Exclusive: TikTok glitch allows Shop to appear to users under 18, despite adults-only policy

person touching a smartphone laying on a table.

Image Credits: Getty Images

A TikTok loophole seems to be allowing some teens access to the TikTok Shop tab, despite the e-commerce offering being restricted to users who are 18 and older, per TikTok’s policy. The issue occurs when a teen originally lies about their age when signing up for TikTok, by entering in a date of birth that indicates they are already 18 or older, but then is later required by a parent to pair the account with their parent’s using TikTok’s built-in parental controls. Despite the pairing process, the teen will still have access to the adults-only Shop feature.

TikTok’s parental controls, known as Family Pairing, allow an adult to manage a teen account’s screen time, content choices and account privacy, after connecting the two accounts in the app. To use Family Pairing, the teen accesses the feature from the app’s settings and chooses the option “Teen” when asked “Who is using this TikTok account?” on the setup screen. The final step is to scan the parent’s QR code after the parent goes through the same steps on their end, responding to the question that they are the “parent” and then displaying their QR code to be scanned.

Setting up parental controls, which effectively turns over key aspects of account management to a parent or guardian, should be a signal to TikTok that the younger user must have earlier lied about their over-18 status, but it does not. Instead, the “Shop” tab that appears alongside TikTok’s For You and Following feeds on the app’s homepage continues to be accessible to the minor, despite their account now being under parental control.

TikTok screenshot
Image Credits: TikTok screenshot

Because the Shop is an 18+ experience, parents should know that their teen may come across adult items in the app at times, including sex toys (including those dubbed “massagers” as well as those disguised as makeup brushes), lingerie, hemp products, and other supplements, weight gainers, vape pens and more. TikTok was also having trouble keeping various banned goods out of the marketplace, according to an earlier Business Insider report.

There is no longer a place to verify the date of birth associated with a TikTok account in the app, so TechCrunch tested the policy loophole around TikTok Shop by creating a new TikTok account for a user over the age of 18, then pairing it with an adult’s account through Family Pairing. This mirrors what could easily be a real-world situation where a teen who lied about their age to create a TikTok account is later required by their parent to let them enable parental controls.

As required by the setup steps, we indicated the test account belonged to a “teen.” The adult’s account was able to pair with the teen’s and adjust various settings. However, the TikTok Shop tab remained on the teen’s screen in various configurations, except when Restricted Mode was turned on. But there, too, we ran into problems.

Image Credits: TikTok screenshot

Using the parent’s TikTok account, we tried adjusting settings using the Family Pairing feature. To speed up the process of the changes going through, we rebooted the teen’s phone to simulate the TikTok app being “restarted” after each setting was applied.

When turning off the dedicated STEM feed for the teen, we found the Shop tab remained accessible to the account, even after the changes were applied. This is because the user had originally indicated they were over 18, even though they’ve opted into parental controls, which should now indicate otherwise.

Unfortunately, we were not able to get the teen’s account to switch over to Restricted Mode without first completely uninstalling TikTok from the device and then logging back in with the teen’s account information. (Similarly, we weren’t able to remove Restricted Mode from the teen’s account without uninstalling the app.)

Image Credits: TikTok screenshot

The tests indicate there are loopholes in TikTok’s ability to apply its parental controls and policies effectively in a situation where the teen user originally lied about their age, as many likely do. This could give the parent a false sense of security, as they believe they are making decisions to make the app safer for their teen — like forcing their teen to use Family Pairing and enabling a Restricted Mode.

Even though the changes may eventually be applied in some cases, the Shop tab remains accessible unless Restricted Mode is enabled by the parent of the teen who lied about their age — and getting the latter to become switched on was a more convoluted process, according to our tests.

When reached for comment, TikTok was not initially aware of how this loophole would be possible, as the company stressed that Shop would be restricted to users 18 and up, as per its policy. Upon further research, TikTok found that the app takes into consideration what age a user said they were upon sign-up when deciding when to show TikTok Shop but not whether they have parental controls enabled. Instead, TikTok expects users to provide their correct age. The company points out that TikTok offers many tools to report possible underage accounts, like those suspected to be held by people under the age of 13. This could possibly help TikTok catch kids on the app but not necessarily teenaged minors who may look 18 (and up), those with private accounts or those who only follow and are followed by friends.

We’re surprised to find that enabling parental controls on a teen’s account (i.e. one with the fake age) does not remove their access to Shop, even though doing so clearly indicates the user is not an adult.

At the very least, TikTok should prompt the parent to confirm their child’s age during the Family Pairing setup process or alert them that their child had entered a birthdate that would make them older than 18, as that could affect other choices around what content they are shown on the app.

It’s not clear whether TikTok will attempt to close this loophole, as TikTok Shop may eventually become a powerhouse for the social app, even if it loses money in the near term. The feature appeals in particular to younger shoppers and has the ability to scale sellers’ access to millions of users. With TikTok Shop, influencers’ videos are connected directly to the products they hawk, creating more opportunities for impulse buying, while also offering a Gen Z-friendly alternative to Amazon, Temu and other e-commerce retailers.

Update, 6/16/24, 6:45 am et: TikTok will take into consideration the user’s age, but not whether they have parental controls enabled, when determining if it should show Shop. This part was updated after previously being misstated.

Exclusive: TikTok glitch allows Shop to appear to users under 18, despite adults-only policy

person touching a smartphone laying on a table.

Image Credits: Getty Images

A TikTok loophole seems to be allowing some teens access to the TikTok Shop tab, despite the e-commerce offering being restricted to users who are 18 and older, per TikTok’s policy. The issue occurs when a teen originally lies about their age when signing up for TikTok, by entering in a date of birth that indicates they are already 18 or older, but then is later required by a parent to pair the account with their parent’s using TikTok’s built-in parental controls. Despite the pairing process, the teen will still have access to the adults-only Shop feature.

TikTok’s parental controls, known as Family Pairing, allow an adult to manage a teen account’s screen time, content choices and account privacy, after connecting the two accounts in the app. To use Family Pairing, the teen accesses the feature from the app’s settings and chooses the option “Teen” when asked “Who is using this TikTok account?” on the setup screen. The final step is to scan the parent’s QR code after the parent goes through the same steps on their end, responding to the question that they are the “parent” and then displaying their QR code to be scanned.

Setting up parental controls, which effectively turns over key aspects of account management to a parent or guardian, should be a signal to TikTok that the younger user must have earlier lied about their over-18 status, but it does not. Instead, the “Shop” tab that appears alongside TikTok’s For You and Following feeds on the app’s homepage continues to be accessible to the minor, despite their account now being under parental control.

TikTok screenshot
Image Credits: TikTok screenshot

Because the Shop is an 18+ experience, parents should know that their teen may come across adult items in the app at times, including sex toys (including those dubbed “massagers” as well as those disguised as makeup brushes), lingerie, hemp products, and other supplements, weight gainers, vape pens and more. TikTok was also having trouble keeping various banned goods out of the marketplace, according to an earlier Business Insider report.

There is no longer a place to verify the date of birth associated with a TikTok account in the app, so TechCrunch tested the policy loophole around TikTok Shop by creating a new TikTok account for a user over the age of 18, then pairing it with an adult’s account through Family Pairing. This mirrors what could easily be a real-world situation where a teen who lied about their age to create a TikTok account is later required by their parent to let them enable parental controls.

As required by the setup steps, we indicated the test account belonged to a “teen.” The adult’s account was able to pair with the teen’s and adjust various settings. However, the TikTok Shop tab remained on the teen’s screen in various configurations, except when Restricted Mode was turned on. But there, too, we ran into problems.

Image Credits: TikTok screenshot

Using the parent’s TikTok account, we tried adjusting settings using the Family Pairing feature. To speed up the process of the changes going through, we rebooted the teen’s phone to simulate the TikTok app being “restarted” after each setting was applied.

When turning off the dedicated STEM feed for the teen, we found the Shop tab remained accessible to the account, even after the changes were applied. This is because the user had originally indicated they were over 18, even though they’ve opted into parental controls, which should now indicate otherwise.

Unfortunately, we were not able to get the teen’s account to switch over to Restricted Mode without first completely uninstalling TikTok from the device and then logging back in with the teen’s account information. (Similarly, we weren’t able to remove Restricted Mode from the teen’s account without uninstalling the app.)

Image Credits: TikTok screenshot

The tests indicate there are loopholes in TikTok’s ability to apply its parental controls and policies effectively in a situation where the teen user originally lied about their age, as many likely do. This could give the parent a false sense of security, as they believe they are making decisions to make the app safer for their teen — like forcing their teen to use Family Pairing and enabling a Restricted Mode.

Even though the changes may eventually be applied in some cases, the Shop tab remains accessible unless Restricted Mode is enabled by the parent of the teen who lied about their age — and getting the latter to become switched on was a more convoluted process, according to our tests.

When reached for comment, TikTok was not initially aware of how this loophole would be possible, as the company stressed that Shop would be restricted to users 18 and up, as per its policy. Upon further research, TikTok found that the app takes into consideration what age a user said they were upon sign-up when deciding when to show TikTok Shop but not whether they have parental controls enabled. Instead, TikTok expects users to provide their correct age. The company points out that TikTok offers many tools to report possible underage accounts, like those suspected to be held by people under the age of 13. This could possibly help TikTok catch kids on the app but not necessarily teenaged minors who may look 18 (and up), those with private accounts or those who only follow and are followed by friends.

We’re surprised to find that enabling parental controls on a teen’s account (i.e. one with the fake age) does not remove their access to Shop, even though doing so clearly indicates the user is not an adult.

At the very least, TikTok should prompt the parent to confirm their child’s age during the Family Pairing setup process or alert them that their child had entered a birthdate that would make them older than 18, as that could affect other choices around what content they are shown on the app.

It’s not clear whether TikTok will attempt to close this loophole, as TikTok Shop may eventually become a powerhouse for the social app, even if it loses money in the near term. The feature appeals in particular to younger shoppers and has the ability to scale sellers’ access to millions of users. With TikTok Shop, influencers’ videos are connected directly to the products they hawk, creating more opportunities for impulse buying, while also offering a Gen Z-friendly alternative to Amazon, Temu and other e-commerce retailers.

Update, 6/16/24, 6:45 am et: TikTok will take into consideration the user’s age, but not whether they have parental controls enabled, when determining if it should show Shop. This part was updated after previously being misstated.

an illustration of a series of location data markers falling out of a phone, lit up with a blue display, on a red darkened background

Stalkerware apps PhoneSpector and Highster appear shut down after NY settlement

an illustration of a series of location data markers falling out of a phone, lit up with a blue display, on a red darkened background

Image Credits: Bryce Durbin / TechCrunch

The makers of two phone surveillance services appear to have shuttered after the owner agreed to settle state accusations of illegally promoting spyware that his companies developed.

PhoneSpector and Highster were consumer-grade phone monitoring apps that facilitated the covert surveillance of a person’s smartphone. Commonly dubbed stalkerware (or spouseware), these apps are typically planted on a person’s phone, often by a spouse or domestic partner and usually with knowledge of the device passcode. These apps are designed to stay hidden from home screens, making them difficult to find and remove, all the while continuously uploading the phone’s messages, photos and real-time location data to a dashboard viewable by the abuser.

In February 2023, Patrick Hinchy, whose consortium of New York and Florida-based tech companies developed PhoneSpector and Highster, agreed to pay $410,000 in penalties to settle accusations that Hinchy’s companies advertised and “aggressively promoted” spyware that allowed the secret phone surveillance of individuals living in New York state.

New York Attorney General Letitia James said at the time that Hinchy’s companies used blog posts that explicitly encouraged prospective customers to use the spyware to monitor their spouses’ devices without their knowledge. As part of the deal, Hinchy’s companies agreed to modify the apps to alert device owners that their phones had been monitored.

Since the settlement, both PhoneSpector and Highster have dropped offline.

PhoneSpector’s website stopped loading in the weeks after the settlement. Its domain now redirects to an Indonesian lottery website. Highster’s website stopped loading several months later.

The domains, servers and back-end infrastructure known to be used by PhoneSpector and Highster are also no longer online.

TechCrunch called phone numbers associated with PhoneSpector and Highster customer service but an automated message said that the numbers had been disconnected. The office space in the New York village of Port Jefferson registered to Hinchy’s companies is currently occupied by a construction firm.

Nearly all of Hinchy’s registered companies in New York and Florida remain active, according to public records searches by TechCrunch, but the companies have not filed paperwork with the states for several years and are designated “past due” for updates. Companies are typically required to file paperwork every two years or face dissolution by state authorities.

Hinchy did not respond to multiple requests for comment from TechCrunch. Michael Weinstein, who represented Hinchy as part of the settlement, deferred comment to the New York attorney general’s office.

Delaney Kempner, director of communications for the New York attorney general’s office, did not answer TechCrunch’s questions about the settlement by email, including whether Hinchy’s companies paid the $410,000 penalty as agreed. Kempner would not agree to TechCrunch’s request for an on-the-record call. In response to specific questions about the case, Kempner told TechCrunch by email that unspecified recent filings would answer some of our questions. “Hopefully you know how to find them :)” said Kempner.

PhoneSpector and Highster are the latest stalkerware apps to have fallen offline in recent years following regulatory action.

In 2019, the Federal Trade Commission brought charges against phone monitoring app maker Retina-X, accusing the company of failing to ensure its app was used for legitimate consensual purposes, and failing to adequately secure the sensitive phone data it siphoned from the phones of unknowing device owners after experiencing several data breaches. Retina-X eventually shut down.

A year later, the FTC banned the stalkerware maker SpyFone and its chief executive Scott Zuckerman from the surveillance industry, also accusing the company of failing to protect the data it secretly harvested from the phones of unwitting victims. A TechCrunch investigation later found Zuckerman returned with a new stalkerware app called SpyTrac, which shut down soon after TechCrunch contacted Zuckerman for comment.

Fake passports, real bank accounts: How TheTruthSpy stalkerware made its millions