TikTok has been given a deadline of Friday to address a directive from Italy’s data protection authority, requiring the platform to restrict access for users whose ages haven't been confirmed, as reported by TechCrunch.

The Italian data protection agency (GPDP) issued the order promptly on Friday in response to the tragic death of a 10-year-old girl from Palermo, who succumbed to asphyxiation while participating in a dangerous “blackout challenge” circulating on the social media network, according to reports from local news sources.

The agency stated that the restriction would be in effect until February 15, indicating a plan to re-evaluate the situation and consider further measures at that time.

As of this moment, TikTok does not appear to have implemented any changes to comply with the GPDP’s directive.

A company representative informed us that they are currently reviewing the notification. “We have received and are in the process of reviewing the notification from Garante,” the representative stated. “Protecting user privacy and safety, especially that of our younger users, is of paramount importance to TikTok, and we are continually enhancing our policies, procedures, and technologies to ensure their safety.”

The GPDP had previously voiced concerns regarding the privacy of children on TikTok, noting in December that its age verification processes are easily bypassed and raising issues with default settings that make user content publicly accessible. On December 22, the agency also announced the commencement of a formal review process, providing TikTok with 30 days to respond.

The current order to block unverified users is in addition to this ongoing action. Failure by TikTok to adhere to the GPDP’s administrative order could result in enforcement measures from the Italian agency, utilizing the penalty powers outlined in the GDPR.

TikTok’s spokeswoman declined to provide further details regarding the order, which prohibits the platform from processing user data “for whom there is no absolute certainty of age,” as stated in the GPDP’s press release on Friday.

The company also did not respond to inquiries about whether it had submitted a response to the agency’s formal review.

Following the girl’s death, the company released a statement saying: “Our deepest condolences are with the girl’s family and friends. The safety of our community – particularly our younger users – is our top priority at TikTok, and we do not permit content that encourages, promotes, or celebrates dangerous activities that could lead to harm. We offer comprehensive safety controls and resources for teens and families on our platform, and we consistently refine our policies and safeguards as part of our ongoing commitment to our community.”

TikTok has stated that it has not found any evidence of a challenge involving asphyxiation on its platform.

However, in recent years, there have been several reported instances of underage users attempting or completing suicide after imitating content they encountered on the platform.

TikTok’s popularity is partly driven by users creating and participating in content challenges, such as a recent trend involving the performance of sea shanties.

Currently, a search for ‘#blackoutchallenge’ on the platform yields no user content but displays a warning indicating that the phrase “may be associated with behavior or content that violates our guidelines”.

Last year, numerous users participated in an event on the platform where they posted black squares using the hashtag #BlackOutTuesday, in connection with Black Lives Matter protests.

Therefore, the term “blackout” has been utilized on TikTok to encourage users to share content, although not in the context of asphyxiation in that particular instance.

Ireland’s Data Protection Commission, designated as TikTok’s lead data supervisor in Europe following the company’s announcement last year that its Irish entity would assume legal responsibility for processing European users’ data, does not currently have an open inquiry into the platform, according to a spokesperson.

However, TikTok is already facing several other investigations and legal challenges in Europe, including an investigation by France’s data protection authority, CNIL, into how the app manages user data – announced last summer.

In recent years, France’s CNIL has been responsible for issuing some of the largest penalties to tech companies for violations of EU data protection laws, including fines levied against Google and Amazon.

In December, it was also revealed that a 12-year-old girl in the U.K. is pursuing a legal challenge against TikTok, alleging that the platform unlawfully uses children’s data. The court has ruled that she can remain anonymous if the case proceeds.

Last month, Ireland’s data protection regulator released draft guidelines outlining “the Fundamentals for a Child-Oriented Approach to Data Processing,” with the stated goal of improving data processing standards related to minors.

While the GDPR generally requires data protection complaints to be directed through a lead agency, Italy’s GPDP’s order to TikTok to halt processing is permissible under the regulation’s provisions (Article 66) allowing for “urgency procedures” by national watchdogs in situations involving immediate risk. However, any such provisional measures are limited to three months and apply only within the jurisdiction of the DPA issuing them (Italy in this case).

Ireland’s DPC would be the EU agency responsible for leading any subsequent investigation.

“If TikTok does not comply with our order, the sanctions stipulated in the GDPR will be applicable,” a spokesperson for the Italian agency confirmed.

This report was updated with comment from the GDPD