TikTok set to face €500 million fine over EU data breach to China

TikTok's parent company, ByteDance Ltd., is set to face a hefty privacy fine exceeding €500 million ($553 million) for improperly transferring European users' data to China, amid rising global scrutiny of the popular video-sharing app.

According to sources familiar with the matter, referenced by Bloomberg, the Irish Data Protection Commission (DPC), which oversees the company's operations in Europe, is expected to impose the penalty before the end of the month, Caliber.Az reports.

This follows an extensive investigation into TikTok's data practices, which found that the company had violated the European Union’s General Data Protection Regulation (GDPR) by sending user data to China, where it was accessed by engineers.

This fine could rank as one of the largest ever issued by the Irish watchdog, trailing only previous penalties of €746 million against Amazon.com and €1.2 billion against Meta Platforms Inc. The exact amount of the fine and its timing are still pending, with potential adjustments before the final decision is made.

TikTok has not responded to requests for comment, and the Irish Data Protection Commission declined to provide further details. According to GDPR regulations, national agencies in countries where foreign firms have their EU headquarters are responsible for enforcing compliance. TikTok will have the opportunity to appeal the decision to the Irish courts.

This fine comes at a critical time for TikTok, as ByteDance faces a looming April 5 deadline to either sell TikTok’s U.S. operations or face a potential ban in the country. Amazon has reportedly entered the fray, submitting a bid to acquire the business, while AppLovin Corp. is also reportedly seeking backing for its own offer. The growing list of potential buyers reflects the tense U.S.-China relationship and the mounting scrutiny surrounding TikTok.

As part of the enforcement action, Ireland's data protection commission is expected to order TikTok to immediately cease the unlawful data processing in China within a set timeframe. This follows broader concerns about China’s extensive surveillance practices, which privacy advocates argue violate fundamental human rights.

TikTok’s handling of user data has already been under the microscope. In September 2023, the company was fined €345 million for alleged mishandling of children’s personal data. The Irish DPC has also taken a firm stance on tech companies transferring personal data outside the EU, most notably slapping a record €1.2 billion fine on Meta for failing to protect European citizens' data from access by U.S. security agencies.

The investigation into TikTok began in 2021, when former DPC head Helen Dixon warned that EU user data could be accessed by “maintenance and AI engineers in China.” The Irish watchdog plays a central role in regulating the activities of Silicon Valley giants due to Ireland’s position as a gateway to the 27-nation EU market.