The UK government has levied a fine of £12.7 million against the Chinese video platform TikTok for multiple breaches of data protection regulations. The Information Commissioner’s Office (ICO), which oversees data privacy in the UK, found that TikTok permitted approximately 1.4 million children in the UK under age 13 to access its services during 2020, despite its own policies prohibiting this age group from creating accounts.
This enforcement action follows a recent UK government decision to prohibit the use of TikTok on all government-issued devices due to concerns regarding the security implications of the Chinese-owned app.
The UK’s ban aligns with similar actions taken by the United States, Canada, the European Union, and India, the latter of which has implemented a complete ban on TikTok, even as the company continues to assert that it does not share user data with the Chinese government.
Under UK data protection laws, organizations providing information services directed at children under 13 are required to obtain consent from their parents or guardians before using personal data.
John Edwards, the UK Information Commissioner, emphasized the importance of protecting children online. He remarked, “There are laws in place to make sure our children are as safe in the digital world as they are in the physical world. TikTok did not abide by those laws.”
He further criticized TikTok, stating: “TikTok should have known better. TikTok should have done better. Our £12.7 million fine reflects the serious impact their failures may have had. They did not do enough to check who was using their platform or take sufficient action to remove the underage children that were using their platform.”
In response, TikTok announced it is evaluating the ruling and considering its next steps.
Edwards indicated that access to the platform by underage users had serious implications, as TikTok was reportedly collecting and utilizing their personal data, which could result in exposing them to inappropriate or harmful content.
The app faces allegations of not conducting thorough checks to identify and remove users under the legal age. The ICO’s investigation uncovered that concerns were raised internally among senior staff about children under 13 accessing the platform, yet no effective action was taken.
The ICO highlighted specific violations that occurred between May 2018 and July 2020, noting TikTok’s provision of services to children under 13 and the unlawful processing of their personal data without consent from their guardians.
Additionally, the organization found that TikTok failed to communicate adequately with its users about how their data is gathered, utilized, and shared, making it difficult for especially younger users to make informed decisions regarding their engagement with the platform.
A spokesperson for TikTok stated, “Our 40,000-strong safety team works around the clock to help keep the platform safe for our community. While we disagree with the ICO’s decision, which relates to May 2018 – July 2020, we are pleased that the fine announced today has been reduced to under half the amount proposed last year. We will continue to review the decision and are considering the next steps.”
Previously, the ICO had issued a “notice of intent” indicating that TikTok could face a £27 million fine for its data-related breaches. After considering TikTok’s representations, the ICO decided not to pursue the allegations regarding the unlawful use of special category data.
