The protection of children’s personal data continues to be a significant focus for data protection regulators. TikTok’s decision to withdraw its appeal against a £12.7 million fine imposed by the UK Information Commissioner’s Office (ICO) provides a further reminder that organisations providing online services to children must take particular care when collecting and using their information.
The fine, originally imposed in 2023, concerned a number of data protection breaches, including TikTok’s unlawful processing of children’s personal information, inadequate measures to prevent underage users from accessing the platform and insufficiently clear privacy information.
What happened?
The ICO’s investigation found that TikTok had processed the personal data of children under the age of 13 without appropriate parental consent. The regulator also raised concerns about TikTok’s failure to take adequate steps to identify and remove underage users from the platform.
A further issue was the information provided to users about how their personal data was being used. The ICO considered that the privacy information provided by TikTok was not sufficiently clear, particularly for children.
TikTok challenged the ICO’s findings. However, in August 2026, the Upper Tribunal rejected TikTok’s argument that the ICO required prior court approval because the processing in question was undertaken for artistic purposes.
TikTok has now withdrawn its appeal against the £12.7 million penalty, meaning the fine is final.
The company has also abandoned its challenge to an information notice requiring it to provide documents to the ICO in relation to a separate investigation concerning its use of information relating to 13 to 17-year-olds in recommender systems. That investigation can therefore resume.
Why is children's data treated differently?
Children may be less able to understand the implications of providing personal information or how that information will subsequently be used. Organisations therefore need to consider whether their processing is appropriate for the age and understanding of the individuals concerned.
The UK GDPR requires personal data to be processed lawfully, fairly and transparently. Where children are likely to access a service, organisations should consider whether their privacy information is genuinely understandable to younger users rather than simply satisfying the requirements of an adult audience.
Age assurance can also present a significant compliance challenge. Businesses need to consider what measures are appropriate to identify users who may be below the minimum age for their service, while ensuring that any age-assurance mechanism itself complies with data protection requirements.
Recommender systems and children's information
TikTok's separate investigation also highlights another developing area of regulatory scrutiny: the use of children's information in recommender systems.
Online platforms increasingly use personal information to determine which content is displayed to users. Where children are involved, this can raise questions about the lawful basis for processing, transparency, data minimisation and the potential consequences of profiling.
The issue extends beyond social media platforms. Organisations using algorithms, recommendation tools or AI systems that process children's information should consider whether they can explain how personal data is being used and whether they are collecting and processing more information than is necessary.
What should businesses be doing?
The TikTok case provides a useful opportunity for organisations that offer services to children, or which are likely to be accessed by children, to review their data protection practices.
In particular, organisations should consider:
- Age assurance: Are reasonable measures in place to identify and manage underage users?
- Privacy information: Is information about data processing clear and understandable to children and their parents or guardians?
- Lawful basis: Does the organisation have an appropriate lawful basis for processing children's personal data?
- Data minimisation: Is the organisation collecting only the information it actually needs?
- Profiling and recommender systems: Are children's personal data being used to personalise content or make decisions about what they see?
- Data protection impact assessments: Have the risks associated with processing children's information been properly assessed?
- Governance: Are appropriate policies, procedures and technical safeguards in place to protect children's information?
These considerations are particularly important where organisations use new technologies such as AI, automated decision-making and recommender systems.
A continuing area of regulatory focus
TikTok's case demonstrates that children's privacy remains an important enforcement priority. The finalisation of the £12.7 million penalty, together with the continuation of the ICO's separate investigation into recommender systems, indicates that organisations cannot assume that compliance issues involving children's data will be treated as a minor aspect of wider data protection compliance.
For businesses operating online services, the key issue is not simply whether children can access a platform. Organisations should consider from the outset whether children are likely to use their service and, if so, whether their approach to data collection, transparency, age assurance and profiling is appropriate.
As AI and algorithmic technologies become increasingly integrated into consumer services, these issues are likely to become even more important. Businesses should therefore ensure that children's data protection is built into the design and governance of their services, rather than addressed only after a regulatory concern arises.
How To Get In Contact
If you require assistance with any aspect of data protection and privacy law, or have questions about your legal obligations, please contact our Data Protection and Privacy team on 020 4600 9907 or email info@culbertellis.com.
Accurate at the time of writing. This information is provided for general information purposes only and should not be relied upon as legal advice.
