TikTok could face fines of up to £27 million ($29 million) following a long-running investigation by the UK's Information Commissioner's Office (ICO) into the misuse of data belonging to children under the age of 13.
The alleged breach occurred between May 2018 and July 2022, in which time the ICO alleges that the company may have processed data from young users without parental consent, saying that the company "failed to provide proper information to its users in a concise, transparent and easily understood way" and "processed special category data, without legal grounds to do so."
We all want children to be able to learn and experience the digital world, but with proper data privacy protections. Companies providing digital services have a legal duty to put those protections in place, but our provisional view is that TikTok fell short of meeting that requirement.
John Edwards, UK Information Commissioner, ICO
The Information Commissioner's Office (ICO) indicated that their initial view was that TikTok failed to provide the required level of data protections for young people. They have also stated that the findings are not yet final and will consider any representations from TikTok before coming to a final decision. Although a Notice of Intent has been issued to TikTok, the commission has made it clear that no conclusions are to be drawn at this stage.
While we respect the ICO's role in safeguarding privacy in the UK, we disagree with the preliminary views expressed and intend to formally respond to the ICO in due course.
Spokesperson, TikTok
TikTok, owned by Chinese company ByteDance, is also facing a probe into child data protection by Ireland's Data Protection Commission (DPC), who have recently submitted a preliminary decision relating to alleged TikTok children's privacy violations to members of the European Data Protection Board under Article 60 of the EU General Data Protection Regulation. Ongoing since September 2021, the case concerns TikTok's platform settings and transparency around the processing of children's personal data which could potentially result in additional EU fines.