Ofcom has launched a formal investigation into TikTok Information Technologies UK Limited, examining whether the platform has breached its legal duties to protect children from harmful content under the Online Safety Act. The move follows a review of major platforms’ child safety measures and the publication of Ofcom’s Children’s Online Experiences report, which raised concerns about children being exposed to harmful material on TikTok.
The investigation centres on whether TikTok’s recommendation algorithms are exposing children to harmful or inappropriate content, in potential breach of duties that came into effect on 25 July 2025 under Part 3 of the Online Safety Act. Under section 12 of the Act, platforms likely to be accessed by children must use proportionate systems to prevent children of any age encountering primary priority harmful content, protect at-risk age groups from other harmful content, and use age assurance that is “highly effective” at correctly identifying whether a user is a child, in order to keep them away from content the platform itself has identified as primary priority harmful content.
What triggered the investigation
Ofcom’s decision to open the investigation follows two pieces of research published by the regulator. Its Children’s Online Experiences report highlighted specific concerns about children being exposed to harmful content on TikTok, while a separate Age Assurance report, published on the same day the investigation was announced, found that age inference models of the kind used by TikTok may in some cases have failed to correctly identify a significant proportion of children using the platform, leaving them at risk of exposure to harmful content.
Ofcom’s own research also found that 73% of children aged 11 to 17 reported encountering harmful content online over a four-week period, a figure the regulator says has shown little improvement since the children’s safety duties came into force. TikTok and YouTube were previously singled out by Ofcom for failing to commit to significant changes aimed at making their content feeds safer for children, unlike several other major platforms that agreed to introduce additional safeguards.
What the investigation will examine
The investigation will seek to establish whether there are reasonable grounds to believe TikTok has failed, or continues to fail, to comply with its obligations under the Act, including its duty to use age assurance capable of correctly determining whether a user is a child. Ofcom has stressed that opening an investigation does not mean it has reached any conclusion about whether TikTok has actually breached its duties. Ofcom has also said TikTok has not provided sufficient evidence that its personalised content feeds are safe for younger users, despite the platform’s own position that its existing safeguards are adequate.
Providers can choose to comply with their duties either by following the measures set out in Ofcom’s Protection of Children Codes of Practice, or by adopting alternative measures, provided those alternatives are capable of meeting the same legal requirements.
What penalties TikTok could face
Where Ofcom identifies compliance failures, it has the power to impose fines of up to £18million or 10% of a company’s qualifying worldwide revenue, whichever figure is greater. In the most serious cases of non-compliance, and where justified by the risk of harm to people in the UK, Ofcom can also seek a court order requiring third parties, such as payment processors, advertising services or internet service providers, to withdraw their services from, or block access to, a non-compliant platform in the UK.
Earlier this year, Ofcom formally required TikTok and other major platforms to demonstrate that they are effectively enforcing minimum age requirements using robust age-assurance measures, a requirement that now sits at the heart of the current investigation.
What happens next
Under Ofcom’s Online Safety Enforcement Guidance, the regulator’s first step will be to use its formal powers to gather and analyse evidence to determine whether a breach has occurred, a process expected to take at least three months. Ofcom has said it will provide an update on the investigation in October 2026.
