Overview

• The Irish Data Protection Commission (DPC) imposed a €530 million fine on TikTok for violating GDPR rules by transferring European user data to China and failing to ensure adequate protections.
• The fine includes €45 million for lack of transparency in TikTok's privacy policy and €485 million for illegal data transfers, making it the third-largest GDPR fine in EU history.
• TikTok admitted in April 2025 that some EU user data had been stored on Chinese servers as of February, contradicting earlier claims provided to regulators.
• The company criticized the DPC for not considering its Project Clover initiative, launched in 2023 to localize EU data, and announced plans to appeal the fine.
• The DPC is consulting with other EU data protection authorities to evaluate potential additional regulatory actions in light of these findings.