Following the Notice of Intent to fine TikTok for failing to protect children’s privacy, issued in September 2022, in which the ICO said that TikTok could face a £27 million fine following an ICO investigation, the ICO has now imposed a fine of £12.7 million.

Taking into consideration the representations from TikTok following the Notice of Intent to fine, the ICO decided not to pursue the provisional finding related to the unlawful use of special category data. Therefore, this potential infringement was not included in the final amount of the fine.

The ICO found that TikTok had breached the UK GDPR between May 2018 and July 2020 by:

• providing its services to up to 1.4 million UK children under the age of 13 and processing their personal data without consent or authorisation from their parents or carers;
• failing to provide proper information to people using the platform about how their data is collected, used, and shared in a way that is easy to understand; without that information, users of the platform, in particular children, were unlikely to be able to make informed choices about whether and how to engage with it; and
• failing to ensure that the personal data belonging to its UK users was processed lawfully, fairly and in a transparent manner.

The ICO said that TikTok ought to have been aware that under 13s were using its platform.

The ICO also said that TikTok had failed to carry out adequate checks to identify and remove underage children from its platform.

The ICO investigation found that a concern was raised internally with some senior employees about children under 13 using the platform and not being removed. In the ICO’s view, TikTok did not respond adequately to this. To read the ICO’s press release in full, click here.