LOS ANGELES – TikTok has been fined a record €530 million (about Ksh. 77 billion or $600 million) by the European Union for violating data protection regulations by transferring personal data of European users to China and failing to safeguard it from potential access by Chinese authorities.
This fine, one of the largest ever imposed by the EU, comes after an investigation into the social media platform’s data transfer practices.
The Irish Data Protection Commission (DPC), which oversees TikTok’s European operations, accused the company of breaching the EU’s General Data Protection Regulation (GDPR).
The investigation revealed that TikTok had hosted European data in China, contrary to previous claims of complying with European standards for data protection.
Graham Doyle, Deputy Commissioner of the DPC, stated that TikTok failed to guarantee that the personal data of European users, which could be remotely accessed by staff in China, was protected at the same level as required by EU laws.
The DPC’s investigation found that TikTok had also not been transparent about its data transfers.
Between 2020 and 2022, the platform did not inform its users where their data was being transferred or that it could be accessed from China.
This resulted in a €45 million penalty for lack of transparency.
Additionally, the DPC ordered TikTok to bring its data processing into compliance within six months or face further action, including the suspension of data transfers to China.
TikTok has vowed to appeal the ruling, with Christine Grahn of TikTok Europe defending the platform’s data protection policies.
She denied the claims that Chinese authorities had accessed European user data, stating, “We have never provided European user data to them.”
TikTok also insisted that there is no evidence that any data had been accessed or disclosed without authorization.
The fine adds to the growing pressure on TikTok, already under scrutiny from several Western governments, including the United States.
In 2024, the U.S. Congress passed a law demanding that ByteDance, TikTok’s Chinese parent company, divest control of the app in the U.S. or face a ban.
The law was passed amid concerns that personal data collected by TikTok could be exploited for espionage or propaganda purposes by the Chinese government.
Beyond data privacy concerns, TikTok has been criticized for its opaque algorithm, which critics argue encourages the spread of misinformation and harmful content.
Several countries, including Pakistan and Nepal, have imposed temporary bans on the app, citing its potential to foster divisive or illegal content.
The latest fine comes despite TikTok’s efforts to reassure European regulators through its “Project Clover,” which promised a €12 billion investment in European data security over the next decade.
The company had previously claimed that European user data was stored in Norway, Ireland, and the U.S., with no access granted to employees in China.
However, the DPC’s investigation uncovered that, contrary to these claims, some data had been stored in China before being deleted.
