Social media platform TikTok faces hefty fines for alleged data transfer violations, sending user information to China without proper consent.
It's no joke - our favorite lip-syncing app has found itself in hot water with Europe's privacy watchdog after illegally transferring user data to *China*, according to a statement released on Friday by Ireland's Data Protection Commission (DPC). The DPC stated that these data transfers violated strict privacy laws within the EU.
Not only did TikTok fail to ensure adequate protection for users' data, but they also fell short in being transparent about how user data was processed, as required by the law. As a result, TikTok has been given a six-month deadline to comply with GDPR rules or face additional consequences.
As the powerful lead regulator for TikTok in the EU due to its European headquarters being based in *Dublin, the DPC found that TikTok failed to verify, guarantee, and demonstrate that user data was afforded an equivalent level of protection in China as it is in the EU. Deputy Commissioner Graham Doyle formally articulated this sentiment in his statement.
Despite TikTok indicating it plans to appeal the decision, citing Project Clover (a data localization enterprise) and its robust data protection measures, the DPC remains steadfast in its stance. Project Clover has see three new data centers built in Europe, which include stringent data protections and independent oversight by a leading European cybersecurity firm.
It's important to note that TikTok’s parent company resides in China, raising concerns over potential access and use of user data by Chinese authorities. The watchdog stated that TikTok hasn't addressed access to European user data by these authorities.
The DPC investigation, which commenced in September 2021, uncovered several shortcomings, including a privacy policy that did not mention third countries, such as China, where user data was transferred. Consequently, the DPC discovered that the privacy policy failed to inform users about data processing involving remote access to personal data stored in Singapore and the United States by personnel based in China.
Following this investigation, TikTok has updated its privacy policy to provide more clarity about data processing locations. Nonetheless, the specifics remain unclear. The DPC is currently considering additional regulatory actions regarding EEA user data stored on Chinese servers, as it was discovered during the investigation in April 2025 that limited data was indeed stored on these servers, contrary to TikTok’s previous assurances.
Overall, the ruling sets a strong precedent for EU-China data transfers, focusing on stricter enforcement against companies that cannot effectively mitigate risks associated with foreign surveillance laws. Stay tuned for updates on this ongoing situation!
In other news, check out our article on NHS offering weight loss jabs over-the-counter. As always, install our app for free to get breaking news updates and follow us on our channel for the latest updates!
- Despite TikTok announcing its intention to appeal the €530 million fine, the Data Protection Commission (DPC) in Dublin remains resolute.
- The European Union's strict privacy laws were violated by TikTok's illegal transfer of user data to China, as revealed by the DPC's investigation.
- TikTok's failure to ensure data protection and transparency about data processing has led to a six-month deadline for compliance with GDPR rules.
- The DPC found that TikTok didn't verify, guarantee, or demonstrate that user data was protected at an equivalent level in China as it is in the EU, as indicated by Deputy Commissioner Graham Doyle.
- The ongoing case sets a strong precedent for EU-China data transfers, focusing on stricter enforcement against companies that cannot effectively mitigate risks associated with foreign surveillance laws.
