TikTok faces £27m fine over 'failing to protect kid’s privacy', ICO said

TikTok could face a £27m fine after a watchdog investigation found the company may have breached UK data protection law by failing to protect children’s privacy when using the app.

The Information Commissioner’s Office has issued TikTok with a “notice of intent” – a legal document that precedes a potential fine.

It says the regulator provisionally believes the hugely popular social media platform breached UK data protection law between May 2018 and July 2020.

The Information Commissioner’s Office (ICO) investigation found the company may have:

processed the data of children under the age of 13 without appropriate parental consent
failed to provide proper information to its users in a concise, transparent and easily understood way
processed special category data, without legal grounds to do so

However, the watchdog said no conclusion should be drawn at this stage, including about whether there has, in fact, been any breach of data protection law or that a financial penalty will ultimately be imposed.

“We all want children to be able to learn and experience the digital world, but with proper data privacy protections,” John Edwards, the information commissioner said.

“Companies providing digital services have a legal duty to put those protections in place, but our provisional view is that TikTok fell short of meeting that requirement.

“I’ve been clear that our work to better protect children online involves working with organisations but will also involve enforcement action where necessary.

“In addition to this, we are currently looking into how over 50 different online services are conforming with the Children’s code and have six ongoing investigations looking into companies providing digital services who haven’t, in our initial view, taken their responsibilities around child safety seriously enough.”

The ICO said it would carefully consider any representations from TikTok before taking a final decision.

TikTok said it disagreed with the ICO’s provisional findings.

A spokesperson said: “This notice of intent, covering the period May 2018 – July 2020, is provisional and as the ICO itself has stated, no final conclusions can be drawn at this time.

“While we respect the ICO’s role in safeguarding privacy in the UK, we disagree with the preliminary views expressed and intend to formally respond to the ICO in due course.”