ICO says the penalty notice is final after withdrawal of the appeal. Payment completion is not independently verified here.
What happened
The ICO announced on 24 September 2026 that TikTok had withdrawn its appeal against a £12.7 million penalty imposed in 2023. The case concerned unlawful use of children’s information and inadequate information for users. TikTok also withdrew an appeal against an information notice in a separate recommender-systems investigation. That separate investigation can continue; it is not a new finding of wrongdoing in this announcement.
Source: ICO — original source ↗
What it means for your website
For a website owner, the useful lesson is the gap between a rule written in your terms and a rule your product actually enforces. Saying a service is not for young children does not, by itself, establish who uses it. If children are likely to visit or create accounts, review the registration journey and privacy information with an appropriately qualified adviser. Keep decisions about age assurance proportionate to the service and avoid collecting unnecessary identity documents simply to look thorough. A cookie scan cannot establish whether your whole children’s privacy programme is adequate.
Three useful next steps
- Identify whether children are likely to use your service.
- Check that age-related controls work in practice.
- Keep a record of your assessment and specialist advice.
Sources & context
Official sources consulted on 1 October 2026. A regulator’s announcement records its findings at that time; it is not proof of payment or the outcome of every later appeal.
ICO — original sourceOur practical suggestions are GDPRFix commentary. A public website scan cannot establish your full legal position. For advice on a specific obligation or enforcement matter, use a suitably qualified adviser.