Ofcom launches investigation into TikTok over ‘age

UK regulator Ofcom has opened an investigation to determine whether social media platform TikTok is in violation of the Online Safety Act in not implementing effective biometric age assurance tools. Per a statement, the investigation into TikTok Information Technologies UK Limited is spurred in part by concerns, highlighted in Ofcom’s recent children’s online experiences report, that kids may be exposed to harmful content on TikTok. “In addition, the Age Assurance report, published today, suggests that in some cases age inference models, such as those used by TikTok, may have failed to correctly identify a significant proportion of children, putting them at risk of exposure to harmful content,” Ofcom says . TikTok system technically profiling, not inference Here, Ofcom indirectly exposes a semantic challenge for regulators. The system it describes as “age inference” is an internal process that guesses a user’s age based on their activity on TikTok. Per a BBC report , it “essentially relies on estimating how old a user is based on how they use the platform, such as the videos they watch or others they interact with.” Or, from TikTok’s own documentation : “We train our safety moderation team to be alert to signs that an account may be used by a child under the age of 13. We also use other information as provided by our users, such as keywords and in-app reports from our community, to help surface potential underage accounts. When our safety team believes that an account may belong to an underage person, the account will be suspended.” This system is what the UK Information Commissioner’s Office classifies as “ profiling ,” and it does not technically qualify as highly effective age assurance (or even age inference ) according to international standards. That’s no surprise, given that both Meta and Google have also tried to frame their algorithmic data monitoring tools as age inference – a convenient way to say to regulators, “look, we’re doing what you want, but our way!” Despite size, TikTok may be easier target than Meta Ofcom’s investigation into TikTok will “seek to establish whether there are reasonable grounds to believe that TikTok has failed, or is failing, to comply with its legal obligations, including by using age assurance that is highly effective at correctly determining whether or not a particular user is a child.” While the regulator specifies that the investigation does not imply guilt on the part of TikTok – and representatives for the company tell the BBC they are “confident that we meet our Online Safety Act obligations and will work with Ofcom to demonstrate it” – it is clearly aware that the would-be age inference systems for age assurance deployed by many Big Social firms are at best a workaround, and at worst another excuse to monitor and collect user data. TikTok may end up being the test case for trying to disqualify such systems from the age assurance discussion . But can Ofcom enforce its own rules? Ofcom says its first steps, which involve gathering information and evidence, will take about three months, and that it will provide an update on the investigation in October 2026. If TikTok is found to be in breach, the regulator has the power to impose fines of up to £18 million (about $24 million) or 10 percent of qualifying worldwide revenue – whichever is greater. According to Business of Apps, in 2025 TikTok generated about $33.6 billion in total revenue. “In the most serious cases of non-compliance,” Ofcom says, “and where appropriate given risks of harm to individuals in the UK, we can seek a court order to require third parties to take action to disrupt the business of the provider.” The same language is laid down with every investigation that Ofcom opens. However, it has become clear that the threat of action is not enough to spur social media platforms to make real change. Ofcom’s major challenge at this stage remains enforcement . At some point, if online safety regulations and age assurance rules are going to stick, the regulator will have to make an example of at least one company. That means following through on threats, actually delivering a bill for $3.3 billion (about £2.4 billion), and being prepared to collect – or disrupting business as promised if conditions are not met.

TikTok system technically profiling, not inferenceHere, Ofcom indirectly exposes a semantic challenge for regulators. The system it describes as “age inference” is an internal process that guesses a user’s age based on their activity on TikTok. Per a BBC report, it “essentially relies on estimating how old a user is based on how they use the platform, such as the videos they watch or others they interact with.

”Or, from TikTok’s own documentation: “We train our safety moderation team to be alert to signs that an account may be used by a child under the age of 13. We also use other information as provided by our users, such as keywords and in-app reports from our community, to help surface potential underage accounts. When our safety team believes that an account may belong to an underage person, the account will be suspended.”

This system is what the UK Information Commissioner’s Office classifies as “profiling,” and it does not technically qualify as highly effective age assurance (or even age inference) according to international standards. That’s no surprise, given that both Meta and Google have also tried to frame their algorithmic data monitoring tools as age inference – a convenient way to say to regulators, “look, we’re doing what you want, but our way!” Despite size, TikTok may be easier target than MetaOfcom’s investigation into TikTok will “seek to establish whether there are reasonable grounds to believe that TikTok has failed, or is failing, to comply with its legal obligations, including by using age assurance that is highly effective at correctly determining whether or not a particular user is a child.”

While the regulator specifies that the investigation does not imply guilt on the part of TikTok – and representatives for the company tell the BBC they are “confident that we meet our Online Safety Act obligations and will work with Ofcom to demonstrate it” – it is clearly aware that the would-be age inference systems for age assurance deployed by many Big Social firms are at best a workaround, and at worst another excuse to monitor and collect user data. TikTok may end up being the test case for trying to disqualify such systems from the age assurance discussion.

But can Ofcom enforce its own rules?Ofcom says its first steps, which involve gathering information and evidence, will take about three months, and that it will provide an update on the investigation in October 2026. If TikTok is found to be in breach, the regulator has the power to impose fines of up to £18 million (about $24 million) or 10 percent of qualifying worldwide revenue – whichever is greater. According to Business of Apps, in 2025 TikTok generated about $33.6 billion in total revenue.

“In the most serious cases of non-compliance,” Ofcom says, “and where appropriate given risks of harm to individuals in the UK, we can seek a court order to require third parties to take action to disrupt the business of the provider. ”The same language is laid down with every investigation that Ofcom opens. However, it has become clear that the threat of action is not enough to spur social media platforms to make real change.

Ofcom’s major challenge at this stage remains enforcement. At some point, if online safety regulations and age assurance rules are going to stick, the regulator will have to make an example of at least one company. That means following through on threats, actually delivering a bill for $3.3 billion (about £2.4 billion), and being prepared to collect – or disrupting business as promised if conditions are not met.