Short-form video giant TikTok has received a “formal warning” from Italy’s data protection authority, which claims that the platform’s planned privacy changes are in breach of EU privacy laws.

TikTok informed users last month that people aged 18 and older in the EEA, UK and Switzerland would receive personalised ads based on their activity on the platform. The change is due to take place tomorrow (13 July).

Currently, people in the European Economic Area, the UK and Switzerland have to agree or opt-in to receive personalised advertising.

However, the Italian watchdog said the change includes an amended privacy policy, which states that the processing of personal data would not be based on consent, but on ‘legitimate interests’.

The Italian authority said this term was vaguely defined by TikTok and “immediately” began a fact-finding exercise on the changed privacy policy and the personal data it would request.

Following this investigation, the regulator has concluded that TikTok’s planned changes are incompatible with an EU privacy directive and local personal data protection law.

The Italian watchdog also raised concerns that unsuitable content could be shown to children as a result of the personalised ad changes.

As a result, the Italian data protection authority said it used the powers granted to it from GDPR regulation to issue a formal warning to TikTok. The regulator said it could take additional measures including “urgent measures” if the platform goes ahead with its planned changes.

The regulator said it is acting under the EU’s ePrivacy Directive, which allowed it to step in “directly and urgently”. It noted that otherwise, Ireland’s Data Protection Commission (DPC) would have had to lead the proceeding, as TikTok’s EU headquarters is based in the country.

The Italian watchdog said it informed the European Data Protection Board and the DPC on the decision, so they could consider further action.

The DPC acts as the EU’s lead data supervisor for several major US tech players that have their European headquarters in Ireland. However, the DPC has been criticised by groups such as the Irish Council for Civil Liberties for how it handles GDPR complaints against Big Tech.

At a Joint Oireachtas Committee meeting in February, Facebook whistleblower Frances Haugen called for a review of the DPC and claimed the Irish regulator is “widely considered” to have stepped back in its responsibilities in enforcing GDPR.

10 things you need to know direct to your inbox every weekday. Sign up for the Daily Brief, Silicon Republic’s digest of essential sci-tech news.

The post Italian regulator warns TikTok over potential EU privacy law breach appeared first on Silicon Republic.