TikTok could face a fine of up to £27 million ($29.3 million) following a probe by the UK privacy watchdog into how it handles data belonging to children. In its preliminary findings, published Monday, the Information Commissioner's Office said that the company may have breached UK data protection law by failing to protect the privacy of children using its platform.
In a notice of intent sent to TikTok, the ICO said that between May 2018 and July 2020 the company may have processed children's data without parental consent. Further potential failures include not providing clear and transparent information to users, and processing sensitive data illegally.
TikTok is far from the only company under scrutiny for the privacy protections afforded to children. The ICO is looking into how 50 different online services conform with the UK's Children's Code, and has six open investigations into companies it thinks haven't taken their responsibilities seriously enough. The UK's scrutiny of digital companies, including via the ongoing introduction of the Online Safety Bill, are all part of a wider push from countries around the world to step up regulatory efforts to provide children with better protections as they make use of the internet.
"We all want children to be able to learn and experience the digital world, but with proper data privacy protections," said Information Commissioner John Edwards in a statement. "Companies providing digital services have a legal duty to put those protections in place, but our provisional view is that TikTok fell short of meeting that requirement."
A spokesperson for TikTok noted in a statement that the ICO's findings were provisional, meaning no final conclusions can be drawn at this time. "While we respect the ICO's role in safeguarding privacy in the UK, we disagree with the preliminary views expressed and intend to formally respond to the ICO in due course," they said.
The ICO said it would consider any points TikTok had to make before issuing a final decision over whether to go ahead with the fine. "I've been clear that our work to better protect children online involves working with organizations but will also involve enforcement action where necessary," said Edwards.