On 24 September 2026, TikTok withdrew its appeal against the Information Commissioner's Office (ICO) penalty of £12.7 million, so the fine is now final. It also dropped its challenge to an information notice that had stalled a separate ICO investigation into how its recommender systems use the personal data of 13–17-year-olds, according to the ICO's announcement. The two outcomes call for different assessments.
The case for the fine is strong
The regulator's case deserves a fair statement. The ICO found that TikTok breached Articles 8, 12, 13 and 5(1)(a) of the UK GDPR between May 2018 and July 2020. It estimated that up to 1.75 million UK children under 13 used the platform in 2020, even though TikTok's own rules barred them. The core findings were that TikTok did not carry out adequate checks to identify and remove underage users, did not obtain parental consent, and did not explain its data practices in terms a child could understand. In the ICO's enforcement record, the breach is described as a failure to use children's personal data lawfully (ICO enforcement action).
That is a reasonable basis for a penalty. Article 8 of the UK GDPR sets a consent age of 13 for information society services, and a service that knows or ought to know that younger children are using it cannot treat a self-declared birthday as a safeguard. The £12.7 million figure is also modest for a company of TikTok's scale. It is not the sort of disproportionate sanction that would deter ordinary startups from serving young users.
What the appeal actually tested
The appeal is worth reading closely because TikTok's strongest argument was not about children at all. It argued that its processing was done 'for the special purposes' (journalistic, academic, artistic or literary), which would have required the ICO to obtain court permission before penalising it. That defence matters to anyone who cares about free expression online, because a broad reading would have shielded any platform that hosts creative content from data-protection enforcement.
The Upper Tribunal rejected it. In TikTok Inc and another v The Information Commissioner [2026] UKUT 277 (AAC), decided on 28 July 2026, the tribunal held that processing is for the special purposes only where the purpose of that processing is itself journalistic, academic or literary. Merely hosting or facilitating content with those qualities is not enough.
For a publication that backs free speech, this is the right result. The special-purposes exemption protects journalists and artists, and it should not become a general licence for intermediaries. Narrowing it keeps the exemption defensible for the people it was written to protect.
TikTok's response, and what is unresolved
TikTok said it disagreed with the 2023 decision and that its findings concern a historical period that does not reflect the youth safety measures it has since introduced, City AM reported. That position is plausible but untested. The final penalty covers 2018 to 2020 and says nothing about current age-assurance practice. The ICO has not published any finding on whether TikTok's present controls comply.
The harder question is teenagers
The ICO opened its recommender-systems investigation in February 2025, and the withdrawn appeal against the information notice now lets it proceed. This is where proportionality becomes difficult. The under-13 case was relatively clean, since the law set a clear age threshold and the platform's own rules agreed with it. The 13–17 group is different. Teenagers can lawfully consent to data processing under UK law, and they also have legitimate interests in speech, discovery and community, interests that a heavy-handed intervention in feeds could damage.
A regulator examining how a recommender profiles teenagers should therefore do three things:
- Separate documented harms from discomfort with personalisation. Profiling that serves a teen's stated interests is different from profiling that exploits vulnerabilities.
- Prefer transparency, default settings and user controls over bans on categories of recommendation, which would push the burden of speech decisions onto the regulator.
- Publish its test. The Upper Tribunal's ruling shows that clear legal tests can be written down. The ICO should do the same for what counts as lawful profiling of minors, so that smaller services know the rule before they are investigated.
The ICO says its work protecting children's data has helped safeguard around five million child users. Emily Keaney, the ICO's deputy commissioner, said in the announcement that how companies design online services and use children's personal information has a significant impact on young people's experience in the digital world. That is true, and it is also a reason for the regulator to build its recommender case on evidence of harm rather than on design preferences.
What to watch
Three things follow from the withdrawal. First, the age-assurance question for under-13s is now settled law and practice: self-declaration alone is not enough where a service knows children are present. Second, the narrow reading of the special-purposes exemption is now precedent that other platforms will have to live with. Third, the 13–17 investigation will show whether the ICO can regulate algorithmic design with the same discipline it applied to a simple consent failure. If it publishes a clear and evidence-based standard, it will have set a useful benchmark for the whole sector. If it does not, the result will be a precedent that is hard to apply to anyone else.