The Information Commissioner's Office (ICO) has issued the social media company with a notice of intent – a legal document that precedes a potential fine.
The document sets out that between May 2018 and July 2020, TikTok may have processed the data of children under the age of 13 without appropriate parental consent; failed to provide proper information to its users in a concise, transparent and easily understood way; and processed 'special category' data without legal grounds to do so.
Information Commissioner John Edwards said: "We all want children to be able to learn and experience the digital world, but with proper data privacy protections. Companies providing digital services have a legal duty to put those protections in place, but our provisional view is that TikTok fell short of meeting that requirement.
"I've been clear that our work to better protect children online involves working with organisations but will also involve enforcement action where necessary.
"In addition to this, we are currently looking into how over 50 different online services are conforming with the Children's Code and have six ongoing investigations looking into companies providing digital services who haven't, in our initial view, taken their responsibilities around child safety seriously enough."
Rolled out in September last year, the Children's Code put in place new data-protection codes of practice for online services likely to be accessed by children, built on existing data-protection laws and with financial penalties a possibility for serious breaches.
The ICO said its findings in the notice are provisional, with no conclusion to be drawn at this stage that there has been any breach of data-protection law. It added: "We will carefully consider any representations from TikTok before taking a final decision."
A TikTok spokesperson said: "This notice of intent, covering the period May 2018-July 2020, is provisional and as the ICO itself has stated, no final conclusions can be drawn at this time.
"While we respect the ICO's role in safeguarding privacy in the UK, we disagree with the preliminary views expressed and intend to formally respond to the ICO in due course."
The tortuously slow progress into law of the Online Safety Bill is not helping regarding matters such as this.
In August, an open letter led by the NSPCC (National Society for the Prevention of Cruelty to Children), and signed by the parents of children who have been groomed, expressed frustration that the long delayed bill has once again been held up in its passage through parliament.
