TikTok Inc & Anor v The Information Commissioner

A penalty notice falls within the special-purposes safeguards only where at least one purpose of the relevant processing itself is journalistic, academic, artistic or literary. Facilitating or being associated with the dissemination of material that has those characteristics is not enough. For automated processing, purpose is assessed by reference to what the system is capable of doing and programmed to do. The safeguards need not apply merely because a platform carries material protected by freedom of expression. Information duties under Articles 12 and 13 of the UK General Data Protection Regulation arise in the context of data processing but do not themselves regulate that processing.

During the relevant period, TikTok operated an online video-sharing service. Users could create and share short videos, while TikTok used personal data to recommend content and deliver targeted advertising. Children under 13 used the service despite its age gate.

The Information Commissioner issued TikTok a £12.7 million monetary penalty notice for breaches of the UK General Data Protection Regulation, including breaches concerning children’s consent and transparency. TikTok appealed to the First-tier Tribunal, arguing that the notice concerned processing for artistic purposes and that the safeguards in section 156 of the Data Protection Act 2018 had not been met. The First-tier Tribunal dismissed that preliminary challenge on 27 June 2025, amending its decision on 25 July 2025. TikTok appealed on the meaning of “for the special purposes”, the effect of human rights obligations and the scope of the notice. The central issues were whether the notice concerned processing for a special purpose and whether it covered processing beyond that relating to underage children.

1. Appeal dismissed. The First-tier Tribunal’s decision on the preliminary issue was confirmed. The notice was not made with respect to processing for the special purposes under sections 156 and 174 of the Data Protection Act 2018. The case was remitted to the First-tier Tribunal to determine the substantive appeal.

2. Section 156 turns on the purpose of the particular processing, not the identity of the controller or the nature of the material that the processing may help disseminate. Processing may have more than one purpose; it is enough that one is a special purpose. But mere facilitation of, or association with, special-purpose material is insufficient. The NT1 and NT2 v Google LLC (Information Commissioner intervening) [2019] QB 344 concerned a materially different statutory test, while the proximity approach in BBC v Sugar (No 2) [2012] 1 WLR 439 did not assist under section 156. The Tribunal applied the textual caution in Moyna v Secretary of State for Work and Pensions [2003] UKHL 44 against adding or substituting words Parliament had not used.

   For automated processing, intention is assessed by what the system can do and is programmed to do. TikTok’s recommender system distributed content according to predicted user engagement, without identifying or acting on artistic characteristics. Its processing was therefore not for an artistic purpose, even when it distributed artistic content. The Tribunal did not need to decide what counts as art. TikTok also did not intend under-13s to use the service, so its processing of their data was not for the purpose of enabling their expression.

3. Section 3 of the Human Rights Act 1998 did not require an expansive reading of section 156. Freedom of expression is important but not absolute, and the relevant rights included children’s data rights as well as Article 10 rights. The ordinary contextual meaning of the provision did not provide inadequate protection for Convention rights. The Tribunal applied the domestic-law starting point described in Osborn v The Parole Board [2013] UKSC 61.

4. The Tribunal construed the notice objectively, reading it as a whole and in its statutory context. Construction was a question of law for the Upper Tribunal to determine for itself, applying Lambeth LBC v Secretary of State for HCLG [2019] UKSC 33. The notice’s Articles 5(1)(a) and 8 penalties concerned under-13s only. The Commissioner could penalise processing as it related to a subset of data subjects; common processing did not make the data of underage and older users inseparable.

   The Articles 12 and 13 penalties concerned failures to provide information transparently, not processing failings. Those duties arise in the context of processing, and their breach may contribute to a later breach of Article 5(1)(a), but they do not themselves regulate processing. The cited CJEU decisions, Meta Platforms Ireland C-757/22 and Integritetsskyddsmyndigheten v AB Storstockholms Lokaltrafik [2025] C-422/24, did not establish otherwise. Ground 5, concerning partial survival of the notice, was unnecessary to decide.

5. The Tribunal also advised caution before separating preliminary and substantive issues where the evidence overlaps, since doing so may delay resolution. It dismissed the appeal and remitted the case for determination of the outstanding substantive issues.

1. Upper Tribunal (Administrative Appeals Chamber) On 28 July 2026, dismissed the appeal, confirmed the First-tier Tribunal’s decision on the preliminary issue and remitted the case for determination of the substantive appeal: [2026] UKUT 277 (AAC) .
2. First-tier Tribunal (General Regulatory Chamber) On 27 June 2025, amended on 25 July 2025, dismissed TikTok’s preliminary challenge to the Commissioner’s power to issue the notice.