TikTok Drops Appeals and Accepts £12.7 Million UK Children’s Privacy Fine

Key Takeaways

• TikTok Accepts £12.7 Million Fine: TikTok has withdrawn its appeal against a 2023 Information Commissioner’s Office penalty over breaches of UK data protection law involving children.
• ICO Estimated 1.75 Million Underage Users: The regulator estimated that up to 1.75 million UK children under 13 used TikTok in 2020 despite the platform’s own age restrictions.
• Second Appeal Dropped: TikTok has also withdrawn its challenge to an ICO information notice seeking details about its use of 13- to 17-year-olds’ personal information in recommender systems.
• Investigation Can Resume: The appeal had prevented the ICO from progressing its recommender systems investigation, which it opened in February 2025.

Deep Dive

TikTok has agreed to pay a £12.7 million fine imposed by the Information Commissioner’s Office in 2023 after the company dropped two appeals against the UK’s data protection regulator, bringing one long-running children’s privacy case to an end and allowing another to move forward.. TikTok has separately abandoned its challenge to an information notice seeking documents and details about how it processes teenagers’ personal information through its recommender systems. The first case reaches back to TikTok’s handling of children under 13, who were not supposed to be on the platform in the first place.

The ICO estimated, based on economic analysis, that as many as 1.75 million UK children under 13 used TikTok in 2020 despite the company’s rules prohibiting children that age from creating an account. The regulator found that TikTok failed to conduct adequate checks to identify and remove underage users and failed to obtain parental consent even though it ought to have been aware that children under 13 were using the service.

There was another problem. The ICO found that TikTok failed to give users clear information about how their personal data was being collected, used and shared. That failure mattered particularly for children, who the regulator said were unlikely to have enough information to make informed decisions about their data.

The ICO imposed the £12.7 million penalty in 2023 for numerous breaches of UK data protection law, including the unlawful use of children’s personal data. TikTok appealed. Part of that dispute eventually turned on a more technical question with consequences for the regulator’s ability to bring the case at all. TikTok argued that its processing of personal data had been for artistic purposes. Had that argument succeeded, the ICO said it would have been required to obtain prior court approval before issuing the penalty.

The Upper Tribunal dismissed that argument in August. TikTok has now withdrawn its appeal against the penalty itself, making the 2023 penalty notice final. The company has also dropped a second appeal, this one concerning an investigation that has yet to reach a conclusion.

The ICO opened that investigation in February 2025 amid concerns about young people being served inappropriate or harmful content through recommender systems. The inquiry is examining how TikTok processes the personal information of users aged 13 to 17 in the systems it uses to decide what content to recommend.

Those systems work by profiling users and drawing on their online activity to select material likely to hold their interest. That capacity to personalize a feed is precisely what makes them valuable to platforms. It is also what has drawn the regulator’s attention when the person being profiled is a child.

Research from the ICO’s Children’s Data Lives year two study indicates that children sometimes find it harder to stop scrolling when repeated exposure to personalized content encourages them to continue engaging. To pursue its investigation, the ICO issued an information notice requiring TikTok to provide certain documents and details about its processing of teenagers’ personal information. TikTok appealed the notice. While that challenge remained alive, the ICO could not progress its investigation. It can now do so.

“How companies design online services and use children’s personal information has a significant impact on young people’s experience in the digital world,” ICO Deputy Commissioner Emily Keaney said.

Keaney said the regulator’s action against TikTok demonstrated the importance of companies having protections in place to prevent access by children who are too young to use their services. She also welcomed TikTok’s decision to withdraw the appeals following the Upper Tribunal ruling.

“We look forward to being able to further progress our ongoing work to protect children's personal information and help build public trust in digital services,” she said.

The distinction between the two cases matters. The £12.7 million penalty is settled. The ICO’s findings underlying that penalty concerned TikTok’s treatment of children’s data and access by under-13s. The recommender systems inquiry, by contrast, remains an investigation. The withdrawal of TikTok’s appeal against the information notice allows the ICO to continue that work. It does not amount to a finding that TikTok has broken the law in that separate matter.

The regulator estimates that its broader work to improve how children’s personal data is used has helped protect close to five million child users. It has paired that enforcement work with its Switched on to Privacy campaign, which is intended to help parents understand the privacy choices available for their children.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.