TIKTOK TECHNOLOGY LIMITED – Court Ruling (Ireland, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Irish Data Protection Commission found that TikTok failed to protect the personal data of its users when transferring it to China. This is significant because it shows that companies must ensure data protection standards are met when moving user data internationally. TikTok's operations could be impacted if they don't comply with these rules.
What happened
TikTok transferred EEA user data to China without ensuring adequate protection for that data.
Who was affected
TikTok's 159 million monthly users in the EEA were affected by the data transfer issues.
What the authority found
The Data Protection Commission ruled that TikTok violated GDPR by not providing necessary information about data transfers and failing to ensure adequate protection.
Why this matters
This case highlights the risks companies face when transferring user data outside the EU. Businesses must prioritize data protection to maintain user trust and comply with regulations.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
TikTok challenged a decision and related suspension order issued by the Irish DPA concerning transfers of EEA user data to China under Article 46 GDPR. In the decision, the DPA found that TikTok had infringed Article 46(1) GDPR by failing to ensure that personal data of EEA users transferred outside the EEA (specifically through remote access by personnel in China) received a level of protection essentially equivalent to that available within the EU during the relevant period. The DPA also found a breach of Article 13(1)(f) GDPR for failure to provide required information about such data transfers to data subjects. Consequently, the DPA imposed administrative fines totalling €530 million, a suspension order requiring TikTok to suspend the data transfers, and a corrective order requiring TikTok to bring its processing operations into compliance. TikTok initiated an appeal against the DPA decision. The appeal automatically stayed the obligation to pay the administrative fines, but it did not stay the suspension order or corrective order. TikTok applied for a stay of those orders, asserting that compliance would require billions of euros in expenditure, significant business disruption, and harm to stakeholders’ experience, and that such losses could not be remedied if TikTok ultimately succeeded on appeal. The DPA opposed the stay, asserting that the ongoing data transfers posed risks to the fundamental rights of TikTok’s 159 million monthly EEA users. The Court held that the appropriate legal standard for deciding whether to grant a stay should be decided according to the national procedural rules (Okunade test), rather than the harmonized EU ones (Zuckerfabrik test). Under the Okunade test, the Court must identify the course of action carrying the least risk of injustice pending the appeal. As the DPA accepted that TikTok’s appeal raised a serious issue to be tried, the Court focused on whether damages would be an adequate remedy and where the balance of justi
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for TIKTOK TECHNOLOGY LIMITED in IE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. TIKTOK TECHNOLOGY LIMITED - Ireland (2025). Retrieved from cookiefines.eu
Last updated: