Regulator action · 4 April 2023
ICO monetary penalty notice: TikTok Information Technologies UK Ltd
ICO Monetary Penalty Notice, 4 April 2023 · Information Commissioner's Office (UK)
What it means for your code
An age field in your terms is not age assurance; if under-13s realistically use the product you need detection and parental-consent flows.
What happened
The ICO estimated that up to 1.4 million UK children under 13 used TikTok in 2020 despite its own terms, and their data was processed without parental consent.
What was decided
Processing data of children under 13 without parental consent, and failing to take adequate steps to identify and remove underage users, breached UK GDPR.
⚖ GBP 12.7 million monetary penalty
The legal test applied
- Offering an online service to under-13s requires parental consent for processing their data (UK GDPR Art. 8)
- Controllers must take adequate steps to identify and remove underage users
What would have changed the outcome
- Effective age assurance plus a parental-consent flow
Information Commissioner's Office, ICO Monetary Penalty Notice, 4 April 2023, 2023-04-04, licensed under the Open Government Licence. Summary and analysis by Lawpatch. Open Government Licence v3.0 Risk analysis, not legal advice; the law may have moved on since this decision.