The Tiktok logo is available on April 4, 2025 outside the Los Angeles office of China Video Apps in Culver City, California.
Robyn Beck | AFP via Getty Images
Tiktok was fined 530 million euros ($601.3 million) by Ireland's privacy regulator for sending user data to China.
The Irish Data Protection Commission (DPC) (EU responsible for Tiktok's privacy oversight) said on Friday that Tiktok violated the group's GDPR data protection laws rather than the transfer of European user data to China.
Regulators ordered Tiktok to include its data processing in compliance within six months and said it would suspend the transfer of Tiktok to China if processing is not followed within that time frame.
“Tiktok’s personal data transmission to China violates GDPR because Tiktok failed to verify that the personal data of EEA users who were remotely accessed by Chinese employees was basically protected to a certain extent with the guaranteed internally of the EU.
He added: "Tiktok has not addressed the potential access rights of Chinese authorities under China's counter-terrorism, counter-protest, counter-clockwise and other laws identified by Tiktok, which differs greatly from EU standards," he added.
The DPC said Tiktok provided inaccurate information when it claimed that it did not store data from European users on servers in China. Tiktok notified regulators this month that it found a problem in February that European user data is limited to stored on servers in China, contrary to its previous statement.
Doyle said the DPC is “very serious” to view the issue as a problem and is considering further regulatory actions that may be needed in consultation with its EU data protection authorities.
Tiktok said it disagreed with the Irish regulator's decision and plan to appeal a full appeal.
In a blog post on Friday, Christine Grahn, head of European public policy and government relations at Tiktok, said the decision failed to take into account Project Clover, a €12 billion data security program designed to protect European user data.
"Instead, it focused on a select period a few years ago, and before the implementation of Clover in 2023, it did not reflect the safeguards that appeared in it," Gran said.
She added: "The DPC itself records what Tiktok has been saying in its report: It never received a request for European user data from Chinese authorities and never provided European user data to them."
Tiktok previously admitted that Chinese employees can access user data.
In its latest news on its privacy policy in 2022, it said employees in countries including China, Brazil, Canada and Israel were allowed to access users’ data to ensure their experience is “consistent, pleasant and secure.”
Western policy makers and regulators are concerned that Tiktok's user data transmission could lead to Beijing accessing data to monitor users using the app. Under Chinese law, if requests are helpful, tech companies are required to hand over user data to the Chinese government.
In the case of Tiktok, it insists that it never sent user data to the Chinese government. Tiktok boss Shou Zi Chew said in a written testimony at a U.S. Congressional hearing in 2023 that the app “has never shared or received a request to share U.S. user data with the Chinese government.”