Introduction
In recent years, social media platforms have faced intense scrutiny and sanctions regarding the processing and cross-border transfer of personal data, particularly that of child users.
Decisions against TikTok in Turkey, the European Union, and other countries have once again highlighted the critical importance of protecting children’s data and complying with international standards in data transfers.
1. Background of the TikTok Decisions
Turkey:
The Turkish Personal Data Protection Authority (KVKK) imposed an administrative fine on TikTok for failing to act transparently in processing children’s data and for not fulfilling its obligation to inform users. It also noted that the platform’s cross-border data transfer processes were not compliant with Article 9 of the KVKK.
EU (Under GDPR):
The Irish Data Protection Commission (DPC) fined TikTok €345 million. The reasons included: accounts of users under 13 being automatically set to public, weak parental consent mechanisms, and insufficient transparency in data transfers.
USA:
The Federal Trade Commission (FTC) and several state attorneys general imposed sanctions on TikTok for violations of the Children’s Online Privacy Protection Act (COPPA).
2. Legal Framework for the Protection of Children’s Data
2.1 Turkey (KVKK)
- Although the KVKK does not set a specific age limit for children’s data, children are considered a “special category of sensitive group.”
- Explicit consent must be obtained from parents or legal guardians for individuals under 18.
- Privacy notices for child-targeted services must be prepared in clear and simple language suitable for the age group.
2.2 European Union (GDPR)
- Article 8 of the GDPR requires parental consent for the processing of personal data of children under 16.
- Member States may lower this age limit to 13.
- “Enhanced protective measures” are mandated for children’s data.
2.3 USA (COPPA)
- Verifiable parental consent is required to collect personal information from children under 13.
- Non-compliance may result in substantial fines and restrictions on the platform.
3. Cross-Border Data Transfers
3.1 Turkey – KVKK Article 9
- Personal data can be transferred abroad only to countries providing adequate protection or based on undertakings approved by the KVKK Board.
- Otherwise, explicit consent must be obtained.
- The TikTok decision shows that cross-border transfers without adequate safeguards are considered violations.
3.2 GDPR Articles 44–50
- Data may be transferred only to countries with an adequate level of protection.
- Legal mechanisms such as “Standard Contractual Clauses” (SCC) and “Binding Corporate Rules” (BCR) can be used.
4. Importance of the TikTok Decisions
- Protection of children’s data has become a priority area of oversight for data protection authorities.
- Data transfer processes must be meticulously designed not only in terms of technical security but also legal compliance.
- Transparent privacy notices and robust parental consent mechanisms are now essential for platforms.
5. Recommendations for Platforms and Businesses
- Prepare age-appropriate privacy notices for child users.
- Implement technical measures to prevent processing of data for individuals under 18 without parental consent.
- Use contracts and safeguards that comply with KVKK and GDPR standards for cross-border data transfers.
- Subject data processing activities to regular independent audits.
- Clearly explain the purposes for which children’s data is processed in an understandable and accessible way.
Conclusion
The TikTok decisions mark a new era for the protection of children’s data and cross-border data transfers both in Turkey and worldwide.
For data controllers, compliance with national and international standards in these areas is no longer optional but mandatory.
Platforms and businesses must ensure not only technical security measures but also complete legal compliance and transparency in their processes.
Yanıt yok