Court documents show TikTok employees warned of child safety flaws
Depositions reveal staff flagged exploitation risks and control loopholes, while the platform faces hundreds of lawsuits over safety records.
Key points
- Staff reported teens appearing in live streams for revenue despite bans.
- Age checks could be bypassed via third-party social accounts.
- Executives were notified of grooming concerns and algorithmic risks.
Court records indicate that TikTok staff repeatedly warned executives about serious child safety failures. According to depositions detailed by NPR, employees expressed frustration with the company's response to these flags. The company is currently facing hundreds of lawsuits regarding its safety record.
Root cause
Employees stated that executives were notified teens regularly appeared in live streams, raising grooming concerns. A safety employee told NPR the company knew about such content after Forbes reported on teens stripping for in-app gifts in 2022. Staff warned the platform generated significant revenue from this content, even though rules barred minors from appearing in live videos.
Attack path
Minors could bypass age verification by signing up with Facebook, Instagram, or Google accounts, according to employee statements. The app also contained a hidden link allowing teens to remove themselves from the family pairing feature. Former safety head Eric Han warned of algorithmic rabbit holes that repeatedly recommended harmful content, creating a real contagion effect.
Affected versions
The source material does not specify which software versions contained these flaws. The issues described relate to account linking mechanisms and content recommendation algorithms rather than a specific patchable code base. No version numbers are provided in the court documents or NPR report.
Mitigation
No technical fix or update has been confirmed yet. The company did not provide an on-the-record statement to NPR regarding remediation steps. While a feature to avoid repetitive content patterns was introduced in 2021, it was held back from millions of users in an apparent test.
What it means for organisations
Teams should review how third-party logins interact with internal age-gating policies. Security leads must verify that parental control features cannot be easily disabled by users. Legal and compliance departments should assess liability risks associated with algorithmic content recommendations. Management needs to ensure safety reports from engineering staff are documented and acted upon promptly.
Background: Parental controls
Implement network-level segmentation, enforce device-level account separation, and audit DNS configurations. Relying on application-based filters is insufficient because children often bypass them via secondary devices or browser extensions. Focus on infrastructure controls rather than behavioural monitoring.
Read the full guide: Parental Controls Best Practices: The Technical Reality
What to do and how to stay safe: TikTok
- Audit third-party authentication flows to ensure they enforce age restrictions.
- Review content moderation logs for revenue-generating features involving minors.
- Monitor algorithmic recommendation systems for harmful content loops.
- Document internal safety warnings and executive responses for compliance.
General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What specific safety flaws did employees report?
Staff flagged teens in live streams, revenue from minor content, and bypassable age checks.
Can users bypass TikTok's age verification?
Yes, employees noted a loophole allowing bypass via Facebook, Instagram, or Google accounts.
Has TikTok addressed these issues?
The company did not provide an on-the-record statement to NPR about fixes.
