The UK’s Information Commissioner’s Office (ICO) has upheld a £12.7m fine against TikTok for breaching data protection laws by processing the data of under-13s without proper consent. The Upper Tribunal ruled against the platform’s challenge to the penalty on Wednesday.
Allegations of unlawful profiling
The ICO found that TikTok had tracked and profiled more than 1.4 million children aged under 13 between May 2018 and June 2020. The regulator claimed the platform used this information to deliver potentially harmful or inappropriate content through its algorithm, without parental consent. Under GDPR, this kind of data use is only allowed for specific purposes such as artistic, journalistic, or academic work.
Court dismisses 'artistic' defence
TikTok argued that the platform’s creative tools allowed children to express themselves in an artistic way, and that this justified the processing of their data. The tribunal rejected this, stating the company could not prove the data had been used for such purposes. The judge described TikTok as the 'innocent party' in this scenario, despite its failure to verify users' ages.
Regulatory precedent and future implications
Joanna Ludlam of Jenner and Block said the ruling is likely to have broader consequences for other platforms that may raise similar arguments. The decision comes as the UK's Online Safety Act begins to take effect, raising the pressure on tech companies to comply with data and safety rules for children. Binnie Goh, general counsel at the ICO, said the ruling sets an important legal benchmark for how special-purpose provisions are applied in data law.
A TikTok spokesperson said the company is “carefully considering this judgment.” The platform has not yet indicated whether it will pursue further legal action or comply without appeal.