The UK's ICO could fine TikTok £27M after provisionally finding that the company breached data protection rules around children's data
ByteDance Ltd.'s TikTok faces a possible fine of 27 million pounds ($28.9 million) after the UK's privacy watchdog provisionally found the company …
Context & Ripple Effects
The ICO's action follows a UK investigation into TikTok's youth-data practices that began in 2019. It marks the point at which that scrutiny moved from investigation to a proposed financial penalty.
The proposal also became a reference point for later enforcement: the ICO ultimately issued a £12.7M fine for failures involving children's data, while Ireland's DPC later imposed a separate €345M GDPR penalty over TikTok's handling of children's data.
First-order effects
- TikTok faces a £27M provisional penalty and must contest the ICO's findings or change the practices the regulator says failed to protect children's data.
- The ICO establishes children's data protection as the immediate compliance issue for TikTok's UK operation, rather than a closed 2019 investigation.
Second-order effects
- The proposed amount sets a UK enforcement benchmark for TikTok that is later recalibrated by the ICO's £12.7M final fine, making the regulator's findings—not the initial headline figure—the durable compliance risk.
- Separate Irish action shows TikTok must manage children's-data scrutiny across European regulators, with each authority able to pursue its own GDPR case.
Third-order effects
- If UK and Irish enforcement continues to converge on minors' data handling, large social platforms will face a more fragmented European compliance model in which child protections are tested regulator by regulator.
- The sequence points toward privacy enforcement treating youth safeguards as an operational product requirement, with penalties and remediation reinforcing each other.
The trend: European privacy regulators are escalating scrutiny of how major social platforms handle children's data, turning youth protections into a recurring cross-border compliance burden.