TikTok Inc & Anor v The Information Commissioner [2026] UKUT 277 (AAC) (28 July 2026)

Executive summary

The Upper Tribunal dismissed TikTok’s appeal on the preliminary vires issue and confirmed that the Information Commissioner’s £12.7 million monetary penalty notice was not issued “with respect to processing of personal data for the special purposes” within the meaning of the Data Protection Act 2018. It held that the relevant processing was not “for” journalistic, academic, artistic or literary purposes, and that the Human Rights Act did not require the additional preconditions TikTok argued were necessary before the notice could lawfully be issued.

Key points

• Parties: TikTok Inc and TikTok Information Technologies UK Ltd v the Information Commissioner
• Holding: appeal dismissed; FtT decision confirmed; MPN not ultra vires
• Reasoning: processing must itself be for special purposes, not merely facilitate or be associated with content that has special-purpose characteristics
• Reasoning: section 3 HRA 1998 did not add extra preconditions to section 156 DPA 2018
• Construction: Articles 5(1)(a) and 8 findings were confined to underage children’s data; Articles 12 and 13 were treated as procedural obligations, not processing
• Outcome: case remitted to the First-tier Tribunal for determination of the substantive appeal

Why it matters

The decision narrows the scope of the DPA 2018 “special purposes” protection and confirms that platforms cannot invoke it simply because their services support dissemination of expressive content. For sanctions and geopolitical-risk audiences, the relevance is indirect but important: it illustrates how UK regulators and tribunals can sustain enforcement against large platforms notwithstanding Article 10 framing, which can affect compliance posture in politically sensitive information environments.

Implications

Compliance teams for platforms and data-driven services should not assume that content-distribution, editorial, or speech-related features automatically trigger the special-purposes regime; the processing purpose itself must fit the statutory category. In litigation, defendants facing UK GDPR penalties will need to build a purpose-specific record early, because arguments based on general expressive context or partial overlap with protected speech were rejected at this preliminary stage.