Privacy & Cybersecurity Law Blog

On September 26, 2022, the UK Information Commissioner’s Office (“ICO”) confirmed in a statement that it issued TikTok Inc. and TikTok Information Technologies UK Limited (together, “TikTok”) a notice of intent to potentially impose a £27 million fine for failing to protect children’s privacy. This notice of intent follows an investigation by the ICO finding that TikTok may have breached UK data protection law between May 2018 and July 2020 by failing to protect children’s privacy when using the TikTok platform.

Specifically, the ICO investigation found TikTok may have:

• processed the data of children under the age of 13 without obtaining appropriate parental consent;
• failed to provide appropriate information to its users in a concise, transparent and easily understandable manner; and
• processed sensitive personal data without a valid legal basis to do so.

The ICO notes in its statement that such findings are provisional and, at this stage, no conclusion should be drawn that TikTok has in fact breached data protection law and/or that a fine will be imposed on TikTok. Representations by TikTok will be considered by the ICO before any a final decision is made. Children’s privacy is currently a key focus for data protection authorities globally, including the ICO.