These are serious, proportionate fines that meaningfully affect the bottom line. These companies are demonstrably making big changes in order to comply. They have been testing out the boundaries and seeing how close to the wind they can sail, but I think that's coming to an end now that they're seeing the impact of the new approach to enforcement.

The clearest sign for me was Meta's decision to delay the launch of Threads in the EU. Even for a company with the financial might of Meta, two billion euros in fines in the past two years has put the brakes on the "move fast and break stuff" mentality. Of course that creates the possibility of a two-tier internet where EU customers simply don't get access to products that are inherently intrusive, but I think that's a feature rather than a bug - either respect the privacy of our citizens, or take your seedy surveillance business elsewhere.

> Of course that creates the possibility of a two-tier internet where EU customers simply don't get access to products

this has already happened. google’s bard took it’s time to launch in europe.

the young kid in me that always thought we finally have a piece of tech that is beyond what politicians can control, that transcend borders and nationalities is saddened. but it is what it is, and without some breakthroughs (a system that cannot be controlled, censored etc by design) i don’t think there’s going back.

It's very naive to think that the Internet can transcend in any way law enforcement. You may have distributed protocols and crypto, but the state has a monopoly on violence, it controls all infrastructure, and therefore can control all inputs and outputs.

You can't change the world just with technology, as society is a "social construct". And if people want regulation, that's what they are going to get.

Speaking of EU's data protection regulations, it's funny because many people here claim that it doesn't work, and then are shocked to see that it does.

For what is worth, I think EU's data protections are a good thing. Big Tech acted irresponsibly for too long.

> It's very naive to think that the Internet can transcend in any way law enforcement.

agree, it is naive. but for a while it did feel liberating to a lot of people.

Oh, huh, I actually didn't realise Bard _had_ launched here.

> without some breakthroughs (a system that cannot be controlled, censored etc by design)

This isn't really a technical issue; some small criminal entity could run an AI bot on Tor (or even, realistically, on the open internet) which forwarded all your personal data directly to the North Korean government and the Mafia or whatever, and realistically they'd get away with that. But if there's a large company behind the service, then that company is going to have to _obey the law_, and no amount of technology will change that.

> But if there's a large company behind the service, then that company is going to have to _obey the law_, and no amount of technology will change that.

i agree on the first part. but that second part could probably also be reinvented by new tech, futuristically speaking.

"a system that cannot be controlled, censored"

sounds like the Safe Network! too bad it will never be finished in our lifetimes

Interesting, right? It's like they can make so much money from tracking people in other countries/jurisdictions that paying a fine to the EU once in a while is just part of the payroll.

Truly, I'm starting to think they think of it as opportunity cost then an actually fine.

You'd be correct. Anyone that actually has to deal with regulators quickly understands how easy it is to game the regulations if you're someone of Meta's stature.

€345M is a pretty huge amount of money

Especially when you consider that it was stopped 3 years ago.

Except it didn’t. My daughter in the US created an account and it didn’t require any family pairing or verification that the adult paired with her was her parent

These are EU laws that only pertain to the EU. US has different laws.

I guess TikTok has different software policies per country

Your honour, clearly you cannot convict my client since the crime was committed years ago.

/s

You don't work for TikTok by amy chance?

I definitely don't work for TikTok. I don't know the details. But the fine is way too much regardless.

you know how it's not too much? they can afford it.

What a deranged idea, you're implying it's okay to bankrupt a company just for a minor privacy violation.

i think it's deranged that you feel privacy violations are minor in any form. also, this isn't a first offense

Data privacy violations are certainly minor. Until we get that through, our companies are going to suffer. We have far, far, far greater problems in the world than privacy issues of usually meaningless data.

Data privacy is a paramount concern in free democracies. But of course you don't get that.

Oh, I think it is totally ok to bankrupt a company for not following the law.

For any violation at all? If one single McDonalds employee in Dublin breaks the health code, you think all of McDonalds should go bankrupt?

I assume you also support the death penalty for J walking?

If it is a single McD employee, fine said restaurant (which is already the case, but you onow that don't you?). If it is a general issue with a franchise chain (McD is running a franchise, so the company to go bankrupt is most likely a franchise in your example), fine them. And yes, that can lead to bankruptcy, as happened a couple of years ago with a Burger King franchise chain in Munich.

If McD is knowlingly selling carcinogenic burgers world wide and reguses to stop, sure, bankcrupt McD.

I don't know how this could possibly be down-voted, it's spot on.

A privacy violation is never minor.

Consider that GDPR has been in effect since 2016, with a grace period until 2018 before the EU started to hand out fines.

It's been 7 years that every company operating in the EU knows about these rules, 3 years ago it was already 4 years into effect. There's no excuse, they broke the law, pay the fine.

It's pretty normal for these things to take a while; most fines (and for that matter most prosecutions) would related to historic offences, not ongoing ones.

That's not the point of the justice system. Justice is not about retribution, justice within criminal contexts is about punishments within the realm of what is good. Punishing someone for past behavior that serves not future purpose is retribution. The justice system needs to be changed if it's about tick for tack.

For example, we don't need to give somebody a life-long sentence for a crime that they're obviously and apparently not going to repeat again. We have to take into consideration relative changes.

An obvious example here is the ongoing case with Danny Masterson, a crime that was committed 20 years. He's now a family man and a father. It makes no sense to give him 30 year in prison. That is just cruel. Our justice system has failed, not only him, but also his family - like his daughter, who will now grow up without a father. What good does that do???

We have to become forgiving and tolerant as a society, things are becoming desperate.

You do know that corporations are not people? Right?

Obviously. That doesn't mean its good to drive our companies into the dirt, just because they're not people. People depend on them. People work for these companies. Their significance is perhaps far greater than actually ruining just the lives of one person.

Our companies? TikTok is Chinese... That being said, I do not consider jobs or companies benefits a valid argument when it comes to anti trust and regulations.

But you sure know capitalism, and corporations, abuse the goodwill of hoverents, local and national, and communities. You just want to be ultra edgy for some reason.

> our companies

Oh ho ho ho. Now your comments ITT suddenly make sense.

That's monopoly money. Put the ones in charge behind the bars, that's something that might make them think twice before breaking the law again

Or people will think twice about opening companies in your jurisdiction. There's a reason pretty much all the new fortune 500 companies created in the last few decades are not from the EU.

Why exactly is it that the quality of a society is measured by how many big companies they have? Does Philip Morris contribute to society or detract from it? Can we dispense with the notion that big companies inherently improve society? Letting go of this does not imply you are a communist, regardless of how many seem to think so. You can believe that society achieves better outcomes by having tighter rules of play, rather than an anything goes mentality. Yes it makes it harder to create megacorps with billions upon billions of revenue. And so what?

I think if that's the case, the fines will have to be increased until we reach a point where they succeed at their task of disincentivizing this behavior.

GDPR already has a provision for this (it accounts for repeated violations and collaboration), and a ceiling of 4% of global revenue is quite high.

"quite" high? Are you serious. These fines are unbelievable.

Good, they might actually work then!

That's the point, and it's the maximum. 4% is there as the nuclear option for repeat offenders.

That's not what's happening at all. The GDPR laws are insane in the first place. Second, ridiculous high fines are happening on even the very first offense, even after they already changed it, like TikTok here!

What exactly is insane about giving the citizens control over their own data and about making it more difficult to monetize that data?

I don't think that the fine is ridiculous high, by the way. I think it's too low.

Unbelievably low. It's really pathetic at how not serious these fines are

And yet apparently not enough of a deterrent, because it keeps happening.

This was a one occurrences, and TikTok stopped it 3 years ago. The laws are getting tighter and tighter (and vaguer and vaguer), that's why "it keeps happening".

oppress /əˈprɛs/ verb

    keep (someone) in subjection and hardship, especially by the unjust exercise of authority.

I can't agree that TikTok or other recipients of such fingers could yet be considered to be in "subjection and hardship". Nor would I consider the fines so far issued to be particularly unjust.

Large corporations are definitely being subject to *unjust* exercise of authority. "Hardship" on a corporation doesn't really apply at the scale of very large corporations because the "hardship" is spread out among the many, many shareholders and stakeholders of the successful company; of course, it's not to be seen - it's a relatively successfully company being attacked, in comparison to non-successful companies not being attacked, so hardship isn't to be seen - but the unjustment is still completely there.

The relevant regulatory authorities at national and European level decided that the company had breached the law of the land and applied the appropriate fine based on that law. Would you agree with that?

It's fair to take issue with the GDPR itself, or how e.g. the people working at the Irish DPC are selected or something like that. While I have sympathy for criticisms of the system, these are free democratic entities which rule by consent (rather that tyranny) and they're applying law that was written by a great many people across many legitimate institutions. That looks like "justice" to me, unless you feel it contravenes some natural law. If you think it does this, please explain the relevant principle under which you find the fine unjust.

So, protecting private data online, as little as the EU does, is oppression... Oppression of whom?

The laws are extremely vague. They're suddenly decried and enforced immediately without giving enough time for these companies to react. Penalties are beyond exorbitant. Judges are bias (see my comment above). This is authoritarian, this is destructive. Socialists laws of the EU is destroying business and society with authoritarianism and punishments.

The article states:

"It found that the “family pairing” scheme, which gives an adult control over a child’s account settings, did not check whether the adult “paired” with the child user was a parent or guardian."

Chapter 8, Article 1 of the GDPR[1] states:

"Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child."

This doesn't seem vague at all.

[1] https://gdpr-info.eu/art-8-gdpr/

Ok, in this one case, it's not that vague. But GDPR in general is extremely vague. Digital Markets Act, extremely vague.

I hope you are PR at TikTok, and not legal.

I have no relations with TikTok. I am in furious at the EU politicians, and laws in general in the West. I am pro-Western but the laws are ruining us.

GDPR generally only seems vague if you're trying to figure out exactly what you can get away with. The spirit of GDPR seems pretty easily explained.

The law is from 2018. And described exactly what was forbidden for underage children privacy. The fact that Ticktock didn't comply until 2021 is their own fault.

Small correction: GDPR was passed in May 2016, but only came into effect in Apr 2018, precisely so that companies had two years to make the necessary changes.

In other words, GDPR is literally older than TikTok by 3-4 months (initial release: September 2016).

In this case, perhaps, but this is a serious problem in the EU, in general. The EU is destroying business.

Interesting turn of phrase “oppressed corporations”

A lot of fun stuff to think about with that

The oppressor is the lawmaker, who has infinite power over the corporations. "oppressed corporations" is a phenomenon that can and does exist in this context.

One angle that makes it interesting is that the very existence of the corporation is determined by the decision of the lawmakers. The sovereign state is the full authority on that matter, and by its right, through the legal process, can change any aspect of it.

Can a sculptor oppress his sculpture?

This feels like musing about the nature of property- Like how many people think property is some sort of natural phenomenon, when it's actually a legal concept defined by the state.

They know how to comply, but that would hurt their bottom line.

No. TikTak wrote: > “We respectfully disagree with the decision, particularly the level of the fine imposed. The DPC’s criticisms are focused on features and settings that were in place three years ago, and that we made changes to well before the investigation even began, such as setting all under-16 accounts to private by default.”

Companies are complying (for the most part). The judges of these decisions are extremely influenced by the politicians - the judges are biased and are making bias decisions - that is chiefly the problem here.

> we made changes to well before the investigation even began

Tiktok was not compliant before 2021. Being compliant in 2022 doesn't magically end an investigation or sentence.

Ok, perhaps in this case it was a fair decision. But GDPR, Digital Markets Act, etc are f*** insane and causing huge problems. There are many more laws too besides these.

Also, as someone else wrote: > That's quite a fine for a single-country ruling, it's like 2.6% of a year of revenue — or 10 days.

These fines are insane. Especially for a company who stopped it then a few years.

GDPR doesn't go far enough and I think courts need to hand out significantly more fines.

Yes, that fine is a lot. It's supposed to be high. That's the only way that fines work. If it doesn't hurt a company's bottom line, they don't learn.

That is exactly the authoritative mindset that is making these laws and judging them (i.e. judges). You don't say, oh, he's jay-walking again, the only way he'll learn, is if we cut off his legs!!

No, because, realistically, jaywalking is not a serious problem (it's not even an offence in some places). However, this sort of thing _is_ a serious problem.

You're trying to peddle a common logical fallacy, reductio ad absurdum. And you've been called out on it.

What would you propose?

TikTok is a massive corporation. They were either negligent or purposefully broke the law.

You don't have to do anything if they change, and they did. Written and formal notification to change their policy. Then if it still happens one small fine of IDK 100,000 EUR would be enough.

This is a false analogy. Corporations are not people, corporations have massive legal teams to go through every single piece of legislation that might affect them, if they break the law you should consider it's willingly given their resources.

They break the law once, get a small fine, they break it again and the fine increases, and keeps increasing until they follow the laws. What is the other option? You can't jail a corporation.

It is a perfect analogy. These fines are unreal - these are not small fines.

This company changed it and stopped it, and they still imposed a 2.5% revenue fine for a first offense!!

Yes, not being small fines is the whole point. If this was a 5 Million Euro fine, TikTok wouldn't care at all and factor it into their cost of doing business.

Large companies have repeatedly shown that they don't care about small fine. As were speaking Meta is paying to the tune of 100k a day in Norway. Meta knew this was an ongoing issue because the Irish DPC has ruled against them in December, yet they did nothing.

> Large companies have repeatedly shown that they don't care about small fine. As were speaking Meta is paying to the tune of 100k a day in Norway. Meta knew this was an ongoing issue because the Irish DPC has ruled against them in December, yet they did nothing.

One case doesn't mirror the entirety of all of them. Also, that Meta case I'm pretty sure was about something else completely that is questionable in its own right if it should be enforced!

> This company changed it and stopped it, and they still imposed a 2.5% revenue fine for a first offense!!

Knowingly an offense at the time they did it. The company was aware of GDPR, was aware of the consequences of breaking it and still decided to break the law, a large fine is a pretty good and fair punishment given the egregious behaviour.

Are you really defending that just because it was a first time offense a slap on the wrist would be ok to a massive corporation? It's a rules-based system, where the law matters, and the law is to apply a proportional fine to the infringement, no special treatment. I won't be sorry for TikTok, it's criminal behaviour.

TikTok knowingly allowed children to get their personal data harvested against the law, they deserve the punishment.

> These fines are insane. Especially for a company who stopped it then a few years.

GDPR has been around since 2016, 5 years is a long enough period to comply to regulations (as you're complaining about 2021), even more given the size of these companies. They didn't comply, they get fined, as an EU citizen I appreciate that they have teeth to subjugate even behemoth corporations.

> But GDPR, Digital Markets Act, etc are f** insane and causing huge problems.

Why do you think they are fucking insane and causing huge problems? As an individual I'm very, very glad these regulations exist and are being enforced, corporations won't change behaviour without massive penalties to these practices, so punish them until they behave decently, that's the only way.

Look, those apps can work without collecting any PII whatsoever. But if they make collecting PII part of their main revenue, then they should take the laws in their respective markets (countries) serious.

Since TikTok implemented the required changes and also (apparently) did not complain about the policies themselves (e.g. being to complicated/ambiguous to implement) it really looks like it is solely on them. They violated the law so they are to be punished accordingly.

It's like doing tax fraud in a year and then complaining that you were compliant in the following years. Penalties for this can be way beyond 2.6% of someones personal revenue. What would you say if someone complains here? Would you agree with them?

It's a social media platform, of course they need PII.

We need to relax all laws. Our laws are unbelievable cruel. Business are expected to follow so so so many bureaucratic laws. To fine them 2.6% every time they break one is insane. Imagine how many countries there are out there, how many business laws there are, how much they have to comply with.

A lot of these companies already operate on extremely thin margins. This can destroy companies. It doesn't make sense.

> It's a social media platform, of course they need PII.

No they don't. Remember MySpace? Worked perfectly without PII.

Of course MySpace had PII. People wrote all about themselves.

Did MySpace not work without providing it PII during e.g. account creation? I remember it did work without it, but I might remember wrong.

A business doesn't have an inherent right to exist. If the only way it can exist is to break the law, then maybe it deserves to be destroyed?

Why should we put up with an abusive business model so some randos can make money?

The law in case was in place three years ago as well, when it was broken.

Just because it took a bit to prosecute doesn't make it magically legal.

“I stopped stabbing him once I knew laws against murder were in place, and haven’t stabbed him since!”

That’s what your argument sounds like to me.

TikTok is not stabbing anyone just for being a social media platform for kids older than 12. These "kids" are teenagers and young adults. That's nothing even close to stabbing someone. If social media is so bad, that these "kids" shouldn't be using it, then either social media should be banned, or "kids" shouldn't have a smartphone!

I always picture companies see regulatory bodies as a slalom course with regulations representing the slalom poles.

The course changes occasionally, but companies adapt quickly and learn to handle the course changes efficiently on the next run, skimming by the poles on the way to the finish line.

Every once in a while a new pole smacks them in the face, but by the next fiscal year, they’ve learned to navigate past it as if it weren’t there.

Lawyer are usually damn fine slalom racers, but occasionally you do need to donate money to the course to encourage the owner to move the poles.