TikTok has lost its legal appeal against a £12.7 million fine imposed by the UK's data protection regulator for unlawfully processing the personal data of more than 1.4 million children under the age of 13.

The Information Commissioner's Office (ICO) issued the penalty in April 2023 after finding that the video-sharing platform had breached UK GDPR between May 2018 and June 2020. The Upper Tribunal ruled in the regulator's favour on Wednesday. The breach period predates the UK's Age Appropriate Design Code, which took effect in September 2020 and requires online services to default to high privacy settings for children, but the case underscores how regulators are now enforcing expectations that predate that code under existing GDPR provisions.

The ICO's investigation concluded that TikTok used children's data to track and profile them, potentially exposing underage users to harmful or inappropriate algorithmic content. Under GDPR rules, platforms are required to obtain parental consent before processing the data of children under 13, which TikTok failed to do.

TikTok's "Special Purposes" Defence Rejected

TikTok contested the fine by arguing that it had processed the data lawfully under the GDPR's "special purposes" exemption, which permits the processing of under-13s' data when it serves journalistic, academic, artistic, or literary ends. The company claimed that videos created and shared using its built-in editing tools constituted a form of artistic expression.

The court dismissed this argument, stating that TikTok's claim was "not sufficient" and that the platform had no means of verifying whether the content was genuinely used for artistic purposes.

"In this case are underage children seeking access to the site, and the 'innocent party' is a commercial entity which has made the operational and commercial choice not to require corroboration of users' warranted age with the consequence that large numbers of underage children accessed the platform during the relevant period," the court said.

Ruling "Likely to Be Relevant" to Other Platforms

Joanna Ludlam, partner at Jenner and Block, said the ruling "is likely to be relevant to other platforms advancing similar arguments" and "lands at a moment when regulators are under real pressure to act quickly on children's data, with the Online Safety Act regime now sitting alongside data protection law."

The decision arrives amid escalating regulatory pressure on social media companies over child safety across multiple jurisdictions. The EU's Digital Services Act now requires large platforms to assess and mitigate systemic risks to minors, while Ireland's Data Protection Commission fined TikTok €345 million in September 2023 for children's privacy violations under EU GDPR. Meta and YouTube have also faced scrutiny over age-verification practices on both sides of the Atlantic.

Binnie Goh, general counsel at the ICO, said the Upper Tribunal's decision "sets an important precedent for the application of the special purposes provisions in data protection law."

"We remain committed to ensuring that organisations, particularly those providing online services to children, comply with their data protection obligations," Goh added.

A TikTok spokesperson said the company is "carefully considering this judgment."