Beleaguered social media app TikTokbeen issued a fine of £12.7 million ($15.8 million) by the UK’s Informational Commissioner’s Office (ICO).

The company, a subsidiary of ByteDance, was found to have violated the UK’s data protection laws, reports Mobile Marketing Reads. Most notably by misusing the data of users below the age of 13.

In a statement, the ICO wrote that TikTok was used by up to 1.4 million children in the UK, and that while the company’s policies don’t allow those below 13 to use the app, it didn’t take the necessary steps to remove these accounts. Additionally, the company failed to get the consent of guardians to use the personal data of children.

“There are laws in place to make sure our children are as safe in the digital world as they are in the physical world,” said the UK’s information commissioner John Edwards. “TikTok did not abide by those laws. As a consequence, an estimated one million under 13s were inappropriately granted access to the platform, with TikTok collecting and using their personal data. That means that their data may have been used to track them and profile them, potentially delivering harmful, inappropriate content at their very next scroll.’’

The investigation found that, not only should TikTok have been aware that users were circumventing the age restriction, but concerns were raised internally with senior employees, who failed to respond adequately.

Is TikTok in trouble?

TikTok has quickly emerged as one of the world’s dominant social media platforms, and helped put ByteDance on the map. However, the app has increasingly drawn the concern of legislators worldwide, leading to bans on its use on government devices in a number of countries.

The reason for this concern is Chinese law, which would require ByteDance to provide any and all data, including sensitive user information such as geolocational data, to the Chinese government upon request. This fine, while unrelated to these bans, may exacerbate concerns about how the company is using data.

Notably, however, the final fine is less than half the possible £27 million ICO proposed as a result of its provisional investigation into the company’s data breaches. This is due to ICO deciding not to pursue its provisional findings related to the company’s misuse of special category data – such as sexual orientation, health, and information regarding religious and political beliefs.

In December, attorney generals in 15 American states demanded Apple and Google change TikTok’s age rating.