(1) TikTok Inc (2) TikTok Information Technologies UK Limited v The Information Commissioner: [2026] UKUT 277 (AAC)
Upper Tribunal Administrative Appeals Chamber decision by Lady Poole, Judge Wikeley and Judge Church on 28 July 2026.
Read the full decision in .
Judicial Summary
The Information Commissioner, concerned about TikTok’s processing of the personal data of children under 13 years old, imposed a £12.7 million monetary penalty notice on TikTok for breaches of Articles 5(1)(a), 8, 12 and 13 of the UK General Data Protection Regulation.
TikTok appealed to the First-tier Tribunal, arguing that its processing of personal data had been “for the special purposes”, being journalistic, academic, artistic or literary purposes, and the Information Commissioner was not entitled to issue the monetary penalty notice without first satisfying the preconditions required by section 156 of the Data Protection Act 2018 (issuing a determination under section 174(3) and obtaining leave from a court). The First-tier Tribunal directed a hearing on the preliminary issue of whether the monetary penalty notice was ultra vires. The First-tier Tribunal decided the preliminary issue against TikTok.
TikTok appealed to the Upper Tribunal, which dismissed the appeal on the preliminary issue, finding that:
(i) the processing covered by the monetary penalty notice was not “for” the special purposes. To fall within section 156 of the Data Protection Act 2018 it is not sufficient that the processing facilitates, or is associated with, the dissemination of material that itself has special purposes characteristics. Processing is “for the special purposes” only where the purpose of the relevant processing is itself journalistic, academic, artistic or literary. The preconditions in section 156(1) did not apply, and the notice was not ultra vires;
(ii) the interpretative obligation under section 3 of the Human Rights Act 1998 did not operate such that the additional preconditions had to be satisfied before the monetary penalty notice could be issued lawfully;
(iii) the parts of the monetary penalty notice that concerned breaches of Articles 5(1)(a) and 8 of the UK GDPR were properly construed as being given only with respect to the processing of the data of underage children;
(iv) the parts of the monetary penalty notice that concerned breaches of Articles 12 and 13 were given in relation to breaches of procedural obligations, not processing of personal data;
(v) given those findings, it was not necessary to determine a fifth ground of appeal about whether the monetary penalty notice could be partially upheld.
The case was remitted to the First-tier Tribunal to consider all other outstanding issues.