TikTok fined €530M for sending EU data to China

TikTok’s latest privacy headache comes with a massive price tag: €530 million.

Ireland’s Data Protection Commission (DPC) found that TikTok transferred European user data to China without meeting GDPR safeguards. That includes protections against access by Chinese authorities under national security laws, which remain a top concern in both the EU and US.

Most of the fine—€485 million—was tied to improper data transfers. Another €45 million was for failing to clearly explain those transfers in its privacy policy. While TikTok updated its policy in 2022 and promised billions in EU data centers, that didn’t sway regulators.

TikTok initially claimed that user data was only accessed remotely from China, not stored there. But during the investigation, it admitted a “limited” amount of European data had been stored on Chinese servers. The company says it deleted that data. The DPC wasn’t convinced.

This isn’t just about TikTok. It’s part of a larger debate around how global tech companies—especially those based in China—handle personal data across borders. With growing tensions between Western governments and China over digital sovereignty and surveillance, TikTok has become a flashpoint.

This is now the third-largest fine ever under GDPR, behind Meta and Amazon. And it’s not TikTok’s first run-in either—it was fined $367 million last year for mishandling kids’ data.

TikTok has six months to fix its data practices or risk even steeper penalties. An appeal is possible, but the pressure from regulators is clearly increasing.