The Information Commissioner’s Office (ICO) has issued the video sharing platform with a ‘notice of intent’ which is a legal document that precedes a potential fine.

It includes the ICO’s provisional view that TikTok “breached UK data protection law between May 2018 and July 2020”.

As part of the investigation, the ICO said TikTok may have processed the data of children under the age of 13 “without appropriate parental consent”  as well as possible failure to provide “proper information” to its users in a concise, transparent, and easily understood way.

Further, the ICO noted it may have “processed special category data”, without the legal grounds to do so.

However, the ICO pointed out that the findings in the notice are provisional, adding that “no conclusion should be drawn at this stage that there has, in fact, been any breach of data protection law or that a financial penalty will ultimately be imposed”.

It added: “We will carefully consider any representations from TikTok before taking a final decision”.

‘Legal duty to put protections in place’

Information commissioner, John Edwards, said: “We all want children to be able to learn and experience the digital world, but with proper data privacy protections. Companies providing digital services have a legal duty to put those protections in place, but our provisional view is that TikTok fell short of meeting that requirement.

“I’ve been clear that our work to better protect children online involves working with organisations but will also involve enforcement action where necessary. In addition to this, we are currently looking into how over 50 different online services are conforming with the children’s code and have six ongoing investigations looking into companies providing digital services who haven’t, in our initial view, taken their responsibilities around child safety seriously enough.”

A TikTok spokesperson, said: “This notice of intent, covering the period May 2018 – July 2020, is provisional and as the ICO itself has stated, no final conclusions can be drawn at this time. While we respect the ICO’s role in safeguarding privacy in the UK, we disagree with the preliminary views expressed and intend to formally respond to the ICO in due course.”

Earlier this year, TikTok launched ‘Stop, Think, Decide & Act’ which means anyone searching for content related to a harmful challenge will not receive any results and will instead be shown an in-app guide featuring these four steps.

It also introduced a tool to let people see exactly how much time they spend on the platform in a single sitting where prompts can be sent to remind people to take regular screen breaks.