UK ICO Data Protection Brief

Headline

ICO issues enforcement notice and £12.7 million fine against social media platform for systematic failures in children's data protection under the Age Appropriate Design Code

Executive Summary

The Information Commissioner's Office has issued an enforcement notice and monetary penalty of £12.7 million against a social media platform for systematic violations of the UK GDPR and the Children's Code (Age Appropriate Design Code), arising from the platform's failure to implement age verification mechanisms, default high-privacy settings for child users, and data minimization practices for users identified as likely under 18. The enforcement action follows a two-year investigation initiated by the ICO's Children's Code monitoring program and represents the largest fine issued under the Children's Code framework since its implementation in September 2021.

Key Regulatory Signals

• Children's Code Enforcement Escalation: The £12.7 million penalty establishes a new enforcement ceiling for Children's Code violations and signals the ICO's willingness to impose significant financial sanctions for failures in children's data protection, moving beyond the advisory and compliance notice approach that characterized the Code's initial enforcement period.
• Age Verification Compliance Standard: The enforcement notice's detailed findings on age verification failures establish practical compliance benchmarks for all online services likely to be accessed by children, requiring implementation of effective age assurance mechanisms that go beyond self-declaration and incorporate technology-based verification.
• Default Settings Obligation: The ICO's finding that the platform failed to implement default high-privacy settings for child users reinforces the Children's Code's Standard 3 requirement and creates an enforcement precedent that applies to all information society services likely to be accessed by children in the UK.
• Cross-Sector Application: While this action targets a social media platform, the Children's Code applies to all information society services likely to be accessed by children, including gaming platforms, educational technology, streaming services, and connected toys, all of which should assess compliance against the standards articulated in this enforcement notice.
• International Regulatory Convergence: The enforcement action aligns with parallel children's online safety enforcement in the EU under the Digital Services Act and in the United States under COPPA and the proposed Kids Online Safety Act, indicating transatlantic convergence in children's data protection enforcement priorities.

Regulatory Delta

The ICO's Age Appropriate Design Code came into force on 2 September 2021 following a 12-month transition period, establishing 15 standards of age-appropriate design for online services likely to be accessed by children. The ICO's initial enforcement approach focused on compliance monitoring and advisory engagement, with the Commissioner publicly stating a preference for bringing services into compliance through collaboration rather than punitive action. The current enforcement notice and monetary penalty represents a material shift toward punitive enforcement, triggered by the platform's failure to implement recommended changes following the ICO's initial compliance engagement in 2024. The fine calculation methodology follows the UK GDPR Article 83 criteria and represents approximately 0.8% of the platform's global turnover, well below the statutory maximum of 4% but significantly above prior ICO fines for non-children's data protection violations.

Materiality Classification

High — Largest ICO enforcement action under the Children's Code establishing punitive enforcement precedent with direct compliance implications for all information society services likely to be accessed by children in the UK.

Time Horizon

Immediate — Enforcement notice is effective upon issuance; the platform must implement required changes within 90 days; all ISS providers should assess Children's Code compliance against the standards articulated in this notice.

Intelligence Outlook

Monitor the ICO for additional Children's Code enforcement actions signaled by the Commissioner's 2026-2027 regulatory priorities. Track the DSIT for updates to the Online Safety Act's interaction with the Children's Code framework. Assess the ICO's age assurance guidance for updated technical standards.