TikTok’s parent company, ByteDance Ltd., may face a fine of over €500 million (US$553.08 million) from Ireland’s Data Protection Commission (DPC) for violating EU data protection laws.

The penalty stems from the unauthorized transfer of European user data to China, where it was accessed by engineers.

The DPC found that TikTok breached the EU’s GDPR and may require the company to stop these data transfers within a specific timeframe. A final decision is expected by the end of April, though the amount and timing may still change.

If confirmed, this would be the third-largest GDPR fine, after Meta’s €1.2 billion (US$1.33 billion) and Amazon’s €746 million (US$825.19 million) penalties.

The DPC began its investigation in 2021 over concerns about Chinese-based engineers accessing EU data.

In September 2023, TikTok was fined €345 million (US$381.62 million) for mishandling children’s data.

Recent TikTok developments