MKB Juristen drafts custom legal documents
It is best not to cobble together or copy important contracts, terms and conditions, and other legal documents yourself. We help entrepreneurs on a budget with customized legal solutions, clear costs upfront, and practical explanations.
- Custom contracts, terms and conditions, and legal documents
- Budget-friendly and clear about the costs upfront
- Request a free consultation or a no-obligation quote
TikTok was fined over €750,000 by the Dutch Data Protection Authority because its privacy policy was only available in English and not understandable to (often young) Dutch users. The lesson: you must inform data subjects about your data processing concisely, understandably, and in simple language — and if you target children, an even stricter standard applies.
With TikTok, users create and share short videos. The app became wildly popular, but it is not without controversy. Partly for this reason, the Dutch Data Protection Authority (AP) launched an investigation, which resulted in a fine of over 750,000 euros.
Privacy policy in English only
The investigation revealed that TikTok failed to comply with the duty to inform and the principle of transparency. The GDPR requires processors to inform about how and why they process personal data in a concise, understandable, and simple manner. TikTok did have a privacy policy, but it was exclusively in English and not tailored to young Dutch-speaking children — even though the app is popular precisely among that group.
The reason the Dutch regulator was able to fine TikTok was that TikTok did not have a European headquarters at the time of the infringement; in that case, all EU member states can exercise supervision. TikTok now has an establishment in Ireland, as a result of which the AP transferred the file to the Irish regulator for the remaining possible infringements.
A fine of 750,000 euros
Failure to comply with the duty to provide information can result in a GDPR fine of up to 20 million euros or 4% of global annual turnover. However, the DPA applies its own fine policy rules, based on which a maximum of 750,000 euros could be imposed in this case — the most severe category. The DPA based this on the seriousness of the infringement, the large group of users under the age of sixteen, and the long duration of the infringement.
The lesson: provide understandable information, especially with children
Provide information about your data processing transparently and in simple language — so no legal, specialist, or technical jargon. If you target children, an even stricter standard applies: tone, style, and language use must be at the child's level. A privacy policy drafted solely in English is, in any case, insufficient for a Dutch-speaking target audience.
Frequently Asked Questions
In what language should my privacy policy be?
In the language of your target audience and in clear, simple terms. An exclusively English privacy policy is not sufficient if you are targeting Dutch-speaking (young) users.
Are stricter requirements for children?
Yes. If you are targeting children, the information must be tailored to their level in terms of tone, style, and language. The AP rigorously checks this.
How high can a fine for a flawed privacy policy be?
Under the GDPR, up to 20 million euros or 4% of global turnover. Within the DPA's fine policy rules, this concerned the heaviest category of 750,000 euros.
Have a privacy policy drafted
The privacy experts at MKB Juristen draft an understandable, GDPR-compliant privacy policy tailored to your target audience. View our expertise in privacy and data protection or schedule an intake meeting .
