A Three-Year Fight Ends Not With a Ruling, But a Withdrawal
On 24 September 2026, the UK Information Commissioner's Office announced that TikTok had withdrawn its appeal against the £12.7 million fine the regulator imposed in 2023, and separately dropped its challenge to an information notice tied to a newer investigation. The 2023 penalty is now final. It was never really in doubt after 28 July 2026, when the Upper Tribunal issued its decision in TikTok Inc and TikTok Information Technologies UK Ltd v The Information Commissioner, [2026] UKUT 277 (AAC). TikTok's withdrawal three weeks ago is less a concession than an acceptance of arithmetic: the argument that had kept the case alive for three years had just been dismantled by the tribunal itself.
The 'Special Purposes' Gambit That Failed
The original 2023 penalty rested on the ICO's finding that TikTok let an estimated 1.75 million UK children under 13 use the platform in 2020 without adequate age checks or parental consent, in breach of UK GDPR and the Data Protection Act 2018. TikTok's defence was procedural rather than factual: it argued its processing of user content qualified for the Act's "special purposes" carve-out — journalistic, academic, artistic or literary activity — which would have forced the ICO to seek prior court approval before fining it at all.
The Upper Tribunal rejected that reading outright. As the tribunal put it, processing is "for" the special purposes "only where the purpose of the relevant processing is itself journalistic, academic, artistic or literary" — not merely because the platform hosts content that might have those qualities. Hosting a video with artistic merit does not make the recommendation engine that surfaces it an artistic activity. That is a sensible, narrowly drawn distinction, and one with consequences well beyond TikTok: any platform tempted to invoke special-purposes protection as a shield around its core data operations — rather than around genuine editorial or creative activity — now has a clear precedent against it.
Why the Recommender Case Is the One That Matters
The more consequential story is what TikTok's capitulation unlocks. In March 2025 the ICO opened an investigation, alongside probes into Reddit and Imgur, into how TikTok uses the personal data of 13-to-17-year-olds — those old enough to hold an account — to power the recommendation algorithm that fills their feed, as IAPP reported at the time. TikTok had used its now-abandoned appeal of the ICO's information notice to slow-walk that inquiry too. With the notice unchallenged, the ICO can now compel the documents and technical detail it needs to actually assess whether TikTok's ranking systems steer teenagers toward content the platform's own house rules say they shouldn't see.
This is the case regulators, and this publication, should watch more closely than the fine itself. A monetary penalty for failing to keep 12-year-olds off a 13+ platform is a comparatively simple compliance failure. An investigation into whether an engagement-optimised recommender system systematically nudges teenagers toward harmful content is a question about the core business model — and one the UK, through the Online Safety Act 2023 and the ICO's Children's Code (in force since 2021), has explicitly reserved the authority to ask.
Steelmanning the ICO
The strongest case for the ICO's approach is straightforward: age verification and parental consent are not exotic asks. They are baseline obligations under GDPR that TikTok's own terms of service already claimed to enforce. A £12.7 million fine against a company with TikTok's global revenue is not disproportionate punishment for a genuine, multi-year failure to build functioning age gates — it is a rounding error calibrated to change incentives, not bankrupt the firm. And a regulator that cannot compel the internal documentation behind a recommender system has no real way to verify a platform's own safety claims; the information notice TikTok fought was a precondition for oversight to mean anything at all.
Where Proportionality Should Bite
The ICO's own framing is instructive: it does not claim TikTok's recommender system is unsafe — only that it wants to examine it.
That distinction matters. The investigation launched in 2025 is fact-finding, not a pre-judged conclusion, and the ICO should be held to that standard as it proceeds. The regulatory risk here is scope creep: an inquiry into 13-17 recommender systems could easily slide from asking whether TikTok's stated safety measures are real into second-guessing the editorial logic of content ranking itself — a much harder line to draw, and one closer to content regulation than data protection. The ICO's remit under the DPA is what data is processed and how, not what algorithmic outcomes are ideologically preferable. Proportionate regulation here means the investigation stays anchored to verifiable claims (does the system do what TikTok says it does) rather than open-ended judgments about what teenagers should be shown.
The Takeaway
TikTok lost cleanly on the law — the special-purposes argument was always a stretch, and the tribunal said so in plain terms. That outcome is good news for regulatory clarity generally: platforms cannot dress up commercial data processing as protected creative expression. But the real test of UK children's-privacy enforcement is the recommender-system case now unblocked, and it deserves scrutiny precisely because it is harder and more consequential than the fine that preceded it.