A regulator's own fine notice explains why the number changed

The test

On 4 April 2023 the UK's Information Commissioner's Office (ICO) announced a £12.7 million fine against TikTok, covering conduct the regulator says ran from May 2018 to July 2020. The ICO's own account states TikTok let children under 13 use the platform without parental consent, failed to check adequately who was using it, and did not give users clear enough information about how their data was collected and shared. The underlying monetary penalty notice is the ICO's formal enforcement instrument setting out these findings and the fine.

What the evidence says

The regulator's own announcement is explicit that the fine changed size during the process: the ICO's original notice of intent proposed a £27 million penalty, and the final £12.7 million figure followed the ICO's decision not to pursue a provisional finding about unlawful use of special category data after considering TikTok's representations. That detail matters for how the number should be read: a headline fine is the outcome of a negotiated regulatory process, not a fixed tariff attached mechanically to the underlying conduct. The ICO's account also states that an internal TikTok concern about under-13 users had been raised with senior employees, which the regulator says was not adequately acted on; that is the ICO's characterisation of TikTok's internal records, not a TikTok admission contained in the same document.

The sample and the variance

The ICO's own figure for scale is stated as an estimate, 'up to 1.4 million' UK under-13 users on TikTok in 2020, which the regulator frames as its own estimate rather than a count TikTok itself disclosed in the notice. The finding period, May 2018 to July 2020, predates TikTok's current age-assurance systems, which this notice does not describe or evaluate. The fine is a UK regulatory penalty under UK GDPR and the Data Protection Act 2018; it makes no finding about TikTok's conduct in other jurisdictions.

What to try next

A platform observer comparing UK, Irish and US children's-privacy enforcement should note that each regulator's document defines its own review period and legal basis, so fines and violation counts are not directly additive across cases. This is an editorial comparison point, not one the ICO's notice itself draws.

• What specific age-assurance measures has TikTok published since 2020, and do they address the failures named in this notice?
• Why did the ICO decide the special-category-data finding could not be sustained after TikTok's representations?
• How does the ICO's 1.4 million estimate compare methodologically with a platform-disclosed active-user figure for the same period?

A monetary penalty notice records a regulator's finding for a bounded period under a specific law; it is a precise document about a narrow window, not a general verdict on a platform's ongoing practice.