TikTok Drops ICO Appeals and Accepts £12.7m Children's Data Fine

TikTok has dropped both of its appeals against the Information Commissioner's Office and accepted a £12.7 million fine over its handling of children's data. The withdrawal also unblocks a separate UK investigation into how TikTok's recommender systems profile 13 to 17 year olds.

Information last verified on 25 September 2026. This is a developing story; we update it as the record changes.

Status: The 2023 monetary penalty notice is final as of 24 September 2026, TikTok having withdrawn its appeal. TikTok has withdrawn both its appeal against the £12,700,000 penalty and its appeal against the ICO information notice. The separate ICO investigation into TikTok's use of children's data in its recommender systems, opened in February 2025, remains OPEN. No findings have been made in that investigation and no infringement has been established.

Jurisdiction scope: This article concerns United Kingdom law only, specifically the UK GDPR and the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025. The UK GDPR is a distinct instrument from the EU GDPR and is enforced by the ICO, not by EU supervisory authorities. Nothing here describes US federal or US state privacy law.

What Happened

The ICO published its statement on 24 September 2026 under the heading "TikTok withdraws two appeals in children's privacy action and accepts £12.7m fine". It records two separate withdrawals.

The first is TikTok's appeal against the monetary penalty notice the Information Commissioner issued on 4 April 2023 under section 155 of, and Schedule 16 to, the Data Protection Act 2018. That notice imposed a penalty of £12,700,000 on TikTok Inc, of Culver City, California, and TikTok Information Technologies UK Limited, of London, whom the Commissioner found jointly and severally liable. In the ICO's words, TikTok "appealed the fine but has now dropped its appeal, meaning the penalty notice is final".

That appeal had run for more than three years, and most of it was spent on a single preliminary question. TikTok argued that the penalty notice was issued without authority because its processing had been for artistic purposes, one of the "special purposes" in the Data Protection Act 2018, which attract additional restrictions on the regulator before it can act. The First-tier Tribunal rejected that argument in a decision dated 27 June 2025, amended under the slip rule on 25 July 2025, after a hearing on 19 to 21 May 2025. Upper Tribunal Judge Wikeley granted permission to appeal on 25 September 2025, in a decision that also suspended the effect of the First-tier Tribunal's decision pending the appeal, and the case was heard on 11 and 12 May 2026. In TikTok Inc & Anor v The Information Commissioner [2026] UKUT 277 (AAC), a panel of Lady Poole, Upper Tribunal Judge Wikeley and Upper Tribunal Judge Church dismissed the appeal, confirmed the First-tier Tribunal's decision and remitted the case for determination of the substantive appeal. The panel authorised that decision for issue on 28 July 2026, and the ICO describes the resulting precedent as having been set in August. It is the remitted substantive appeal that TikTok has now abandoned.

The second withdrawal concerns an information notice. The ICO says TikTok has "withdrawn its appeal against our information notice requesting details from the company about how it processes the personal information of 13-17-year-olds in its recommender systems", and that the appeal "prevented us from progressing our investigation but now the appeal has been dropped it can continue".

Emily Keaney, ICO Deputy Commissioner, said: "How companies design online services and use children's personal information has a significant impact on young people's experience in the digital world. Our successful action against TikTok shows how important it is for companies to have the right protections in place, including to prevent access by children who are not old enough to be using their services." She added: "We have always been clear that this processing was not for the special purposes, and following the Upper Tribunal's decision, we welcome TikTok's withdrawal of its appeals," and said the regulator looks forward to "being able to further progress our ongoing work to protect children's personal information and help build public trust in digital services."

What the 2023 Penalty Was For

The penalty notice covers a defined window, described in the document as the "Relevant Period": 25 May 2018 to 28 July 2020. Over that window TikTok's UK footprint grew from 2,051,643 monthly active UK users on 30 May 2018 to 17,723,009 by 31 July 2020.

The Commissioner found four infringements of the UK GDPR.

Article 8, conditions applicable to a child's consent for information society services. TikTok provided its services to UK users under 13 and processed their personal data without consent given or authorised by a holder of parental responsibility, and without identifying any lawful basis other than consent. The Commissioner rejected TikTok's argument that contractual necessity supplied an alternative basis. He also found that TikTok did not make reasonable efforts to verify parental consent under Article 8(2), noting that because TikTok's stated policy limited the platform to over 13s, it "did not make any efforts at all to verify consent in respect of underage users".

Article 12, transparent information and communication. TikTok failed to take appropriate measures to provide the information required by Article 13 in a concise, transparent, intelligible and easily accessible form, using clear and plain language, "in particular in relation to information addressed specifically to children".

Article 13, information to be provided where personal data are collected from the data subject. TikTok failed to provide data subjects with the information required by Articles 13(1) and (2).

Article 5(1)(a), lawfulness, fairness and transparency. By failing to comply with the above, TikTok failed to ensure UK users' personal data was processed lawfully, fairly and transparently.

On age assurance, the Commissioner's reasoning was blunt. At paragraph 67 of the penalty notice he recorded that "the only age gateway or age verification process in place at the point of entry to the platform, was a self-declaration of age by the user". At paragraph 68 he continued:

"As a result, individuals were able to set up an account just by entering a date of birth, without any further details and without any form of corroboration or verification being required. While UK users were precluded from access if they stated they were younger than 13, there was nothing stopping children from making a false declaration of age and thus being able to create an account."

Nor, on the Commissioner's findings, did the position improve after sign-up. TikTok did not conduct any random checks for underage users throughout the Relevant Period and until August 2021, and in 2020 only 207,046 accounts were proactively reviewed on suspicion of belonging to an underage user, around 1.3 per cent of total monthly active users. Accounts removed on suspicion of being underage amounted to less than 1 per cent of TikTok's total UK users across the period.

The arithmetic of the fine is set out in the notice. The Commissioner arrived at £6,750,000 for the Article 8 infringement and £3,950,000 for the Article 12 and 13 infringements, a subtotal of £10,700,000, then added an uplift of £2,000,000 for deterrence to reach £12,700,000. That final figure is well below the £27 million he had provisionally been minded to impose in the notice of intent of 23 September 2022, a reduction driven largely by his decision, communicated on 15 March 2023, to de-prioritise the part of the investigation relating to Article 9 of the UK GDPR after considering TikTok's written representations of 14 November 2022. The Commissioner recorded that even with the uplift the penalty came to 2.32 per cent of the combined turnover of the two TikTok entities, which he put at £547 million for 2020, and about 0.036 per cent of parent company ByteDance's turnover.

What the Law Actually Says

The legal architecture behind this action is UK-specific, and it is worth separating the four moving parts. Our overview of UK data privacy laws, the UK GDPR, the Data Protection Act 2018 and the 2025 reforms sets out the wider framework.

The age of consent for online services is 13 in the UK. Article 8(1) of the UK GDPR provides that, where consent is the lawful basis and an information society service is offered directly to a child, processing is lawful where the child is at least 13 years old; below 13, it is lawful only to the extent that consent is given or authorised by the holder of parental responsibility. The figure of 13 was substituted into the retained text on 31 December 2020 by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019. Article 8(2) requires the controller to make reasonable efforts to verify that such consent has been given, "taking into consideration available technology". Since 29 April 2026 a new Article 8(2A), inserted by section 72(2) of the Children's Wellbeing and Schools Act 2026, allows the Secretary of State to change that age by regulations, but not below 13 or above 16, and to set different ages for specified services; Article 8(2B) makes those regulations subject to the affirmative resolution procedure.

The Children's code is the design standard. Section 123 of the Data Protection Act 2018 requires the Commissioner to prepare a code of practice on standards of age-appropriate design of relevant information society services likely to be accessed by children, having regard to the fact that children have different needs at different ages and to the UK's obligations under the UN Convention on the Rights of the Child. The resulting Age Appropriate Design Code, universally called the Children's code, contains 15 standards covering matters such as data protection impact assessments, default settings, data minimisation, profiling, nudge techniques and geolocation. Its legal status is precise rather than dramatic: under section 127, a failure to act in accordance with the code does not of itself create liability, but the code is admissible in evidence, and both a court or tribunal and the Commissioner must take a relevant in-force provision of it into account when determining a question to which it appears relevant.

A penalty notice is appealed to the First-tier Tribunal. Section 162(1) of the Data Protection Act 2018 gives a person who is given an information notice, assessment notice, interview notice, enforcement notice, penalty notice or penalty variation notice a right of appeal to the Tribunal, in practice the First-tier Tribunal (Information Rights). Section 162(3) allows a separate appeal against the amount of a penalty, whether or not the notice itself is appealed. The 2023 penalty notice told TikTok that a notice of appeal should be received within 28 days of the date of the notice, and recorded that the Commissioner would not take action to enforce the penalty unless the payment period had expired with the penalty unpaid, all relevant appeals had been decided or withdrawn, and the period for appealing had expired. It is the second of those conditions that TikTok's withdrawal has now satisfied. Readers looking at the other end of the same system may find our guide to complaining to the ICO, step by step useful.

An information notice is a compulsory-disclosure tool, and appealing it pauses the clock. Section 142 of the Act lets the Commissioner require a controller, processor or other person to provide information reasonably required for the Commissioner's functions, including for investigating a suspected failure. The notice must state why the information is required and must give information about the consequences of failing to comply and about appeal rights. Crucially, section 142(6) provides that if an appeal is brought against an information notice, "the information need not be provided pending the determination or withdrawal of the appeal". That subsection is the whole explanation for why TikTok's appeal stalled the recommender-systems investigation, and why withdrawing it restarts matters. Failing to comply with an information notice is itself a ground on which the Commissioner may issue a penalty notice under section 155(1)(b), and under section 157(4) such a penalty attracts the higher maximum. Section 157(5) sets that higher maximum, for an undertaking, at £17,500,000 or 4 per cent of total annual worldwide turnover in the preceding financial year, whichever is higher; the standard maximum is £8,700,000 or 2 per cent.

One governance change is imminent and does not disturb any of this. The Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026, SI 2026/1015 (C. 83), made on 10 September 2026, bring sections 117(4)(a), 118 and 119 of the Data (Use and Access) Act 2025 into force on 30 September 2026. Section 118 abolishes the office of Information Commissioner and section 119 transfers its functions to a new body, the Information Commission. Regulation 3 provides that any act, omission or other thing, "including legal proceedings", done by or in relation to the Information Commissioner, or in the process of being done immediately before 30 September 2026, is to be treated as done by or in relation to the Information Commission and capable of being continued by it. So the 2023 penalty, already final before the transfer date, stands, and the open recommender-systems investigation carries over to the Commission without needing to be restarted.

The Investigation That Is Still Open

The recommender-systems matter is a separate investigation from the 2023 penalty, and it is at a much earlier stage.

The ICO opened it in February 2025 and announced it publicly on 3 March 2025, alongside investigations into Reddit and Imgur. The scope, as the ICO described it then, is "how the platform uses personal information of 13-17-year-olds in the UK to make recommendations to them and deliver suggested content to their feeds". The stated concern is that platforms use data generated by children's online activity in their recommender systems in ways that "could lead to young people being served inappropriate or harmful content". In its September 2026 statement the ICO connected that to its own research, saying findings from year two of its Children's Data Lives study "indicates that children sometimes find it harder to stop scrolling, as repeated exposure to personalised content encourages continued engagement".

The important point for anyone reading about this is what the ICO has not said. In announcing the investigation the regulator was explicit: "At this stage, we are investigating whether there have been any infringements of data protection legislation. If we find there is sufficient evidence that any of these companies have broken the law, we will put this to them and obtain their representations before reaching a final conclusion." No finding of infringement has been made against TikTok in relation to recommender systems. No notice of intent has been reported. No penalty has been proposed. The only development on 24 September 2026 is procedural: a statutory obstacle to the ICO gathering information has been removed because the company withdrew its appeal. We will not speculate on where the investigation lands, and neither should anything you read elsewhere.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The headline number is the least interesting thing here. £12.7 million is a small sum measured against the entities fined, as the Commissioner himself pointed out when he put it at 2.32 per cent of the two companies' combined 2020 turnover and a rounding error against ByteDance's. What makes 24 September 2026 worth recording is that a penalty which sat in suspense for three and a half years finally became an enforced fact, and that the route the company used to keep it in suspense has now been closed by a reported appellate decision.

The special-purposes argument was the more consequential of the two fights. If processing of this kind had been characterised as processing for artistic purposes, section 156(1) of the Data Protection Act 2018 would have barred a penalty notice unless "(a) a determination under section 174 with respect to the data or the processing has taken effect, and (b) a court has granted leave for the notice to be given." A regulator that has to obtain court permission before fining a video-sharing platform is a materially weaker regulator. The Upper Tribunal's conclusion that the notice was not made with respect to processing for the special purposes, and its reasoning that the Article 12 and 13 findings concerned procedural failings in privacy notices rather than processing, removes that route for the next platform that tries it.

The information-notice point deserves as much attention as the fine, because it shows how an investigation can be paused without anyone doing anything unlawful. Section 142(6) is a protective provision: it exists so that a company is not compelled to hand over material before a tribunal has ruled on whether the demand was proper. Used in a case of this size, the practical effect was that an investigation opened in February 2025 was still waiting for documents in September 2026. That is not an abuse; it is the statute working as written. It is also a reason to be sceptical of any assumption that a regulatory investigation announced with a press release will move quickly.

For readers, two things follow. First, the standard the ICO applied to TikTok is not exotic. Self-declared date of birth as the only barrier, no random checking, and privacy information that children could not realistically parse are the same failures that show up across consumer services, which is why the Children's code and the general shape of UK data privacy rights are worth understanding even outside a headline enforcement case. Second, a regulator's fine is not a payout to the people whose data was misused. The 2023 notice required the penalty to be paid to the Commissioner's office, and nothing in it directs a penny to any user; it is enforcement, not compensation. Anyone thinking about their own position should look separately at how data breach compensation actually works in the UK, and at narrower remedies such as the right to erasure.

Finally, the timing is a neat illustration of institutional continuity. Six days after the penalty became final, the office that issued it ceases to exist and its functions pass to the Information Commission. Regulation 3 of SI 2026/1015 is a single sentence doing quiet but important work: nothing in the transfer reopens a concluded enforcement action or resets an open investigation.

Disclaimer: This article is general legal information about the law of the United Kingdom and is not legal advice. It does not create a solicitor-client relationship and it does not address any individual's circumstances. Data protection law changes, and an open investigation may develop after the date of publication. If you need advice about your own position, consult a solicitor qualified in the relevant UK jurisdiction.

Related articles

• UK data privacy laws: the UK GDPR, the Data Protection Act 2018 and the 2025 reforms
• UK data privacy, DBS checks and your rights
• How to complain to the ICO, step by step
• The right to be forgotten and erasure requests in the UK
• Data breach compensation in the UK: what you can actually claim

Last updated: 2026-09-25. This is a developing story; details verified as of 2026-09-25.

Frequently Asked Questions

Is the £12.7 million fine now final?

Yes. The ICO announced on 24 September 2026 that TikTok withdrew its appeal against the monetary penalty notice issued on 4 April 2023, and stated that the penalty notice is final. The notice itself provided that the Commissioner would not enforce the penalty until all relevant appeals had been decided or withdrawn and the appeal period had expired.

What did the ICO actually find TikTok had done wrong?

The Commissioner found infringements of four provisions of the UK GDPR during the period 25 May 2018 to 28 July 2020: Article 8 on children's consent for information society services, Article 12 on transparent communication, Article 13 on information to be provided to data subjects, and Article 5(1)(a) on lawfulness, fairness and transparency. The core findings were that TikTok processed the data of UK children under 13 without parental consent or another lawful basis, made no real effort to verify consent or to keep under-13s off the platform, and did not give users, particularly children, intelligible information about how their data was used.

Why was the fine £12.7 million rather than the £27 million first proposed?

The Commissioner's notice of intent of 23 September 2022 provisionally proposed £22.75 million plus a £4.25 million uplift. After considering TikTok's written representations of 14 November 2022, he de-prioritised the part of the investigation concerning Article 9 of the UK GDPR and dropped one provisional Article 13(1)(a) finding. The remaining elements came to £6,750,000 for Article 8 and £3,950,000 for Articles 12 and 13, with a £2,000,000 deterrence uplift, giving £12,700,000.

What is an information notice, and why did appealing it stop the investigation?

An information notice under section 142 of the Data Protection Act 2018 compels a controller, processor or other person to give the regulator information it reasonably requires for its functions, including investigating a suspected failure. Section 142(6) provides that if an appeal is brought against an information notice, the information need not be provided pending the determination or withdrawal of the appeal. TikTok's appeal therefore suspended its obligation to hand over the recommender-systems material until it withdrew.

Has the ICO found anything against TikTok on recommender systems?

No. That investigation was opened in February 2025 and announced on 3 March 2025. The ICO said at the time that it was investigating whether there had been any infringements, and that if it found sufficient evidence it would put that to the company and take representations before reaching a final conclusion. No findings have been made and no penalty has been proposed. The 24 September 2026 development is procedural only.

How large a fine can the ICO impose?

For infringements of the UK GDPR, section 157(1) of the Data Protection Act 2018 applies the maximum specified in Article 83 of the UK GDPR. For failures to comply with an information notice, assessment notice, interview notice or enforcement notice, section 157(4) applies the higher maximum, which section 157(5) sets at £17,500,000 or 4 per cent of an undertaking's total annual worldwide turnover in the preceding financial year, whichever is higher. The standard maximum is £8,700,000 or 2 per cent.

At what age can a child consent to an online service in the UK?

13. Article 8(1) of the UK GDPR, as it applies in the UK, makes consent-based processing lawful where the child is at least 13 years old, and requires parental consent below that age. Since 29 April 2026 the Secretary of State has had a power under Article 8(2A) to change that age by affirmative-procedure regulations, but not below 13 or above 16.

Does the Children's code have legal force?

It is a statutory code prepared under section 123 of the Data Protection Act 2018. Under section 127, breaching it does not of itself make a person liable to proceedings, but the code is admissible in evidence, and a court, tribunal or the Commissioner must take a relevant in-force provision into account when determining a question to which it appears relevant. In practice it is the design standard the ICO applies to services likely to be accessed by children.

Does the ICO becoming the Information Commission on 30 September 2026 change anything here?

No. SI 2026/1015 commences sections 117(4)(a), 118 and 119 of the Data (Use and Access) Act 2025 on 30 September 2026, abolishing the office of Information Commissioner and transferring its functions to the Information Commission. Regulation 3 provides that anything done, or in the process of being done, by or in relation to the Commissioner, including legal proceedings, is treated as done by or in relation to the Commission and capable of being continued by it.