Free tools Windows power users keep installed
One-click scans. No signup required.
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
The UK Information Commissioner’s Office (ICO) fined TikTok’s UK and US entities £12.7 million after finding that the service unlawfully processed children’s personal data. The case concerned TikTok’s operation in 2020, when the ICO estimated that up to 1.4 million UK children under 13 used the platform. The regulator said TikTok did not do enough to identify and remove underage users, obtain parental consent where required, or explain its processing clearly. TikTok appealed, so the penalty remains part of ongoing litigation rather than a fully settled court dispute.
What the ICO fined TikTok for
The ICO’s enforcement summary and monetary penalty notice describe failures in how TikTok handled children’s information during the relevant period, primarily 2020.
- TikTok processed personal data belonging to children under 13 without an appropriate lawful basis.
- Where its processing relied on consent, it did not obtain parental consent required by the UK GDPR.
- Its privacy information was not sufficiently clear and transparent for users.
- It did not take adequate steps to identify underage users and remove their accounts.
The finding was not that every current under-13 user has been unlawfully processed, nor that TikTok verified the precise age of each child. The ICO estimated that up to 1.4 million UK children under 13 used TikTok in 2020. That estimate was produced using the methodology in Annex 2 of the penalty notice and could be over- or underestimated.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Why the threshold is 13
Article 8 of the UK GDPR sets special conditions for children’s consent when an online service relies on consent to process personal data. In that situation, a child under 13 cannot generally provide the consent alone; parental authorisation is required.
#1 Best Overall
This does not create a universal UK ban on online services for under-13s. A platform may set a higher minimum age in its terms, and the legal analysis depends on the service’s lawful basis, design and actual conduct. TikTok’s published age rule therefore could not, by itself, resolve whether the company was meeting its data-protection duties.
The legal provisions involved
The final decision identified infringements of four UK GDPR provisions:
- Article 5(1)(a): personal data must be processed lawfully, fairly and transparently.
- Article 8: conditions for children’s consent in relation to information-society services.
- Article 12: transparent information and communications.
- Article 13: information that must be supplied when personal data are collected from the individual.
That list matters because the case was broader than a narrow failure of age verification. The ICO’s criticism covered governance, transparency and the information supplied to children and families as well as the controls used to detect and remove underage accounts.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhy the fine fell from £27 million to £12.7 million
In September 2022, the ICO issued a notice of intent proposing a £27 million penalty. The final penalty, announced publicly on April 4, 2023 (with the ICO enforcement page listing the decision date as May 15, 2023), was £12.7 million.
The reduction was not explained as a general act of leniency or as a reward for cooperation. In the final decision, the ICO dropped a provisional finding about unlawful processing of special-category data. Removing that issue narrowed the case and reduced the appropriate penalty. The core findings about children’s personal data, parental consent, transparency and age-related controls remained.
What TikTok argued on appeal
TikTok contested the ICO’s findings and appealed the penalty. One preliminary argument was that the processing fell within the UK GDPR’s “special purposes” provisions, which cover activities such as artistic, academic, literary or journalistic processing.
Rank #3
In July 2025, the First-tier Tribunal rejected that argument at the preliminary stage. The tribunal considered the case to be principally about processing children’s personal information, not processing for those special purposes, and accepted that the ICO had authority to issue the monetary penalty notice. The ICO reported that the Upper Tribunal granted TikTok permission on November 11, 2025, to appeal that legal issue, with a hearing scheduled for May 11–12, 2026. The official material available for this article does not establish the result of that hearing, so it would be inaccurate to say that TikTok has definitively lost—or that the penalty has been cancelled.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesThe distinction is important: an ICO final administrative decision, a preliminary tribunal ruling and the ultimate outcome of the full appeal are separate stages.
Why the case matters for platforms and families
A written age rule is not enough
The case shows that a platform cannot satisfy children’s privacy obligations simply by publishing a minimum age. If children are likely to use the service, the company must take reasonable, proportionate steps to identify likely underage users, act on credible evidence and avoid continuing to process data unlawfully.
Age assurance has trade-offs
Self-declared birthdays are easy to circumvent, but stronger checks can require additional personal information and create security and proportionality risks. The ICO’s Children’s Code strategy favours a risk-based approach rather than one mandatory technical method. Services need controls that are effective for their risks while collecting as little extra identity data as possible.
Children receive heightened protection
The enforcement action is an early, high-profile example of the ICO applying expectations associated with the UK Age Appropriate Design Code, commonly called the Children’s Code. It also illustrates the difference between the ICO’s data-protection role and Ofcom’s separate online-safety responsibilities. A data-protection fine does not amount to a ban on TikTok, nor does it decide every question about harmful content.
How the 2025 investigation differs
In February 2025, the ICO opened a separate investigation into how TikTok processes the personal information of UK users aged 13 to 17 to recommend content. That work concerns recommender systems, profiling and potential exposure to harmful material—not simply whether under-13 users obtained parental consent.
Best Value
The investigation is not a finding that TikTok breached the law. It should not be merged with the 2023 penalty: the earlier case covered under-13 users and processing in 2020, while the newer inquiry examines teenagers and recommendation practices. The ICO’s announcement and subsequent progress update treat it as a distinct regulatory matter.
What businesses can learn
- Assess real users, not just stated rules. Test whether age gates and removal processes work in practice.
- Document the lawful basis. Explain why each category of children’s data is processed and when parental consent is required.
- Make notices understandable. Articles 12 and 13 require information that children and parents can actually understand.
- Use proportionate assurance. Avoid both ineffective self-declaration and unnecessary collection of identity documents.
- Keep monitoring. Recommender systems and profiling can create separate Children’s Code and UK GDPR risks even for users above 13.
For parents and educators, the practical message is that TikTok’s stated minimum age is not proof that an account is being handled lawfully. Reporting an underage account, reviewing privacy settings and limiting the information a child shares remain sensible safeguards, but the legal responsibility for compliant processing rests with the service.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
