TikTok face a potential £27 million fine from the ICO for failing to protect children’s privacy

On the 26^th September 2022, the Information Commissioner’s Office (‘ICO’) published a statement confirming that it has issued TikTok Inc and TikTok Information Technologies UK Limited (‘TikTok’) with a ‘notice of intent’ to impose upon TikTok a fine of £27 million for alleged data protection breaches.

If TikTok are found to have breached data protection laws, it will be the largest fine that the ICO has ever issued, following the £20 million fine imposed on British Airways in 2021 – this is not altogether surprising given the ICO’s focus on the protection of children and its Age Appropriate Design Code, particularly in the context of social media platforms.

The notice of intent, although only a provisional measure, sets out the professional view of the ICO that TikTok breached UK data protection laws between May 2018 and July 2020 on the basis that they may have:

• Processed the data of children under the age of 13 without appropriate parental consent;
• Failed to provide proper information to its users in a concise, transparent, and easily understandable way; and
• Processed special category data, including ethnic and racial origin, political opinions, religious beliefs, and sexual orientation, without the legal grounds to do so.

A spokesperson from the TikTok group confirmed that they will be making representations in response to the notice, however, they disagree with the preliminary views of the ICO.

This statement should act as a reminder for all businesses that use personal data relating to children (being any person under the age of 18) to ensure that such processing complies with the Age Appropriate Design Code.

If you need advice on how to ensure that your systems are compliant with UK data protection laws, please do not hesitate to contact one of our data protection specialists on 0161 832 3434.