Investigation into TikTok’s compliance with duties to protect children from encountering harmful content under section 12

Background

Part 3 of the Online Safety Act (the ‘Act’) imposes duties on providers of regulated user-to-user services that are likely to be accessed by children to protect children from harmful content. In particular, under section 12 of the Act, such providers must comply with the following duties:

• the duty under section 12(3)(a) to use proportionate systems and processes designed to prevent children of any age from encountering primary priority content that is harmful to children;
• the duty under section 12(3)(b) to use proportionate systems and processes designed to protect children in age groups judged to be at risk of harm from other content that is harmful to children (or from a particular kind of such content) from encountering it by means of the service; and
• the duty under sections 12(4) and (6) to meet the duty set out in section 12(3)(a) by using age assurance that is highly effective at correctly determining whether or not a particular user is a child to prevent children from encountering primary priority content which the provider identifies on the service (this duty applies except, under section 12(5), where a provider’s terms of service indicate primary priority content is prohibited and this applies to all users of the service).

These duties came into effect on 25 July 2025.

To comply with these duties, providers may choose to take the measures recommended in Ofcom’s Protection of Children Codes of Practice for user-to-user services or adopt effective alternative measures. Where alternative measures are used, providers must ensure that those measures are capable of meeting the relevant duties under the Act.

Investigation

Ofcom has today opened an investigation into TikTok Information Technologies UK Limited (‘TikTok’) to examine its compliance with its duties under the Act. The investigation follows Ofcom’s review of the steps taken by major platforms to protect children online and the publication of our Children’s online experiences report, which highlighted concerns about children being exposed to harmful content on TikTok. In addition, the Age Assurance report, published today, suggests that in some cases age inference models, such as those used by TikTok, may have failed to correctly identify a significant proportion of children, putting them at risk of exposure to harmful content.

In light of these concerns, this investigation will seek to establish whether there are reasonable grounds to believe that TikTok has failed, or is failing, to comply with its legal obligations as set out above, including by using age assurance that is highly effective at correctly determining whether or not a particular user is a child.

The opening of an investigation does not mean that Ofcom has reached any conclusion about whether the provider has breached its duties. However, where we identify compliance failures, we can impose fines of up to £18m or 10% of qualifying worldwide revenue (whichever is greater). In the most serious cases of non-compliance, and where appropriate given risks of harm to individuals in the UK, we can seek a court order to require third parties to take action to disrupt the business of the provider. This may require third parties (such as providers of payment or advertising services, or Internet Service Providers) to withdraw services from, or block access to, a regulated service in the UK.

Ofcom’s Online Safety Enforcement Guidance sets out how Ofcom will normally approach enforcement under the Act. This includes our approach to information gathering and analysis and the procedural steps we must take to fairly determine the outcome of the investigation. Our first step will be to use our formal powers to gather and analyse evidence to determine whether a breach has occurred. This is likely to take at least three months.

We will provide an update on this investigation in October 2026.