TikTok withdraws appeal against £12.7 million privacy fine: lessons for digital platforms

TikTok’s withdrawal of two appeals brings its challenge to a historic children’s privacy penalty to an end, while allowing a separate investigation into its recommender systems to proceed. For digital platforms, the developments highlight the importance of effective age assurance, accessible privacy information and scrutiny of how children’s data informs personalised content.

What has happened?

On 24 September 2026, the Information Commissioner (“IC”) announced that TikTok had withdrawn its appeal against a £12.7 million fine imposed in 2023 for breaches of data protection law. The withdrawal makes the penalty notice final. TikTok has also withdrawn a separate appeal against an information notice concerning its use of teenagers’ personal data in recommender systems.

Although the two developments concern children’s privacy, they relate to distinct regulatory matters. The first concerns historic findings about TikTok’s handling of personal data, including that of children under the age of 13. The second concerns an ongoing investigation into how the platform uses the personal information of users aged 13 to 17 to recommend content. However, both illustrate the expanding regulatory focus on children’s data across the digital-service lifecycle: not only whether platforms can identify and appropriately protect child users, but how those users’ behavioural data is subsequently used to personalise their experience.

The historic penalty: age restrictions must work in practice

The IC’s 2023 penalty concerned failures including inadequate checks to identify and remove underage children, insufficient information about how users’ data was collected, used and shared, and failures to obtain parental consent. In its September announcement, the regulator estimated that up to 1.75 million UK children under 13 used TikTok in 2020, despite the platform’s rules prohibiting accounts for that age group.

For providers of digital services, the practical lesson is that a minimum-age requirement in terms and conditions is not, by itself, an effective age-assurance measure. Businesses should consider whether their controls support their stated age restrictions and how they respond to evidence that younger children are accessing their services.

There is also an important distinction between a platform's minimum age and the legal rules governing consent. Article 8 of the UK GDPR does not require parental consent for every use of a child's personal data. Where a provider relies on consent to process personal data in connection with an information society service offered directly to a child under 13, however, consent must be given or authorised by the holder of parental responsibility, and the controller must make reasonable efforts to verify that authorisation, taking available technology into account. Compliance, though, starts earlier than this: providers must first identify the lawful basis for each processing activity and only then determine what age-related requirements (parental verification or otherwise) follow from that basis and the nature of the service. This is a materially different exercise to simply ticking a parental-consent box.

Accordingly, businesses should assess the lawful basis for each processing activity rather than treating age verification or parental consent as a complete answer to children’s privacy compliance.

The appeals and the “special purposes” argument

The withdrawal followed an Upper Tribunal decision rejecting TikTok's argument that its processing of personal data had been for the "special purposes" (including artistic purposes), which would otherwise have required the ICO to obtain prior court approval before issuing the penalty. That ruling resolved only a preliminary jurisdictional question and did not determine the substantive allegations underlying the fine; the ICO's August statement confirmed the case had been remitted to the First-tier Tribunal for that purpose. The penalty became final only once TikTok subsequently withdrew its substantive appeal.

Recommender systems remain under scrutiny

TikTok's withdrawal of its second appeal allows the IC to progress its investigation into how the platform processes the personal information of 13- to 17-year-olds in its recommender systems. The investigation was opened in February 2025 amid concerns about children being served inappropriate or harmful content through personalised recommendations.

This is separate from the historic penalty. The withdrawal of an appeal against an information notice should not be presented as a finding that the recommender systems themselves breach data protection law. The IC's announcement describes an investigation that can now continue, not a concluded enforcement outcome.

The investigation also shifts the focus beyond the point of account creation, towards how children's data is used throughout their interaction with a platform. Recommender systems profile users based on their online activity in order to select and personalise content. The IC has linked this directly to its Children's Data Lives research, which found that children can find it harder to disengage once repeated exposure to personalised content encourages continued use. This reframes the compliance question: it is not only whether a child should be using the service at all, but what the service's own design does with their data once they are.

The IC's Children's Code provides an important benchmark. Standard 12 of the Code calls for these profiling options to be switched off by default unless there is a compelling reason otherwise, taking account of the child's best interests. It also calls for appropriate measures to protect children from harmful effects, including being served content detrimental to their health or wellbeing. This is not a blanket prohibition on personalisation, but it raises the bar for digital platforms who must justify their approach and implement appropriate safeguards.

These developments also sit alongside a wider UK regulatory framework governing children's online experiences, in particular the Online Safety Act 2023 and Ofcom's associated codes of practice, which impose separate duties on platforms likely to be accessed by children to assess and mitigate risks of harmful content. Privacy regulation and online-safety regulation increasingly address overlapping ground even though they proceed under different statutory regimes and different regulators. For TMT businesses, this means children's compliance can no longer be managed as a single-regime exercise.

What should TMT businesses consider?

The issues are relevant beyond social media. The Children’s Code addresses online services likely to be accessed by children, including apps, online games and websites, even where children are not the intended audience.

Against that background, providers should consider:

• Actual users, not only the intended audience: TikTok's own rules prohibited accounts for under-13s, yet the IC estimated up to 1.75 million UK children under that age used the platform in 2020. A stated minimum age or contractual restriction does not answer the regulatory question if evidence shows materially different patterns of actual use.
• Lawful basis and consent: Identify the basis for each processing activity and check that parental authorisation arrangements work where required.
• Meaningful transparency: Test whether younger users can understand how their information is used, including for personalised recommendations.
• Profiling and default settings: Review the justification for profiling children, the safeguards applied and whether default settings reflect their best interests.
• Evidence of compliance: Maintain clear records of assessments, design decisions, testing and remedial action so that the business can explain its approach if challenged.

Looking ahead

The finality of TikTok’s £12.7 million penalty closes one strand of the proceedings, but the separate recommender-systems investigation remains ongoing.

For TMT businesses, children's privacy needs to be built into the design and operation of a service, not addressed solely through an age restriction or a privacy notice. That means understanding who actually uses the service, the basis on which their data is processed, and how data-driven features shape their experience once they are on it.

This article was authored by Laura Thackeray (Senior Associate), Luke Roper (Associate) and Wesley Chan (Associate).