TikTok Accepts ICO's £12.7m Children's-Data Fine as Final

TikTok's £12.7m Children's-Data Fine Is Now Final

TikTok has dropped its two remaining appeals and accepted the UK ICO's £12.7 million penalty for unlawfully processing children's data as final — the first UK Children's Code fine to run all the way to a paid, final penalty.

Why It Matters

The ICO confirmed on 24 September that TikTok withdrew both its appeal against the 2023 £12.7 million penalty and its appeal against the related information notice. The penalty stands for allowing an estimated 1.75 million UK children under 13 onto the platform in 2020 without adequate age checks, clear information, or the parental consent UK law requires.

The finalisation follows an August 2026 Upper Tribunal ruling that dismissed TikTok's argument that its data processing counted as an "artistic purpose." For compliance and legal teams, the practical takeaway is that a novel defence to children's-data obligations has now been tested and rejected — and that the ICO's Children's Code enforcement produces fines that survive appeal. Expect age-assurance and children's-data design to be judged on outcomes, not stated intent.

Action Items

Verify age-assurance controls — Confirm they prevent under-13 access to any service processing children's data, and document how flagged underage users are identified and removed.
Check lawful basis and parental consent — For any child-directed processing, confirm a valid lawful basis and, where children are below the applicable age threshold, verifiable parental consent.
Review children's privacy notices — Check them for clarity and age-appropriateness under the UK GDPR / DPA 2018 and equivalent regimes.

Get the full analysis. Pro subscribers receive the complete deep dive, all 5 action items, source documents, and jurisdiction-specific compliance checklists.

Upgrade to Pro