The Information Commissioner's Office (ICO) announced on September 24, 2026 that TikTok Information Technologies UK Limited and TikTok Inc had withdrawn their appeals and accepted a GBP 12.7 million penalty notice imposed in 2023 for unlawful processing of children's personal data under the UK GDPR and the Data Protection Act 2018. TikTok also dropped its appeal against an information notice compelling documents for a separate ICO investigation into how its recommender systems process the personal data of 13- to 17-year-olds, a probe opened in February 2025 that can resume after the withdrawal.
UK-operating social media and video-sharing platforms that profile under-18s in recommender systems, and online services with UK users under 13, must immediately audit their age-assurance controls, parental-consent flows and recommender-system profiling against the UK GDPR and the ICO Age Appropriate Design Code, or face the same penalty notice and fine, with UK GDPR fines reaching GBP 17.5 million or 4% of global annual turnover, plus an enforceable information notice compelling document production.
- Authority : Information Commissioner's Office (ICO)
- Entity : TikTok Information Technologies UK Limited and TikTok Inc
- Measure and amount : penalty notice, fine of GBP 12.7 million
- Legal basis : UK GDPR (assimilated Regulation (EU) 2016/679) and Data Protection Act 2018 (c. 12); ICO Age Appropriate Design Code (Children's Code)
- Decision date : September 24, 2026 (penalty notice issued in 2023, final after appeal withdrawal)
- Official source : ICO enforcement action, TikTok penalty notice
What happened
The ICO announced on September 24, 2026 that TikTok had withdrawn its appeals and accepted the GBP 12.7 million penalty notice imposed in 2023, which found that up to 1.75 million UK children under 13 used TikTok in 2020 despite rules barring accounts for that age, and unlawful processing of their personal data.
The finality follows an August 2026 Upper Tribunal ruling dismissing TikTok's argument that its processing was for "artistic purposes", which would have forced the ICO to obtain prior court approval before issuing the penalty. The precedent means the ICO need not seek prior court approval for such penalties. TikTok separately withdrew its appeal against an information notice on how it processes 13- to 17-year-olds' data in its recommender systems, letting the investigation, opened in February 2025 over concerns about young people being served inappropriate or harmful content, resume.
The breach
The penalty notice cites the UK GDPR and the Data Protection Act 2018 on the lawful processing of children's personal data. The decision records that TikTok "failed to use children's personal data lawfully", "failed to carry out adequate checks to identify and remove underage children from its platform", "failed to provide users with clear information about how their data was being collected, used and shared", and "failed to obtain parental consent even though it ought to have been aware that under 13s were using its platform". These failures engage the UK GDPR's lawfulness, fairness and transparency principles, the conditions for processing children's data, and the transparency duties, read with the DPA 2018, which sets the digital-consent age at 13.
The ICO's Age Appropriate Design Code (the Children's Code), a statutory code under the DPA 2018, sets the standard for services likely accessed by children: age-appropriate assurance, high-privacy defaults and transparency on profiling. The information notice probes how 13- to 17-year-olds are profiled and served content, the processing the ICO says risks compulsive engagement.
Who else is in the same regime
The decision is a signal to every UK-operating social media and video-sharing platform that profiles under-18s in recommender systems, including services run by Meta (Instagram), Snap (Snapchat) and Google (YouTube), and to any online service with UK users under 13 subject to the ICO Children's Code. The resumption of the recommender-systems investigation, and the removal of the "artistic purposes" shield, mean peers can expect the same information-notice and penalty-notice route without prior court approval. TikTok is the sanctioned context, not the audience.
What to check now
- Audit age-assurance controls for detecting and removing under-13s against the Children's Code standard of high privacy by default for services likely accessed by children.
- Verify parental-consent flows for under-13s, since the UK GDPR read with the DPA 2018 requires parental consent below the digital-consent age of 13.
- Review recommender-system profiling of under-18s for a lawful basis, transparency and the Children's Code expectations on profiling and nudge techniques.
- Prepare document-production readiness for an ICO information notice on recommender systems, mapping what you hold on under-18 profiling, content served and engagement signals.
- Refresh children's data protection impact assessments and brief the DPO and product teams on the precedent that "artistic purposes" is not a shield from ICO penalties.
Continuous, per-jurisdiction monitoring of ICO enforcement and Children's Code guidance surfaces these changes as they publish, so a compliance team can act before an information notice arrives.
