close
close
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Enforcement · Administrative fine

Irish DPC fines TikTok €530M for unlawfully transferring EU data to China

GDPR

Ireland's Data Protection Commission fined TikTok €530 million: €45 million for transparency failures and €485 million for unlawful data transfers, after finding the company could not guarantee that European users' data, once remotely accessed from China, received protection equivalent to EU law. TikTok must bring its data transfers into compliance within six months or suspend them entirely.

Why it matters A real deadline comes with this one: comply within six months, or TikTok has to stop sending EU user data to China altogether.
Read the primary source
Data Protection Commission (Ireland)
Open source

Published by Editorial on Sep 23, 2026. Not independently re-checked against the primary source — read it via the link above.

Related actions

Administrative fine

Irish DPC fines Google €403M over unlawful location data processing

Google Ireland Limited

GDPR

€403,000,000Decided

The fourth-largest GDPR fine ever issued, for tracking exactly the kind of location data most apps collect by default.

Primary source
Settlement / consent order

Meta pays $459M to settle Cambridge Analytica privacy claims with four states

Meta Platforms, Inc.

California

$459,300,000Settled

Eight years after Cambridge Analytica broke, states are still collecting on it. This time it's $459 million, folded into an even larger settlement over Meta's design choices for kids.

Primary source
Settlement / consent order Pending

DOJ’s $400M TikTok privacy settlement hits a snag: a judge may reject part of it

TikTok Inc. and ByteDance Ltd.

COPPA Federal

$400,000,000Pending

A $400M privacy settlement isn't final just because the government announced it: a judge can still send both sides back to the table.

Primary source

Summaries are DataGrail’s wording, not statutory text; amounts and outcomes come from the linked primary source.

This summary is DataGrail's own plain-language account, written for privacy practitioners. It is not legal advice. For the authoritative text, follow the primary-source link above.