TikTok has dropped its appeal and will pay a £12.7m fine to the UK’s Information Commissioner’s Office, ending a challenge to a ruling first issued in 2023. The ICO found that TikTok’s failure to enforce its own minimum user age of 13 resulted in up to 1.75 million UK children under 13 using the service in 2020, and that the company had done “very little, if anything” to address it. TikTok says it disagrees with the ruling but paid because the findings relate to the 2018–2020 period, before it introduced “many youth safety measures and policies”.
The instinct for most UK businesses is that this is a story about a very large social network and therefore about somebody else. Two details make that reading a mistake. The first is that only one of the ICO’s three findings was about age enforcement at all. The regulator also found that TikTok failed to give users proper information about how their data was collected and used, and neglected to obtain parental consent — failures that have nothing to do with the size of a platform and everything to do with whether an organisation has thought about who is actually using its service. The second is timing: age–checking measures will be central to the UK government’s new under–16 social media age limit, due to come into force next year, and Ofcom has already said “more action from the tech industry is needed” on enforcing age limits ahead of it. A fine for conduct in 2020 is being paid in the month before the regulatory standard tightens again.
What the ICO actually found
The headline is the age failure, and it is stark. TikTok set its own minimum user age at 13, and the ICO concluded that the company did “very little, if anything” to stop children below that age using the service — with the consequence that up to 1.75 million UK under–13s were on the platform during 2020. The phrasing matters: this was not a finding that the company failed to meet an externally imposed standard it disputed. It was a finding that it did not enforce its own.
The two further findings are the ones UK businesses should read most carefully, because they are portable. The ICO found that TikTok failed to give users proper information about how their data was collected and used, and that it neglected to obtain parental consent. Neither of those requires a recommendation algorithm or a hundred million users to get wrong. They are questions about transparency and lawful basis that apply to any organisation processing children’s personal data — a tutoring business, a sports club booking system, a children’s clothing retailer, a school portal, a family attraction selling tickets online.
Emily Keaney, the ICO’s deputy commissioner, framed the case in terms that are deliberately general rather than platform–specific: it shows “how important it is for companies to have the right protections in place, including to prevent access by children who are not old enough to be using their services.” Read that sentence as a regulator describing an expectation of companies plural, not of one company, because that is evidently how it was intended.
TikTok’s position is worth stating fairly. The company says it disagrees with the ruling, and paid because the findings concern 2018–2020 — a period before it introduced what it describes as “many youth safety measures and policies”. That is a reasonable thing to say and quite possibly accurate: six years is a long time in this area, and platforms have changed substantially. It does not alter the finding, but it does mean this is a judgement about historical conduct rather than a statement about the platform as it operates today.
The development that has attracted least attention may prove the most consequential. TikTok has also withdrawn a separate appeal against an ICO request for information about how its recommendation algorithm processes teenagers’ personal data and serves them content. That investigation will now resume. A regulator examining how a recommender system uses minors’ data is a materially different and broader inquiry than one about age gates, and its eventual findings are likely to shape expectations for any business that personalises content or product recommendations for younger users.
The most common reason a UK business concludes this is not its problem is that its service is not designed for children. That is the wrong test. The ICO’s children’s code — the Age Appropriate Design Code, a statutory code of practice — applies to information society services likely to be accessed by children, which is a substantially wider category than services aimed at them. A general–audience e–commerce site, a booking platform, a community forum, a gaming–adjacent site, a fan site, a streaming service: any of these can be likely to be accessed by under–18s regardless of intent, and a terms–and–conditions clause saying the service is for adults does not settle the question. We would not attempt to tell any specific business where it falls — that needs proper advice on your own facts. But if nobody in your organisation has ever asked whether children use your service, then you have not answered the question. You have assumed an answer, which is precisely the position the ICO described as doing “very little, if anything”.
Six years from the conduct to the cheque
The chronology is worth laying out because it demonstrates something businesses consistently underestimate: how long the tail is between a data protection failure and its consequence, and how much the standard can move in the interval.
The six–year gap between the conduct and the payment is the part worth internalising. A business improving its practices today is not thereby insulated from how it behaved in 2024, because data protection enforcement examines the period in which the processing occurred. That is an argument for documenting when you introduced a control as carefully as you document the control itself — TikTok’s own defence rests precisely on being able to say that its youth safety measures postdate the period under examination.
How much assurance different age checks actually provide
“Age verification” covers methods that differ enormously in strength, and conflating them is how businesses end up with a control that exists on paper only. The chart below is an indicative planning model — not measured data — ranking approaches by how much assurance they realistically deliver.
The bottom two rows are what most UK websites actually have, and the distance between them and everything else is the substance of the ICO’s criticism. A self–declared date of birth is not an age check; it is a record of what someone typed. It has genuine value as evidence that you asked, and as a basis for acting on what you were told, but as a barrier it stops only children who choose to be stopped. “Very little, if anything” is, uncomfortably, a fair description of a signup form with a date field and nothing behind it.
The top rows carry costs that deserve honest statement rather than enthusiasm. Stronger age assurance means collecting more personal data — a face image, an identity document, a payment instrument — about people including children, which is itself a data protection risk and can sit awkwardly against data minimisation. This is the genuine tension in the policy area, and it is why the certified digital identity route is interesting: a certified provider returns an assertion that someone is over a threshold without handing the underlying document to the business relying on it. We covered that model when digital ID became acceptable for alcohol sales in England and Wales, and the architecture translates directly to online age assurance.
The two findings nobody is talking about
Coverage of this case has concentrated almost entirely on the age gate, which is understandable and slightly misleading. Count the ICO’s findings and sort them by what they require of an organisation.
This is the reframe that makes the case relevant to a forty–person business. Building robust age assurance is a genuine engineering and cost problem, and a small organisation could reasonably conclude that industrial–grade age checking is beyond it for now. Neither of the other two findings is like that. Explaining clearly, in language a child could follow, what data you collect and what you do with it is a writing task. Establishing whether you need parental consent for the processing you are doing, and obtaining it where you do, is a process design task. Both are achievable by any business that decides to do them, and both were part of what the £12.7m covered.
The consent point in particular is where general–audience businesses are most often quietly exposed. If children use your service and you are relying on consent as your lawful basis — for marketing, for analytics and profiling, for cookies beyond the strictly necessary — then the question of whether a child can validly give that consent, and at what age, is a real one with real answers under UK data protection law. A great many websites collect behavioural data from users whose ages they have never considered, on a consent basis that was designed with adults in mind. That is not an exotic compliance risk. It is the ordinary state of a large part of the UK web.
The resuming algorithm investigation extends this further and is worth watching even if you have no recommender system. The ICO is examining how TikTok’s recommendation algorithm processes teenagers’ personal data and serves them content. Whatever expectations emerge from that will be about profiling minors as a general practice — and personalisation, related–product suggestions and behavioural targeting are features of an enormous number of ordinary commercial websites.
The honest counterweight: age gates get circumvented
Any article recommending stronger age assurance should be straight about its limits, and there is now evidence rather than speculation. Australia introduced its own under–16 social media ban in December 2025, and its eSafety commissioner has said that a “substantial proportion” of under–16s have kept existing accounts, created new ones, or bypassed age–gating systems altogether.
That is a preview of the enforcement challenge UK platforms may face, and it should temper expectations in both directions. It means a business implementing age assurance should not promise itself or anyone else that children will be kept out; determined teenagers are, historically and universally, better at circumventing controls than organisations are at building them. But it emphatically does not mean the effort is pointless, and the ICO’s own language shows why. The finding against TikTok was that it did “very little, if anything” — a judgement about effort and mechanism, not about outcome. A regulator assessing a business that implemented proportionate, documented age assurance which some children nonetheless defeated is in a very different position from one assessing a business that never tried.
The practical framing, then, is risk reduction with evidence, not exclusion. Take reasonable steps proportionate to your service and the risk to children using it; document what you did and when you did it; act on the information you hold rather than ignoring it; and review as better methods become available. That is a defensible position even when it does not fully work, which is fortunate, because on Australia’s evidence it will not fully work.
Where UK businesses are exposed on children’s data
The rows below reflect where this typically sits in an organisation that does not think of itself as a children’s service, with badges indicating how much attention each usually needs.
The sixth row is the one that turns a defensible position into an indefensible one, and it is worth dwelling on. Many businesses already hold clear indications that some users are children — a birth year entered at signup, a school email domain, a product mix that only makes sense for a young audience, support tickets written by someone who is plainly thirteen. Holding that information and doing nothing with it is materially worse than not having it, because it removes any argument that the organisation was unaware. “We did not know” is a weak position; “we knew and did not act” is not a position at all.
The seventh row is the cheapest insurance on the list and almost nobody has it. TikTok’s entire public defence is that the findings relate to 2018–2020, before it introduced its youth safety measures. That defence is only available to an organisation that can demonstrate when things changed. A dated log of privacy and safety changes — what was introduced, on what date, and why — costs nothing to maintain and is exactly what lets you confine an inquiry to a historical period rather than an open one.
What acting on this costs
The bands below are indicative planning figures for UK businesses assessing and improving their position on children’s data and age assurance — not quotes, and not a substitute for advice on your own circumstances.
| Business profile | Typical scope | Indicative cost | What you get for it |
|---|---|---|---|
| General–audience site, children not expected | A documented assessment of whether children are likely to access the service, review of analytics and consent practices, dated record of the conclusion | £700 – £2,500 | A written, dated answer to the question the ICO effectively asked TikTok — most likely concluding that current arrangements are proportionate |
| Site or app children plausibly use | Age assurance appropriate to the risk, child–readable privacy information, profiling and marketing reviewed against user age, parental contact route | £2,500 – £12,000 | The two non–age findings in this case addressed directly, which is the cheaper and more portable half of the problem |
| Service with a genuine minimum age requirement | Age assurance implemented with a certified provider or estimation service, signals in existing data acted on, parental consent process, dated change log | £8,000 – £35,000 | A mechanism behind the policy, rather than a minimum age stated in terms with nothing enforcing it |
| Platform in scope of the incoming under–16 limit | All of the above plus design review against the children’s code, documented proportionality reasoning, data protection impact assessment, evidence pack for a regulator | £30,000 – £120,000 | A position built before the requirement lands next year rather than assembled after Ofcom asks |
| Any business, ongoing | A dated log of privacy and safety changes, an annual review of whether the user population has shifted, and a named owner | £0 – £2,500 a year | The ability to say exactly when each protection was introduced — the defence TikTok is relying on, available to anyone who keeps the record |
The first row will apply to most readers, and it is worth being clear that its likely output is reassurance rather than a project. A documented assessment concluding that children are not likely to access your service, with the reasoning recorded and dated, is a legitimate and valuable outcome. The failure mode this case illustrates is not having the wrong answer; it is never having asked the question, and therefore having nothing to show.
Two ways to hold the children’s data question
Reactive posture
What most UK businesses have today
- A minimum age in the terms and conditions, with no mechanism of any kind behind it
- The question of whether children use the service never asked, so the answer is assumed rather than known
- Analytics, profiling and marketing consent configured once, with no reference to user age
- Privacy information written by a lawyer for adults, with no version a child could follow
- Age signals already sitting in the data — birth years, school domains, product mix — collected and ignored
- No record of when any protection was introduced, so every period is equally open to examination
- Position discovered during a complaint, a parental query or a regulator’s letter
Proactive posture
Where Cloudswitched web development takes you
- A documented, dated assessment of whether children are likely to access the service, revisited annually
- Age assurance proportionate to the risk, with a real mechanism rather than a declaration
- Profiling and marketing reviewed against what you know about user age, and restricted where appropriate
- Privacy information a child could actually understand, alongside the full version
- Age signals in existing data acted on, because holding them and ignoring them is the worse position
- A dated change log, so a historical period can be distinguished from current practice
- A clear route for a parent to raise a concern or request deletion, published and monitored
The asymmetry between those columns is mostly documentation, and that is the encouraging part. Only one item on the right — proportionate age assurance — involves meaningful build cost. The rest are an assessment, a rewrite, a configuration review, a log and a published contact route. Set against a £12.7m fine the comparison is absurd, and it is meant to be: the point is not that a small business faces a penalty on that scale, but that the work which would have addressed two of the three findings is work almost any organisation could complete in a month.
Before any spending decision, answer one question with evidence rather than assumption: do children use our service? The data to answer it is usually already in your systems. Look at any birth dates or ages you collect and check the distribution rather than the average. Search your user records for school and college email domains. Look at which products, pages or features attract traffic and ask whether the mix makes sense for an exclusively adult audience. Read a sample of support enquiries with the question in mind — people are often quite obviously young in writing. Check whether your analytics platform reports any age or demographic estimate you have never looked at. Then write down what you found, what you concluded, the date, and who decided. If the conclusion is that children are not likely to access the service, you have a dated, reasoned record and you are finished for the year. If the conclusion is that some do, you now have a scoped problem rather than an unexamined one — and you have the two cheapest fixes available to you immediately: privacy information a child can follow, and a review of what profiling you apply to users you now know may be minors.
Where this fits with the incoming under–16 limit
The regulatory direction is unusually clear for once. The UK government’s under–16 social media age limit is due to come into force next year, with age–checking measures central to it, and Ofcom has already said that “more action from the tech industry is needed” on enforcing age limits ahead of the ban. That is a regulator flagging inadequacy before the requirement exists, which is a reliable signal that the expectation will be applied firmly once it does.
Most UK SMEs will not be in scope of a social media age limit, and it is worth saying so plainly rather than manufacturing urgency. But scope is not the mechanism by which this reaches ordinary businesses. Two other mechanisms are. The first is the children’s code, which already applies to information society services likely to be accessed by children and is not new — this case is an illustration of it being enforced rather than a change in the law. The second is the normalisation of age assurance as an expected feature: once a substantial share of consumer services performs an age check, a business that performs none looks like an outlier to customers, to clients writing supplier questionnaires and to insurers, regardless of whether any rule compels it.
The technical route is also improving in a way that eases the central tension. Stronger age assurance usually means collecting more sensitive data about users including children, which sits badly against data minimisation. The certified digital identity model resolves much of that: a certified provider checks the underlying document and returns only an assertion that the person is above a threshold, so the business relying on it never receives the document, the date of birth or the name. That architecture became acceptable for alcohol sales in England and Wales this month, and the same pattern is the most promising answer for online age assurance — better privacy and better assurance simultaneously, which is rare.
For organisations pursuing Cyber Essentials, the relevant connection is the one this series keeps returning to: enumeration. The scheme forces an organisation to establish what systems and data it actually has, and a children’s data assessment is the same discipline applied to the user population rather than the asset list. Neither prevents a determined teenager from lying about their birthday. Both mean that when someone asks what you knew and what you did about it, you have an answer with a date on it.
The story at a glance
| Item | Detail |
|---|---|
| What happened | TikTok dropped its appeal and will pay a £12.7m fine to the UK’s ICO, reported 24 September 2026 |
| Original ruling | Issued in 2023, covering conduct in the 2018–2020 period |
| Central finding | Failure to enforce a minimum user age of 13 resulted in up to 1.75 million UK children under 13 using the service in 2020 |
| The ICO’s characterisation | TikTok did “very little, if anything” to address underage use |
| Second finding | Failed to give users proper information about how their data was collected and used |
| Third finding | Neglected to obtain parental consent |
| Why that matters | Two of the three findings have nothing to do with age gating and apply to any organisation processing children’s data |
| ICO quote | Deputy commissioner Emily Keaney: the case shows “how important it is for companies to have the right protections in place, including to prevent access by children who are not old enough to be using their services” |
| TikTok’s position | It disagrees with the ruling but paid because the findings predate the introduction of “many youth safety measures and policies” |
| The second appeal | TikTok also withdrew its appeal against an ICO information request about how its recommendation algorithm processes teenagers’ data and serves them content — that investigation resumes |
| What is coming | The UK’s under–16 social media age limit is due in force next year, with age–checking central to it |
| Ofcom’s view | “More action from the tech industry is needed” on enforcing age limits ahead of the ban |
| The Australian evidence | After its under–16 ban took effect in December 2025, the eSafety commissioner reported a “substantial proportion” of under–16s kept accounts, made new ones, or bypassed age gating |
| What that implies | Age assurance is risk reduction with evidence, not exclusion — but the ICO’s finding was about effort and mechanism, not about perfect outcomes |
| The wider legal hook | The ICO’s children’s code applies to services likely to be accessed by children — a much lower bar than services aimed at them |
| Free first step | Establish from your own data whether children use your service, then write down the finding, the conclusion, the date and who decided |
This story connects to several we have covered recently, and the thread is regulators converging on a single idea: that stating a protection is not the same as having one. Ofcom’s AI ground rules for telecoms providers is the closest parallel published this week — a regulator setting a short, testable expectation and saying it will act if evidence of harm accumulates. The Citizens Advice research on chatbots blocking access to human support is the same pattern seen from the consumer side. The Kiteworks shutdown warning makes the case for knowing what personal data your systems actually hold, which is the prerequisite for every judgement in this article. Ofcom’s investigations into VoIP number misuse turn on the same “know your customer” principle applied to a different industry. And Vodafone’s copper switch–off is a reminder that deadlines announced well in advance are still missed by organisations that treat them as someone else’s problem.
Do you know whether children use your website?
Cloudswitched builds and maintains websites, web applications and e–commerce platforms for UK businesses — including the parts that only surface when a regulator asks: whether children are likely to access your service, what age assurance is proportionate, how profiling and analytics treat users whose ages you have never considered, and whether your privacy information is intelligible to anyone under eighteen. For most organisations the honest outcome is a short, dated assessment confirming current arrangements are appropriate. The value is in having asked.
Talk to us about Web DevelopmentFrequently asked questions
The finding was about effort, not perfection
“Very little, if anything” is a judgement about what an organisation did, not about whether it succeeded — which means a proportionate, documented, dated effort is a genuinely defensible position even when some users defeat it. Cloudswitched helps UK businesses get there: assessing whether children are likely to access your service, implementing age assurance that fits the actual risk, reviewing how analytics and profiling treat users whose ages nobody had considered, and writing privacy information that a fourteen–year–old could follow.
Talk to us about Web Development
CloudSwitched
London-based managed IT services provider offering support, cloud solutions and cybersecurity for SMEs.
