TikTok could be facing a £27 million fine for an alleged breach of data protection law by failing to protect young users’ privacy.

The Information Commissioner’s Office has issued the Chinese-owned social media company with a notice of intent, a legal document that precedes a potential fine.

It says that between May 2018 and July 2020, TikTok may have processed the data of under-13s without appropriate parental consent; that it had failed to provide proper information to its users in a concise, transparent and easily understandable way; and that it had processed special-category data without the legal grounds to do so.

John Edwards, the information commissioner, said: “We all want children to be able to learn and experience the digital world, but with proper data privacy protections. Companies providing digital services have a legal duty to put those protections in place, but our provisional view is that TikTok fell short of meeting that requirement.

“I’ve been clear that our work to better protect children online involves working with organisations, but will also involve enforcement action where necessary.”

The Children’s Code, introduced a year ago, put in place data protection codes of practice for online services likely to be accessed by children, with financial penalties a possibility for serious breaches.

Edwards added: “We are looking into how over 50 different online services are conforming with the Children’s Code and have six investigations looking into companies providing digital services who haven’t, in our initial view, taken their responsibilities around child safety seriously enough.”

The commissioner’s office emphasised that its findings on TikTok were provisional and that it would “carefully consider any representations” from the company before taking a final decision.

A spokesman for TikTok said: “This notice of intent, covering the period May 2018 to July 2020, is provisional and, as the ICO itself has stated, no final conclusions can be drawn at this time. While we respect the ICO’s role in safeguarding privacy in the UK, we disagree with the preliminary views expressed and intend to formally respond in due course.”

Baroness Kidron, of the 5Rights Foundation, which campaigns to protect youngsters’ data, and an architect of the Children’s Code, welcomed the authority’s intervention. “This is clear proof that tech can be held accountable for the safety and privacy of children,” she said.

Last week it was reported that TikTok’s popularity with young people had helped its advertising revenues to rise by more than 50 per cent in the first half of the year, compared with a 20 per cent increase at Meta, Facebook’s American parent company.