TikTok withdraws two appeals in children’s privacy action and accepts £12.7m fine

What happened

The UK Information Commissioner’s Office confirmed TikTok has withdrawn appeals against a £12.7 million penalty issued in 2023 for multiple breaches of data protection law, including unlawful processing of children’s personal data. The fine relates to TikTok’s failure to verify age, obtain parental consent, and provide clear information to users under 13. The ICO also lifted the appeal against an information notice, allowing its investigation into TikTok’s recommender systems for 13‑17‑year‑olds to continue. The action follows an Upper Tribunal ruling that TikTok’s processing was not for artistic purposes. The regulator estimates its broader work has protected around five million child users.

Why it matters

Other platforms must ensure robust age‑verification, obtain verifiable parental consent for under‑13 users, and provide transparent information about data collection to avoid similar penalties.

Business impact

Failure to implement age checks and consent mechanisms can lead to substantial fines and ongoing regulator investigations, affecting product design and data‑governance processes.

Checklist

• Implement age verificationHigh priority

  Deploy technical controls to reliably identify and block users under the legal age limit.

• Obtain parental consentHigh priority

  Secure verifiable consent from parents before processing personal data of children under 13.

• Update privacy noticesMedium priority

  Provide clear, age‑appropriate information on data collection, use, and sharing for all users.

• Prepare for regulator information requestsMedium priority

  Maintain documentation on processing activities for minors to respond promptly to future notices.

Who reported it

Discussion