The ICO has issued the fine following a number of breaches of data protection law, including failing to use children’s personal data lawfully.

“There are laws in place to make sure our children are as safe in the digital world as they are in the physical world,” John Edwards, UK Information Commissioner said. “TikTok did not abide by those laws.”

About 1.4m UK children under 13 were allowed to use the platform in 2020, despite its own rules of not allowing children aged 12 or below to create an account.

UK data protection law says that organisations that use personal data when offering information society services to children under 13 must have consent from their parents of carers.

TikTok failed to do this, and the ICO says the company “ought to have been aware that under 13s were using its platform.”

TikTok also failed to carry out adequate checks to identify and remove underage children from its platform.

The ICO investigation found that a concern was raised internally with some senior employees about children under 13 using the platform and not being removed – the ICO found TikTok did not respond adequately.

“As a consequence, an estimated one million under 13s were inappropriately granted access to the platform, with TikTok collecting and using their personal data. That means that their data may have been used to track them and profile them, potentially delivering harmful, inappropriate content at their very next scroll,” Edwards commented.

Recommended

• Scot-Secure 2023 | Delivering Impactful Cybersecurity Workshops
• National Cyber Force Outlines Security Operations
• Scots Firm Lands £2.2m to Help Fund Rehabilitative Robotic Glove

In the ICO’s findings, TikTok breached UK General Data Protection Regulation (UK GDPR) between May 2018 and July 2020 by providing services to children under the age of 13 and processing their data without consent or authorisation from parents or carers.

Further, the company failed to provide proper information to people using the platform about how their data is collected, used, or shared in an understandable way. The ICO says this prevented users from making informed decisions on their engagement with the service.

Overall, the ICO said that TikTok failed “to ensure that the personal data belonging to its UK users was processed lawfully, fairly and in a transparent manner.”

Previously, the ICO planned to fine TikTok for £27m, but upon taking into consideration the representations from TikTok, they decided to reduce the fine and not pursue any findings regarding the use of special category data. Special category data includes: ethnic and racial origin, political opinions, religions beliefs, sexual orientation, trade union membership, genetic and biometric data or health data.

It was after the ICO’s investigation of TikTok, the regulator has published the Children’s code to help protect children in the digital world, aimed at online services that are likely accessed by children.

“TikTok should have known better. TikTok should have done better. Our £12.7m fine reflects the serious impact their failures may have had. They did not do enough to check who was using their platform or take sufficient action to remove the underage children that were using their platform,” Edwards concluded.