on p. 27.
504
TTL Art. 65 Submissions, paragraph 7.15 on p. 27.
505
Judgement of the Court of Justice of 16 July 2020 in case Data Protection Commissioner v Facebook Ireland
Limited and Maximillian Schrems, C-311/18, ECLI:EU:C:2020:559, (hereinafter, ‘C-311/18, Schrems II’),
paragraph 111.
506
Recital 129 GDPR. EDPB Guidelines on Article 65(1)(a) GDPR V1.0, paragraphs 92 and EDPB Guidelines on
Article 65 (1)(a) GDPR V2.0, paragraph 92.

Adopted 59

---

275. Considering the conclusion on the additional infringement of Article 5(1)(a) GDPR established
in Section 4.4.2 above, as well as the type507 and number of data subjects affected by this
infringement508, the EDPB shares the view of the DE SAs509 that the corrective measure chosen in
the circumstances of this case should aim to bring the TTL’s processing into compliance with the
GDPR thus minimising the potential harm to data subjects created by the violation of the GDPR510.

276. The EDPB considers that, in order to ensure compliance and bring the harm to the data
subjects to an end, in this particular case, it is appropriate, necessary and proportionate to amend
the order to TTL to bring processing into compliance envisaged in the Draft Decision to include the
TTL’s infringement of the principle of fairness under Article 5(1)(a) GDPR511. This measure would
require TTL, as proposed by the DE SAs in their objection512, to put in place the necessary technical
and operational measures to achieve compliance, i.e. to eliminate the deceptive design patterns
identified in paragraphs 109-113 and 114-116 of this Binding Decision, taking into account the
EDPB’s analysis in paragraphs 104-107 and 117-118 of this Binding Decision.

277. The EDPB takes notes that the DE SAs’ objection does not identify a specific timeframe for
such order, if it were to be imposed. The EDPB considers that the deadline for compliance with the
order should be reasonable and proportionate, in light of the potential harms to the data subject
rights and the resources available to the controller to achieve compliance.

278. The EDPB recalls that compliance with the GDPR can be achieved in different manners and it
is the controller’s responsibility to identify and implement the appropriate measures to bring its
processing operations into compliance with the GDPR513. In the case at hand TTL has to remedy the
infringement of the principle of fairness under Article 5(1)(a) GDPR by eliminating the deceptive
design patterns in the context of the Registration Pop-Up514 and the Video Posting Pop Up515 of the
TikTok platform. The EDPB however considers that in this particular case, TTL is in a position to
decide the most suitable manner to implement the compliance order, in accordance with its
accountability obligations516.

279. Finally, the EDPB recalls that non-compliance with an order issued by a supervisory authority
can be relevant both in terms of it being subject to administrative fines in line with Article 83(6)
GDPR, and in terms of it being an aggravating factor for the imposition of administrative fines 517.
In addition, the investigative powers of supervisory authorities allow them to order the provision

507
See paragraph 117 of this Binding Decision (reference to section 4.4.2)
508
DE SAs Objection, p. 7.
509
DE SAs Objection, p. 8.
510
C-311/18 Schrems II, paragraph 112: ‘Although the supervisory authority must determine which action is
appropriate and necessary and take into consideration all the circumstances [...] in that determination, the
supervisory authority is nevertheless required to execute its responsibility for ensuring that the GDPR is fully
enforced with all due diligence’.
511
As identified by the EDPB in Section 4 of this Binding Decision.
512
DE SAs Objection, p. 8.
513
Art. 24 GDPR.
514
Paragraphs 111-113 of this Binding Decision.
515
Paragraphs 114-116 of this Binding Decision.
516
Art. 5(2) GDPR.
517
See Art. 83(2)(i) GDPR.

Adopted 60

---

of all the information necessary for the performance of their tasks including the verification of
compliance with one of their orders518.

280. The EDPB therefore instructs the IE SA to expand the compliance order envisaged in its Draft
Decision519 and to include in its final decision an order to TTL to bring its processing in the context
of the Registration Pop-Up and the Video Posting Pop Up of the TikTok platform into compliance
with the principle of fairness in accordance with Article 5(1)(a) GDPR. Specifically, TTL has to be
ordered to eliminate the deceptive design patterns identified in paragraphs 109-113 and 114-116
of this Binding Decision, taking into account the EDPB’s analysis in paragraphs 104-107 and 117-
118 of this Binding Decision, within the specified timeframe to be determined by the IE SA.

7 BINDING DECISION
281. In light of the above, and in accordance with the task of the EDPB under Article 70(1)(t) GDPR
to issue binding decisions pursuant to Article 65 GDPR, the EDPB issues the following Binding
Decision in accordance with Article 65(1)(a) GDPR.

On the objection concerning the potential additional infringement of the principle of fairness

282. The EDPB decides that the objection of the DE SAs, regarding the additional infringement by
TTL of the principle of fairness under Article 5(1)(a) GDPR, meets the requirements of Article 4(24)
GDPR.

283. The EDPB instructs the IE SA to include in its final decision an additional infringement by TTL
of the principle of fairness under Article 5(1)(a) GDPR in line with the analysis above.

On the objection concerning the potential infringement of Article 25 GDPR

284. The EDPB decides that the objection of the IT SA, regarding the existence of the infringement
by TTL of Article 25 GDPR, meets the requirements of Article 4(24) GDPR.

285. The EDPB decides that, taking into account the elements available to the EDPB in the context
of this procedure, it does not have sufficient information to conclusively assess TTL’s compliance
with Article 25(1) GDPR in relation to the age verification measures implemented by TTL on the
TikTok platform during the Relevant Period.

286. In light of the serious doubts expressed regarding the effectiveness of the measures chosen
by TTL, the EDPB requires the IE SA to modify the conclusion set out in paragraph 221 of the Draft
Decision in the IE SA’s final decision in the present case, by stating that it cannot be concluded in
this case that the technical and organisational measures in respect of the age verification processes
themselves undertaken by TTL during the Relevant Period infringed the GDPR in light of the
measures undertaken and the extent to which TTL sought to ensure its platform remained
accessible only to those above the age of 13.

On the objection concerning the compliance order

287. The EDPB decides that the objection of the DE SAs on the order to bring processing into
compliance with the GDPR under Article 58(2)(d) GDPR, in relation to the additional infringement

518
Art. 58(1) GDPR.
519
Draft Decision, paragraphs 284-286, 294-297 and 413.

Adopted 61

---

of the principle of fairness under Article 5(1)(a) GDPR, meets the requirements of Article 4(24)
GDPR.

288. The EDPB instructs the IE SA to expand the compliance order envisaged in its Draft Decision
and to include in its final decision an order to TTL to bring its processing in the context of the
Registration Pop-Up and the Video Posting Pop Up of the TikTok platform into compliance with the
principle of fairness in accordance with Article 5(1)(a) GDPR.

On the objections concerning the administrative fine

289. The EDPB decides that the relevant parts of the objections of the DE SAs and IT SA specifically
relating to an administrative fine do not meet the threshold of Article 4(24) GDPR.

8 FINAL REMARKS
290. The EDPB addresses this Binding Decision to the LSA in this case (the IE SA) and to all the CSAs,
in accordance with Article 65(2) GDPR.

291. Regarding the objections deemed not to meet the requirements stipulated by Article 4(24)
GDPR, the EDPB does not take any position on the merit of any substantial issues raised therein.
The EDPB reiterates that its current decision is without any prejudice to any assessments the EDPB
may be called upon to make in other cases, including with the same parties, taking into account
the contents of the relevant draft decision and the objections raised by the CSAs.

292. According to Article 65(6) GDPR, the IE SA shall adopt its final decision on the basis of the
Binding Decision without undue delay and at the latest by one month after the EDPB has notified
its Binding Decision.

293. The IE SA shall inform the EDPB of the date when its final decision is notified to the
controller520. This Binding Decision will be made public pursuant to Article 65(5) GDPR without
delay after the IE SA has notified its final decision to the controller521.

294. The IE SA will communicate its final decision to the EDPB522. Pursuant to Article 70(1)(y) GDPR,
the IE SA’s final decision communicated to the EDPB will be included in the register of decisions
that have been subject to the consistency mechanism.

For the European Data Protection Board

The Chair

(Anu Talus)

520
Art. 65(6) GDPR.
521
Art. 65(5) and (6) GDPR.
522
Art. 60(7) GDPR.

Adopted 62