On 24 September 2026 the Information Commissioner's Office (ICO) announced that TikTok had withdrawn its appeal against the £12.7m penalty notice issued in 2023. The fine is now final. TikTok also dropped its appeal against an information notice in a separate investigation, which the ICO opened in February 2025. That investigation examines how TikTok's recommender system uses the personal data of 13-17-year-olds. It had been stalled by the appeal and can now proceed.
The two halves of this story call for different judgments.
The case for the regulator
The strongest argument for the ICO is simple. The 2023 penalty notice found that TikTok failed to use children's data lawfully. The ICO estimated, using economic analysis, that up to 1.75 million UK children under 13 used the platform in 2020, even though TikTok's own rules barred accounts for that age group. It found that TikTok did not do enough to identify and remove underage users. It found that TikTok gave users unclear information about how their data was collected, used and shared. It also found that TikTok did not obtain parental consent even though it ought to have known under-13s were on the service.
That is a fair description of a compliance failure, not a novel theory. A platform that writes an age limit into its terms and then does not check it has made a promise it did not keep. The ICO's case rested on existing UK GDPR rules, which set a parental-consent threshold for children's data, and did not depend on stretching them.
TikTok says the findings "relate to a historical period, May 2018 – July 2020" and do not reflect its later youth-safety measures. That may be true. But accepting a final penalty notice is not the same as contesting the facts, and a fine for past conduct is an ordinary consequence when a company had the means to comply and did not.
The legal point that matters beyond TikTok
The most consequential ruling in this saga came before the withdrawal. The ICO's release says the Upper Tribunal in August rejected TikTok's argument that its processing fell under the "special purposes" exemption, which covers journalistic, academic, artistic and literary processing. TikTok's argument would have required court approval before a penalty could be issued. A Slaughter and May analysis quotes the tribunal's reasoning: "The processing itself must be for a special purpose. It is not enough that the processing merely facilitates content with special-purpose characteristics." The analysis adds that the tribunal saw TikTok's algorithm as indifferent to whether content has artistic value.
This is a sound result for a pro-speech publication to welcome. The exemption exists to protect people who make journalism and art. It was never meant to shield a platform's data-handling from scrutiny because users upload creative work. If platforms could claim it, the exemption would be diluted for the journalists and artists it was written to protect. Keeping it narrow protects speech.
Where proportionality should bite: the recommender investigation
The second investigation is harder to evaluate. The ICO says its Children's Data Lives research indicates that personalised recommendations encourage prolonged engagement and make it harder for young people to disengage. The ICO's Children's code sets out 15 flexible standards, which cover areas such as data minimisation, default settings, profiling and nudge techniques. Recommender systems sit squarely in the territory of the profiling and nudge standards.
This investigation is legitimate in principle, and it should be judged on evidence. Three tests would keep it proportionate:
- Separate data use from content taste. Personalised feeds are also how teenagers find music, hobbies, communities and support. An investigation that treats all profiling of 13-17-year-olds as suspect would push platforms toward blunt, non-personalised feeds. That would make services worse for young people without making them safer.
- Show a causal link to data processing. The ICO regulates personal data. It is not a content regulator, and Ofcom holds that role under the Online Safety Act. The ICO should show that specific processing choices, such as the signals used, defaults and retention, caused identifiable harm. "Engagement is high" is not evidence of unlawful processing.
- Publish the standard before enforcing it. Companies and smaller developers copying TikTok's design need to know what lawful teen profiling looks like. If a final decision is not accompanied by specific, practical guidance, the effect will be uncertainty and over-restriction rather than better design.
What the precedent does and does not show
It would be easy to read the TikTok outcome as proof that the UK regime is working. The evidence supports a narrower claim. The regime produced a final penalty for a clear, age-gating failure, and a tribunal ruling that stops the special-purposes exemption from being used as a shield. Both are useful. Neither shows that the ICO can handle a harder question, which is whether personalised design for teenagers crosses a legal line. On that question the investigation has barely begun.
The timeline is also a warning. The fine was issued in 2023, the conduct covered 2018 to 2020, and the matter closed in September 2026. A regulator that takes this long to resolve one enforcement case will struggle to keep pace with product design that changes every few months. Faster, clearer guidance would protect children better than a slow case-by-case approach. It would also give compliant companies something to build to, instead of waiting to be told after the fact.
The pro-innovation position is not to oppose this enforcement. It is to insist that the ICO keeps to what it does well: hold companies to rules they have already accepted, such as age limits and transparency, and confine its next investigation to provable data-protection harm. If it does that, the TikTok case will be a useful precedent. If it reaches for broad theories about engagement, it risks undermining the credibility it has just gained.