TikTok tribunal ruling establishes boundaries for special purposes data processing exemption

The First-tier Tribunal (General Regulatory Chamber) delivered a significant judgement on 25 July 2025 in TikTok Inc & Anor v Information Commissioner, clarifying the scope of "special purposes" exemptions under data protection legislation. The ruling addresses fundamental questions about when commercial platforms can claim artistic expression protections whilst processing children's personal data.

The Information Commissioner issued a £12.7 million Monetary Penalty Notice (MPN) against TikTok following findings that the platform processed personal data of children under 13 without appropriate parental consent, contrary to UK GDPR requirements and the Data Protection Act 2018. The substantial penalty reflects the seriousness with which regulators view children's data protection breaches.

TikTok mounted its defence on sections 155 and 156 of the DPA 2018, arguing that penalties could not be imposed where processing occurred "for special purposes." The platform contended that its data processing activities aligned with artistic expression—one of the recognised special purposes—positioning itself as a platform designed primarily for creative and expressive content.

The tribunal rejected this characterisation, establishing crucial precedent regarding the boundaries of special purposes exemptions. Whilst acknowledging that TikTok facilitates user creativity, the tribunal distinguished between the platform's promotional messaging and its actual data processing activities. The judgement emphasised that commercial operations, particularly targeted advertising mechanisms, remain fundamentally profit-driven rather than artistic in nature.

Central to the tribunal's reasoning was the recognition that platforms cannot shelter behind special purposes exemptions merely because they host creative content. The judgement clarifies that the exemption applies to the specific processing activity in question, not to the platform's general character or stated mission. This distinction proves particularly relevant for social media platforms that combine user-generated creative content with sophisticated commercial data processing systems.

The tribunal's analysis focused on the specific processing practices that triggered the MPN—those relating to underage users' data. It determined that these activities served commercial rather than artistic purposes, thereby falling outside special purposes protection. The judgement reinforces that targeted advertising, algorithmic content curation, and user profiling constitute commercial processing regardless of the creative nature of the content being promoted.

Parliament's intent in crafting the DPA 2018 provisions emerges clearly from the tribunal's interpretation. The special purposes exemption was designed to protect legitimate journalistic, academic, and artistic activities, not to provide commercial entities with broad immunity from data protection obligations. The judgement affirms that platforms cannot exploit these exemptions to avoid accountability for processing children's data without proper safeguards.

The ruling carries significant implications for the broader digital economy, particularly platforms that blend creative content with commercial data processing. It establishes that regulatory authorities retain full enforcement powers over commercial processing activities, even within platforms that facilitate artistic expression. The judgement suggests that future special purposes claims will face rigorous scrutiny regarding the specific nature and purpose of the contested processing.

This precedent arrives at a critical juncture for digital platform regulation, as authorities worldwide grapple with balancing innovation, expression, and privacy rights. The tribunal's approach provides a framework for distinguishing between protected expressive activities and commercial data exploitation, particularly where children's rights are concerned.

The case proceeds to examine the specific violations alleged in the MPN, with this judgement establishing the tribunal's jurisdiction and the applicable legal framework. The outcome reinforces the principle that platforms serving children bear heightened responsibilities for data processing compliance, regardless of their creative or expressive functions.