TikTok is facing the prospect of a £27m fine for failing to protect the privacy of children, the UK’s data watchdog has said. An investigation conducted by the Information Commissioner’s Office (ICO) found the video-sharing app may have breached data protection law between May 2018 and July 2020. The ICO issued TikTok with a “notice of intent”, a precursor to handing down a potential fine, which could be up to £27m. If TikTok were to be fined this amount it would be the largest in the ICO’s history, exceeding the record £20m handed to British Airways two years ago after an incident in 2018 that saw the personal details of more than 400,000 customers compromised by hackers. The maximum fine the ICO can impose would be based on a calculation of 4% of TikTok’s global annual turnover. The regulator’s “provisional view” is that TikTok may have processed the data of children under the age of 13 without parental consent, and failed to provide proper information to its users in a “concise, transparent and easily understood way”. The ICO also said TikTok may have processed special category data – which includes ethnic and racial origin, political opinions, religious beliefs, sexual orientation, trade union membership and genetic, biometric or health data – without legal grounds to do so. The information commissioner, John Edwards, said: “We all want children to be able to learn and experience the digital world, but with proper data privacy protections. “Companies providing digital services have a legal duty to put those protections in place but our provisional view is that TikTok fell short of meeting that requirement.” The ICO said it had not reached a conclusion as to whether there had been a breach of data protection law, or if a financial penalty would be imposed. “We will carefully consider any representations from TikTok before taking a final decision,” the ICO said. TikTok said it disagreed with the ICO’s provisional findings and would make a formal response challenging the findings of the investigation. “This notice of intent, covering the period May 2018 – July 2020, is provisional and as the ICO itself has stated, no final conclusions can be drawn at this time,” said a spokesperson for the company. “While we respect the ICO’s role in safeguarding privacy in the UK, we disagree with the preliminary views expressed and intend to formally respond to the ICO in due course.” In July, an Australian-US cybersecurity firm published a report that found TikTok collected “excessive” amounts of information from its users. Edwards, who began his five-year term as commissioner in January, said the ICO was also looking at more than 50 other online services to see if they were complying with data laws relating to children. He said the ICO had several ongoing investigations. “I’ve been clear that our work to better protect children online involves working with organisations but will also involve enforcement action where necessary,” he said. “We are currently looking into how over 50 different online services are conforming with the children’s code and have six ongoing investigations looking into companies providing digital services who have not, in our initial view, taken their responsibilities around child safety seriously enough.” The Instagram owner, Meta, was fined €405m (£349m) by the Irish data watchdog this month for letting teenagers set up accounts that publicly displayed their phone numbers and email addresses. In May, the ICO fined the facial recognition company Clearview AI £7.5m – the third largest it has imposed – for collecting images of people from social media platforms and the web to add to a global database. The ICO ordered the US-based firm to delete the data of UK people from its systems. The company has collected more than 20bn images of people’s faces from Facebook, other social media companies and from scouring the web.