TikTok Fined €530M for GDPR Violations, Ban on Sending Data to China to Be Reviewed

What Happened?

On June 18, 2025, Ireland's High Court issued a landmark ruling in the enforcement of the EU's General Data Protection Regulation (GDPR). The judgment addresses two key aspects of TikTok's case against the Irish Data Protection Commission (DPC). On one hand, the court upheld the €530 million fine imposed on the platform for GDPR violations, specifically for failing to adequately protect the data of minor users and for transparency failures. On the other hand, the court returned the order banning TikTok from transferring European user data to China to the DPC, requesting a more detailed review of the security measures implemented by the company. This decision does not annul the ban but temporarily suspends it while the DPC reevaluates the evidence.

The case originated from investigations launched in 2021 following complaints that TikTok transferred personal data of European users to servers in China, where it could be accessed by Chinese authorities under the 2017 National Intelligence Law. In September 2023, the DPC issued a provisional order to halt these transfers, but TikTok appealed to the High Court. The current ruling is the result of that appeal.

Why Is This Important?

This decision has profound implications for the privacy of over 100 million monthly active TikTok users in Europe. The case sets a precedent for how European authorities address international data transfers to countries without adequate protection levels, such as China. Unlike the United States, which has a framework like the Data Privacy Framework, China lacks an EU adequacy decision, making any transfer potentially illegal unless sufficient safeguards are implemented.

Moreover, it reinforces GDPR enforcement against major tech platforms, showing that multi-million-euro fines are a reality. The €530 million fine is one of the highest under the GDPR, surpassed only by Amazon (€746 million in 2021) and Meta (€1.2 billion in 2023). However, the fact that the transfer ban has been sent back for review indicates that courts are still defining the limits of European digital sovereignty vis-à-vis global companies.

The geopolitical context is also relevant: the ruling comes amid growing tensions between the EU and China on technology matters. While the EU has intensified scrutiny of platforms like TikTok and Shein, China has criticized what it sees as protectionist measures. This case could influence negotiations on data flows under the EU-China Digital Dialogue.

What Consequences Will It Have?

In the short term, TikTok gains time to demonstrate that its data transfers to China comply with European standards. The DPC must reassess the evidence presented by the company, including contractual and technical guarantees such as Standard Contractual Clauses (SCCs) and impact assessments. If the ban is ultimately confirmed, TikTok may have to store and process European user data exclusively within the EU or in countries with adequacy decisions, such as the UK or Japan. This would require a significant restructuring of its infrastructure, with estimated costs in the hundreds of millions of euros.

In the long term, the ruling could influence future regulations on cross-border data flows and the EU-China digital relationship. For example, it could accelerate the adoption of the Data Governance Act and the EU Data Act, which aim to create a single data market. It could also set a precedent for similar cases against other Chinese platforms like WeChat or Alibaba.

For users, the immediate consequences are limited. The app will continue to function normally, but they should watch for potential changes in privacy policy. If the ban is confirmed, TikTok may need to request explicit consent for international transfers, which could affect user experience in features like content personalization.

What Should Readers Know?

• The €530 million fine is final and TikTok must pay it. The company has stated it will appeal, but the court has rejected a suspension of payment.
• The ban on transferring data to China is under review, not annulled. The DPC has six months to issue a new decision, though this could be extended.
• TikTok has been found liable for GDPR violations, affecting its reputation and potentially leading to class-action lawsuits from users. In 2024, several lawsuits were already filed in the Netherlands and Germany.
• European users should watch for possible changes in the app's privacy policy. TikTok may implement measures such as local data storage or end-to-end encryption.
• This case is a milestone in GDPR enforcement regarding international data transfers. It marks the first time a European court has reviewed a suspension order for transfers to China.

“The court has made it clear that tech companies cannot evade their obligations to European citizens' data, even if they operate on a global scale.”

The decision comes amid increasing scrutiny of Chinese platforms' data practices. Meanwhile, TikTok continues to operate in Europe, but under the shadow of a potential total restriction on its data transfers. The DPC must now balance data protection with the reality of a global business, in a case that could define the future of data governance in the EU.