The ICO calls its TikTok fine final and credits an Upper Tribunal ruling as an important precedent. Its statement on that ruling says it sent the case back for a hearing that never took place.
Estimated reading time: 7 minutes
In short. On 24 September 2026 the ICO announced that TikTok had withdrawn its appeal of a £12.7m fine first issued in 2023, and a separate appeal against an information notice tied to an ongoing investigation into how TikTok recommends content to 13 to 17 year olds. The regulator credits "an important legal precedent" from an August Upper Tribunal ruling for that outcome. Its own statement on that same ruling says the Tribunal sent the case back to the First-tier Tribunal "for determination of the substantive issues" [2], a hearing on whether TikTok actually broke the law that never took place, because TikTok withdrew instead. The same release repeats a "close to five million child users" impact figure that has, since its last outing, quietly lost the reliability caveat it used to carry. Three documented mistakes: four stars.
TikTok has agreed to stop fighting a fine the Information Commissioner's Office issued more than three years ago. The ICO's press release calling that a win opens by naming the company, the number, and the word "final". What it does not spend much time on is what actually happened in between: a legal argument about "special purposes", an appeal, a two-year wait, and a tribunal decision that settled a technical question without ever reaching the one that mattered.
What the release says
The ICO's 24 September 2026 release is built around two pieces of TikTok's own retreat. First, the original penalty: "We issued a £12.7 million fine to TikTok Information Technologies UK Limited and TikTok Inc (TikTok) in 2023 for numerous breaches of data protection law, including failing to use children's personal data lawfully," estimating "up to 1.75 million UK children under 13 used TikTok in 2020" despite the platform's own age-13 rule [1]. "TikTok appealed the fine but has now dropped its appeal, meaning the penalty notice is final" [1].
Second, a newer and still-open thread: "TikTok has also withdrawn its appeal against our information notice requesting details from the company about how it processes the personal information of 13-17-year-olds in its recommender systems... now the appeal has been dropped it can continue" [1]. The release says that investigation opened "in February 2025 in light of growing concerns about young people being served inappropriate or harmful content" [1], and credits a wider impact: "We estimate that our work to drive improvements to how children's personal data is used has helped protect close to five million child users" [1].
Binding the two threads together is the Upper Tribunal ruling: "It comes after an important legal precedent was set in August when the Upper Tribunal dismissed TikTok's argument that its processing of personal data had been for artistic purposes, which would have meant that we should have obtained prior court approval before issuing the penalty" [1].
The claims, tested
| The release's own words | What the ICO's own record actually shows | Verdict |
|---|---|---|
| "An important legal precedent was set in August when the Upper Tribunal dismissed TikTok's argument that its processing of personal data had been for artistic purposes" [1] | The ICO's own statement on that ruling, issued the same week: "We welcome the Upper Tribunal's decision to dismiss TikTok's appeal and remit the case to the First-tier Tribunal for determination of the substantive issues... We will now continue to defend our original decision before the First-tier Tribunal" [2] | The Tribunal settled a procedural question, whether the "special purposes" rule applied at all. It did not decide whether TikTok's processing actually broke the law [2]. That question went back for a hearing the ICO itself said it would still have to argue, and which never happened, because TikTok withdrew first |
| "We estimate that our work to drive improvements to how children's personal data is used has helped protect close to five million child users" [1] | That figure traces to the Children's code strategy's August 2026 update: "improvements introduced between April 2024 and July 2026 have already affected close to five million child users across several platforms," with no caveat attached [3]. The same running total's December 2025 outing, then "over three million," carried a footnote the newer figure does not: "Measuring the direct impact on this population can be challenging. As children often use more than one platform, the figures do not necessarily represent individual children in the population" [4] | A self-reported, strategy-wide estimate the ICO itself flagged as unreliable at the individual-child level grew by roughly 60% between two updates while that flag was dropped, then was folded wholesale into a release about one company's fine |
| "We opened this investigation in February 2025 in light of growing concerns about young people being served inappropriate or harmful content" [1] | The ICO's own announcement of that investigation is dated 3 March 2025: "We are today announcing three investigations looking into how TikTok, Reddit and Imgur protect the privacy of their child users in the UK" [5] | A minor, directly checkable date error: the regulator's own account of when it opened its own investigation is about a month off from the date on its own announcement page |
Credit where due
The underlying 2023 case was not thin. The ICO pursued TikTok over conduct dating to 2018-2020, reduced its original proposed fine after TikTok's representations, and has now spent over two years defending that finding through an appeal and a Tribunal hearing rather than letting it lapse [6]. The Upper Tribunal statement itself is a model of the kind of plain, same-day regulatory communication this site has praised elsewhere: it is dated, names the case, and states what was decided and what was not, in terms a non-lawyer can follow [2]. And the December 2025 progress update did, at the time, attach a proper caveat to its headline impact figure [4], evidence the ICO knows how to be transparent about the limits of that number when it chooses to be.
The mistakes, counted
A procedural win is presented as the reason the dispute is over, when the dispute itself was never heard (1). The release's own sequencing puts the Upper Tribunal ruling immediately before TikTok's climbdown, as though one caused the other on the merits [1]. The ICO's own statement on that ruling is explicit that the Tribunal remitted the substantive question, whether TikTok's processing actually broke the law, to the First-tier Tribunal, and that the ICO expected to "continue to defend our original decision" there [2]. That hearing never happened.
The headline impact figure dropped its own reliability caveat as it grew (2). "Over three million" in December 2025 carried a footnote explaining why it should not be read as a count of individual children [4]. "Close to five million" in August 2026, and again in September's TikTok release, carries none [3] [1].
The release misdates the ICO's own earlier announcement by about a month (3). "February 2025" in the September release [1] against "3 March 2025" on the ICO's own announcement of the same investigation [5]. Small on its own, but it is the regulator's record of its own prior work, checked against itself.
Verdict
Four stars, from three documented mistakes. None of this means the 2023 fine was wrong, or that TikTok has been cleared of anything: the penalty notice stands, and it is now legally final because TikTok chose not to keep fighting it, which is a real outcome, not a technicality. What is not supported is the release's own framing of why. "An important legal precedent" is true as far as it goes, the special purposes question is now settled for other platforms too, but it is doing more work in the release's narrative than it did in court. The actual question that would have tested the ICO's 2023 findings against TikTok's defence was sent back for a hearing, and that hearing never happened, because the company walked away first. A regulator is entitled to call that a win. It is not entitled to let readers think a tribunal agreed with it on the substance when no tribunal ever reached that question.
Sources
- TikTok withdraws two appeals in children's privacy action and accepts £12.7m fine, ICO, 24 September 2026
- ICO statement on Upper Tribunal decision, ICO, 5 August 2026
- Children's code strategy progress update, August 2026, ICO
- Children's Code Strategy progress update, December 2025, ICO
- Investigations announced into how social media and video sharing platforms use UK children's personal information, ICO, 3 March 2025
- TikTok Information Technologies UK Limited and TikTok Inc (TikTok), ICO enforcement action, 15 May 2023