TikTok, owned by Chinese company ByteDance Ltd., is set to face a privacy fine of more than €500 million ($553 million) for unlawfully sending European users’ data to China, according to Bloomberg sources. The penalty will be issued by Ireland’s Data Protection Commission (DPC), the company’s main regulator in Europe, and is expected to be finalized before the end of the month.
This fine follows a lengthy investigation which found that TikTok violated the European Union’s General Data Protection Regulation (GDPR) by allowing Chinese engineers to access the data of European users. The decision to issue the fine marks another significant blow for the video-sharing app, as it faces growing scrutiny from regulators around the world. The €500 million penalty is likely to be one of the largest ever levied by the Irish DPC, trailing only the €746 million fine imposed on Amazon and the €1.2 billion fine against Meta Platforms Inc. (Facebook), according to sources familiar with the matter.
Although TikTok has not responded to the development, the Irish Data Protection Commission declined to comment. Under GDPR, national regulators, such as Ireland’s DPC, are responsible for enforcing data protection rules for foreign firms operating in the EU. TikTok has the right to appeal the fine in Irish courts.
The fine is the latest chapter in TikTok’s growing legal challenges in Europe. In September 2023, the company was fined €345 million over alleged mishandling of children’s personal data. Concerns about data privacy have been a major focus of regulators, particularly regarding the transfer of European citizens’ data to countries outside the EU, including the United States and China. In one high-profile case, Meta Platforms Inc. was hit with a record €1.2 billion fine for not protecting EU data from US government access.
The timing of the fine is especially sensitive for ByteDance, as it faces a looming April 5 deadline to divest TikTok’s US operations or risk a potential ban in the country. The ongoing uncertainty around TikTok’s future in the US has prompted major companies, including Amazon, to enter the fray with acquisition bids. Amazon recently submitted a bid to buy TikTok’s US business, while AppLovin Corp. is also reportedly exploring a potential takeover.
The investigation into TikTok’s data practices began in 2021 when Ireland’s then head of the DPC, Helen Dixon, expressed concerns that EU user data was being accessed by “maintenance and AI engineers in China.” As part of the upcoming ruling, TikTok will be required to suspend the unlawful processing of data in China within a specified timeframe.
TikTok has already been in the sights of regulators over its data practices, and this fine further intensifies the pressure on the app amid broader global concerns over privacy and data security. The outcome of the Irish DPC’s ruling, along with ongoing legal and political battles, will be crucial in determining TikTok’s ability to continue operations in both the EU and the US.
