TikTok Technology Limited

DPC (Ireland) case IN-21-9-2, decided 2025-04-30. EUR 530,000,000.

What the regulator decided

TikTok transferred EEA user data to the People's Republic of China without verifying that the protections offered by Chinese law were essentially equivalent to those under EU law, breaching Article 46(1) GDPR; and failed to inform users about the transfers and the remote access by personnel in China, breaching the transparency obligation in Article 13(1)(f) GDPR.

Primary source

Regulator-owned URL. Quote this in legal briefs and academic citations.

https://www.dataprotection.ie/sites/default/files/uploads/2025-10/Inquiry%20into%20TikTok%20Technology%20Limited%20April%202025.pdf

Archived snapshot

Wayback Machine snapshot of the primary source. Use this when the regulator URL might be refactored or expire.

https://web.archive.org/web/20260506173624/https://www.dataprotection.ie/sites/default/files/uploads/2025-10/Inquiry%20into%20TikTok%20Technology%20Limited%20April%202025.pdf

ConsentMark interpretation

Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.

Distinct from IN-21-9-1 (the September 2023 children's design-patterns case). Composite fine is EUR 485M (Art 46(1)) plus EUR 45M (Art 13(1)(f)). Cite when the scanner narrative needs the precedent for transparency about international transfers and remote access by third-country personnel.

Verification trail

Verified by: donal
Verified at: 2026-05-27
Review due: 2026-11-27

Cite this case

Pick the format that matches where you are pasting. The methodology version is preserved in every variant so the citation stays verifiable after future methodology changes.

BibTeX

@misc{consentmark-precedent-dpc-in-21-9-2,
  author       = {{ConsentMark}},
  year         = {2025},
  title        = {DPC (Ireland) IN-21-9-2 - TikTok Technology Limited},
  howpublished = {\url{https://www.consentmark.com/precedent/dpc-in-21-9-2}},
  note         = {ConsentMark methodology v1.3}
}

APA

ConsentMark. (2025, April 30). DPC (Ireland) IN-21-9-2 - TikTok Technology Limited. Methodology v1.3. https://www.consentmark.com/precedent/dpc-in-21-9-2

Markdown

[DPC (Ireland) IN-21-9-2 - TikTok Technology Limited - ConsentMark](https://www.consentmark.com/precedent/dpc-in-21-9-2)

Plain text

DPC (Ireland) IN-21-9-2 - TikTok Technology Limited - ConsentMark, 2025-04-30, methodology v1.3, https://www.consentmark.com/precedent/dpc-in-21-9-2