TikTok has been fined £12.7 million by the Information Commissioner’s Office for misusing children’s data.
The ICO estimates that TikTok allowed up to 1.4m UK children under 13 to use its platform in 2020, despite its own rules not allowing children that age to create an account.
UK data protection law says that organisations that use personal data when offering information society services to children under 13 must have consent from their parents or carers.
TikTok failed to do that, even though it ought to have been aware that under 13s were using its platform, the ICO says. It also found that TikTok failed to carry out adequate checks to identify and remove underage children from its platform.
The ICO investigation found that a concern was raised internally with some senior employees about children under 13 using the platform and not being removed. In the ICO’s view TikTok did not respond adequately.
Further breaches of data protection law included failing to provide proper information to people using the platform about how their data is collected, used, and shared in a way that is easy to understand; and failing to ensure that the personal data belonging to its UK users was processed lawfully, fairly and in a transparent manner.
“There are laws in place to make sure our children are as safe in the digital world as they are in the physical world. TikTok did not abide by those laws,” said Information Commissioner John Edwards.
“As a consequence, an estimated one million under 13s were inappropriately granted access to the platform, with TikTok collecting and using their personal data. That means that their data may have been used to track them and profile them, potentially delivering harmful, inappropriate content at their very next scroll.
“TikTok should have known better. TikTok should have done better. Our £12.7m fine reflects the serious impact their failures may have had. They did not do enough to check who was using their platform or take sufficient action to remove the underage children that were using their platform.”
The original ICO notice of intent for TikTok, issued in September 2022, set the fine at £27m.
“Taking into consideration the representations from TikTok, the regulator decided not to pursue the provisional finding related to the unlawful use of special category data,” the ICO said.
“That means this potential infringement was not included in the final amount of the fine set at £12.7m.”
Since the conclusion of the ICO’s investigation of TikTok, the regulator has published the Children’s code to help protect children in the digital world. It is a statutory code of practice aimed at online services, such as apps, gaming platforms and web and social media sites, that are likely to be accessed by children.
The code sets out 15 standards to ensure children have the best possible experience of online services.
A TikTok spokesperson said the platform “is for users aged 13 and over”.
They added: “We invest heavily to help keep under 13s off the platform and our 40,000-strong safety team works around the clock to help keep the platform safe for our community. While we disagree with the ICO’s decision, which relates to May 2018 – July 2020, we are pleased that the fine announced today has been reduced to under half the amount proposed last year.
“We will continue to review the decision and are considering next steps.”
TikTok has a 12+ rating in the App Store and Google Play, which enables parents to use device-level controls to block their children from downloading the app. The company says that while most people understand the importance of being truthful about their age, many do not provide the correct information, which is a challenge many online services face.
It says that it promptly processes any requests from parents or guardians to remove underage accounts; trains its safety moderation team to be alert to signs that an account is being used by an underage child; and that any account it suspects of belonging to an underage person will be suspended.
The BBC and UK government both instructed employees to delete the TikTok app recently over fears that the Chinese government can access its user data.