TikTok fined $600m by EU for failing to protect user data

TikTok has been fined €530 million (US$600 million) by Ireland’s Data Protection Commissioner (DPC) for failing to adequately protect user data.

The company must suspend data transfers to China unless it complies within six months.

The DPC found that TikTok, owned by ByteDance, didn’t meet EU standards, raising concerns over potential Chinese government access.

TikTok plans to appeal, citing its use of standard contractual clauses and new security measures like storing EU user data in centers in Europe and the US.

Earlier this year, TikTok admitted to storing a limited amount of EU data in China, which has now been deleted, but further action is being considered by the regulator.

🔗 Source: Reuters

🧠 Food for thought

1️⃣ Tech platforms face escalating privacy penalties amid growing regulatory scrutiny

TikTok’s €530 million fine follows a pattern of increasing regulatory action against social media companies, with the platform previously fined €345 million in 2023 for children’s privacy violations 1.

This latest penalty joins a growing list of major GDPR fines, including Meta’s record €1.2 billion penalty and Amazon’s €746 million fine, reflecting regulators’ mounting concerns about data protection practices 1.

The escalation is particularly evident in TikTok’s case, starting with a $5.7 million FTC fine in 2019 for collecting children’s data without parental consent, and now facing significantly larger penalties in Europe 2.

This trend indicates a global shift toward stricter enforcement of privacy laws, with GDPR penalties reaching €5.65 billion as of March 2025, signaling that data protection has become a priority for regulators worldwide 3.

European authorities are increasingly targeting how platforms handle international data transfers, with particular attention to companies that might face government access requests in their home countries.

2️⃣ Regulatory fines face significant enforcement challenges despite headline-grabbing amounts

Despite the impressive headline figures, data shows that only 1.3% of cases before EU Data Protection Authorities actually result in fines, revealing a significant gap between investigations and penalties 4.

The effectiveness of these penalties remains questionable as only $19.9 million of €3.26 billion in fines from the Irish Data Protection Commission had been paid by the end of 2024, demonstrating how lengthy appeals processes can delay consequences 5.