TikTok drops £12.7m ICO GDPR fine and information notice appeals

TikTok has agreed to pay a £12.7 million monetary penalty issued by the Information Commissioner's Office (ICO) after withdrawing its appeal against the underlying enforcement action.

The ICO issued the penalty in 2023 for extensive data protection violations, primarily concerning the unlawful processing of children’s personal information. The ICO issued the fine after an investigation found that the platform had violated Articles 5(1)(a), 8, 12, and 13 of the UK General Data Protection Regulation (GDPR) after it allowed 1.75 million (up from 1.4 million) children under 13 to use its service without parental consent in 2020, contrary to the technology company's policy. TikTok failed to implement sufficient age checks, failed to secure parental consent, and did not provide transparent information to help younger users make informed choices. The withdrawal makes the monetary penalty final, following a decision by the Upper Tribunal (UT) in August dismissing TikTok's defence that it processed data for artistic purposes.

TikTok has also withdrawn its appeal against an ICO information notice, unblocking a separate investigation launched in February 2025 into its recommender systems. That investigation is examining how the platform processes data belonging to users aged between 13 and 17, addressing concerns that personalised profiling algorithms make it harder for minors to stop scrolling and expose them to harmful content.

Training announcement: Freevacy provides comprehensive training for new and existing practitioners on the changes introduced by the DUA Act to the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA18), and the Privacy and Electronic Communications Regulations 2003 (PEC-Regulations). Our courses are always up to date and provide a forum for learning and discussing how to ensure your data protection processes remain compliant. Find out more.