TikTok (UK): under-13s used the app without parental consent

TikTok’s own rules set a minimum age of 13. The ICO found that between May 2018 and July 2020 many younger children used the app anyway, that TikTok did too little to find and remove them, and that it had no parental consent for their data.

These are ICO findings in the penalty notice. The tribunals ruled on a preliminary legal point, not on these facts, and TikTok then accepted the fine.

• TikTok processed the data of UK children under 13 without consent from a parent or carer (Article 8).
• Its checks to identify and remove under-13 users were not enough.
• It did not give users clear information about how their data was collected, used and shared (Articles 12 and 13).
• The processing was not lawful, fair or transparent (Article 5(1)(a)).
• The notice estimates that 1.1 to 1.4 million UK children under 13 used TikTok in the period. The ICO’s September 2026 announcement says "up to 1.75 million". This page uses the notice figure; Inth has not found an explanation for the difference.

Inth’s technical interpretation: the failure was in account sign-up and moderation, not in website tags. Without a reliable signal of age, the service treated children’s accounts like any others. The tribunal fight was about procedure: TikTok argued the processing was for "special purposes" such as artistic expression, which would have changed how the ICO could act. The First-tier Tribunal and the Upper Tribunal both rejected that argument.

1. 25 May 2018 to 28 July 2020Period covered by the penalty
2. 4 April 2023ICO issues the penalty notice
3. 19 to 21 May 2025First-tier Tribunal hears the preliminary issue
4. 25 July 2025First-tier Tribunal decides against TikTok, [2025] UKFTT 798 (GRC)
5. 11 to 12 May 2026Upper Tribunal hearing
6. 28 July 2026Upper Tribunal dismisses TikTok’s appeal, [2026] UKUT 277 (AAC)
7. 24 September 2026ICO announces TikTok has withdrawn its appeals and accepted the fine

According to the ICO’s September 2026 announcement, TikTok withdrew both appeals and accepted the £12.7 million fine. The penalty is now final.

£12,700,000, plus more than three years of tribunal proceedings.

This is a fully litigated UK children’s privacy fine. It shows that a minimum age in the rules needs working checks behind it, and the tribunal rulings close off one procedural route that content platforms might have used to resist a penalty.

Inth has no capability for age assurance, parental consent or in-app account checks. Code audit, Website audit and the Consent banner do not review who is signing up or how old they are.

The one adjacent point: the Consent banner covers cookie and tag consent on websites, under the regional policy you choose. It does not verify age or collect parental consent.

In the repository

• Find the code path that handles a user reported or detected as under age, and check it removes or restricts the account.

In the app and network

• Create test accounts at ages 12, 13 and 16 and record what each can do and what data is collected.

With the people responsible

• Ask how many under-age accounts were found and removed last quarter, and how.
• Check that the privacy notice explains processing in words a child could follow.

• ICO enforcement record
• ICO penalty notice (PDF)
• [First-tier Tribunal, [2025] UKFTT 798 (GRC) (PDF)](https://www.bailii.org/uk/cases/UKFTT/GRC/2025/798.pdf)
• [Upper Tribunal, [2026] UKUT 277 (AAC)](https://www.gov.uk/administrative-appeals-tribunal-decisions/1-tiktok-inc-2-tiktok-information-technologies-uk-limited-v-the-information-commissioner-2026-ukut-277-aac)
• ICO announcement, September 2026

Source review: 20 October 2026. This page describes the cited records and procedural stage. It does not audit TikTok’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: TikTok (EU), Reddit (UK), Imgur (MediaLab)