The UK’s data protection authority warned social media company TikTok it could be slapped with a £27 million fine after a provisional investigation raised concerns about protection of children’s privacy on its platform.

In a statement, the Information Commissioner’s Office (ICO) indicated it had issued the social media player’s local arm with a notice of intent, a legal document which details suspicions of wrongdoing and precedes any fine.

Accusations surround the company’s activities between May 2018 and July 2020, with the ICO provisionally taking the view data protection laws were broken.

TikTok is suspected of processing data of under 13s without parental consent; failing to provide “proper information” to users in a transparent and concise way; and processing so-called special category data without legal grounds to do so.

Data defined as special category includes ethnic origin, sexual orientation, health data, union affiliations or political opinions.

“We all want children to be able to learn and experience the digital world, but with proper data privacy protections. Companies providing digital services have a legal duty to put those protections in place, but our provisional view is that TikTok fell short of meeting that requirement,” UK information Commissioner John Edwards said.

The authority added it will consider representations from the company before making a final decision and added “no conclusion should be drawn at this stage that there has, in fact, been any breach of data protection law or that a financial penalty will ultimately be imposed”.