CookieGate
Start free trial

TikTok drops its appeals: ICO’s £12.7m children’s data fine is final

5 min read By Comply Ark

Regulations: UK GDPR, DPDPA

In this post

TikTok has withdrawn its appeal against the UK Information Commissioner’s £12.7 million fine for misusing children’s data, so the 2023 penalty notice is now final. The ICO announced the withdrawal on 24 September 2026. TikTok also dropped a second appeal, against an information notice in a separate ICO investigation into how it uses the data of 13 to 17-year-olds in its recommender systems, which can now proceed. The fine was for processing the personal data of children under 13 without parental consent, and for failing to tell users clearly what happened to their data. For any online service that says children cannot sign up, the case is a reminder that a minimum age in the terms is not the same as keeping children out.

What the ICO fined TikTok for

The ICO issued its Monetary Penalty Notice on 4 April 2023 to TikTok Inc and TikTok Information Technologies UK Limited, following a Notice of Intent on 23 September 2022. It found breaches of Articles 5(1)(a), 8, 12 and 13 of the UK GDPR between 25 May 2018 and 28 July 2020.

The ICO estimated, based on economic analysis, that up to 1.75 million UK children under 13 used TikTok in 2020, although TikTok’s own rules did not allow children that age to create an account. In the regulator’s words, TikTok “failed to carry out adequate checks to identify and remove underage children from its platform” and “failed to obtain parental consent even though it ought to have been aware that under 13s were using its platform.” It also failed to give users clear information about how their data was collected, used and shared, so users, especially children, were unlikely to be able to make informed decisions.

Article 8 of the UK GDPR is the core of the case. Where a service relies on consent and offers information society services directly to a child, the processing is lawful for a child of 13 or over. Below 13, it is lawful “only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child”, and the controller must make “reasonable efforts to verify” that it was, “taking into consideration available technology.”

Why the appeal collapsed

TikTok’s appeal turned on a preliminary point. It argued its processing was “for the special purposes” (journalistic, academic, artistic or literary), which under section 156 of the Data Protection Act 2018 would have required the ICO to make a determination and obtain a court’s leave before issuing any penalty. The First-tier Tribunal rejected that on a preliminary issue on 27 June 2025.

The Upper Tribunal heard TikTok’s further appeal on 11 and 12 May 2026 and dismissed it in a decision issued on 28 July 2026, [2026] UKUT 277 (AAC). Its test is narrow: processing is “for the special purposes” only where the purpose of the processing is itself journalistic, academic, artistic or literary. It is not enough that the processing “facilitates, or is associated with, the dissemination of material” that has those characteristics. A platform that hosts creative content is not, for that reason alone, processing its users’ data for creative purposes. The tribunal also held that the Article 8 findings in the penalty notice concerned the data of underage children only, and remitted the remaining issues to the First-tier Tribunal. The ICO’s general counsel said on 5 August 2026 that the reasoning “is likely to be relevant to other online platforms in similar circumstances.” With the appeal now withdrawn, the penalty notice stands as issued.

Emily Keaney, ICO Deputy Commissioner, said the outcome “shows how important it is for companies to have the right protections in place, including to prevent access by children who are not old enough to be using their services.”

What the recommender systems investigation means

The ICO opened its investigation into TikTok’s use of 13 to 17-year-olds’ data in recommender systems in February 2025. TikTok’s appeal against the information notice had stopped the ICO from progressing it. That obstacle is now gone. The investigation concerns profiling used to recommend content, the same profiling that drives engagement, so its outcome is worth watching for any service that personalises content for teenage users.

What this means in India

The DPDPA sets a stricter baseline. Under Section 2(f) a child is anyone under 18, not 13. Section 9(1) requires a Data Fiduciary to obtain the verifiable consent of a parent or lawful guardian before processing any personal data of a child, and Section 9(3) bars “tracking or behavioural monitoring of children or targeted advertising directed at children”, subject to exemptions the government may prescribe under Section 9(4). Those obligations take effect in May 2027. Brazil’s ANPD reached a similar point from a different angle when it fined TikTok over its logged-out feed.

What to do now

Start with an honest estimate of how many users below your minimum age you actually have, using the signals you already hold, because the ICO’s case rested on what TikTok “ought to have been aware” of, not on what its terms said. Where your service is offered directly to children and relies on consent, build parental authorisation with a verification step proportionate to the risk, and record how each one was obtained. Rewrite your privacy information so a child can understand it, since the Articles 12 and 13 findings were about clarity, not only disclosure. Review which trackers, analytics and advertising tags run for users who may be children, and switch off profiling for them by default. If you serve users in India, plan for a parental consent flow covering everyone under 18 and for removing behavioural tracking from children’s journeys before May 2027. For how these rules sit alongside the GDPR and other regimes, see our regulations overview.

Sources

enforcementchildren-dataage-assuranceparental-consent

Comply Ark Regulatory infrastructure company. Builds CookieGate.

If this applies to your site.

CookieGate holds non-essential tags until the visitor decides, resolves the right law by location, and prints a receipt per decision.

Start free trial

15 days. Card required. Nothing is charged before day 15.

How CookieGate handles each regulation