Fine of 530 million euros for TikTok for transferring data to China
Ireland's Data Protection Commission (DPC) is fining China's ByteDance 530 million euros. The parent company of TikTok sends personal data of European users to China while that data is not properly protected there. The investigation and fine have been coordinated with other European privacy regulators, including the Personal Data Authority (AP).
Personal Data Authority May 8, 2025
AP Vice President Monique Verdier: "TikTok has a big responsibility: it manages data of more than a billion people worldwide. And in the Netherlands, too, millions of people are on TikTok, including many children. Children need to be safe online, and European privacy regulators are committed to ensuring that social media companies like TikTok take responsibility and abide by the law.'
Chinese government
ByteDance employees in China have access to European users' data. ByteDance cannot prove that the data of TikTok users in China is well protected. And that not, for example, the Chinese government has access to the data. That is a violation of the General Data Protection Regulation (AVG), and for that the DPC is fining 485 million euros. In addition, ByteDance does not clearly inform users that their personal data is going to China. For that, the DPC is fining 45 million euros.
'TikTok knows a lot about you'
Verdier: "If you're on TikTok, that platform knows a lot about you. If you're a kid who watches a lot of videos about dealing with depression or an eating disorder, that algorithm can conclude that you might not be feeling well. Also, TikTok can see who your friends are, what comments you leave on their videos and where you are: TikTok can track you. That sensitive information is something the company needs to protect properly. And TikTok doesn't.
ByteDance employees in China can now still download the data of European users, for example for maintenance of the TikTok app. This must change, the Irish regulator says: ByteDance must ensure within six months that employees in China no longer have access to the data.
Third AVG fine for TikTok
The Irish regulator led this investigation, as TikTok's European headquarters is in Ireland. It is the third AVG fine for TikTok:
in 2023, the DPC imposed a fine of 345 million euros for inadequately protecting children's privacy. The DPC then launched that investigation in part at the request of the AP. In 2021, before TikTok set up shop in Ireland,
the AP imposed a fine on the company of 750,000 euros because TikTok did not properly inform children about the use of their data.
ByteDance can appeal the fine.
