Enforcement · Data Protection Authority of Ireland EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

TikTok Limited: Non-compliance with general data processing principles

The Irish DPA (DPC), has imposed a fine of EUR 345 million on TikTok Limited.

€345,000,000 Fine
TikTok Limited
IRELAND
Art. 5 GDPR Art. 12 GDPR Art. 13 GDPR Art. 24 GDPR Art. 25 GDPR
Privacy by Design & Default Processing Personal Data Supervisory Authorities Security
Sep 1, 2023 Source edpb.europa.eu

Full text 2 findings

Paragraphs carrying a topic or an applied provision show those connections inline
§

The Irish DPA (DPC), has imposed a fine of EUR 345 million on TikTok Limited. The DPC conducted an investigation primarily focused on the processing of personal data between July 31, 2020, and December 31, 2020. During their investigation, the DPC found that the profiles of child users were set to public access by default. As a result, the DPC concluded that TikTok had failed to implement appropriate technical and organizational measures to ensure that only necessary personal data was being processed. Furthermore, the DPC noted that the 'Family Pairing' feature, which allowed non-child users to link their accounts with those of child users, posed a security risk to the personal data of children. Additionally, TikTok failed to provide child users with information about the categories of recipients of their personal data and clear, understandable information on the scope and implications of data processing.

Social Media Minors Personal Data
§

The DPC also found that TikTok introduced so-called 'dark patterns,' leading users to frequently opt for less privacy-friendly options during registration and when posting videos on the platform. In addition to the fine, the DPC issued an order requiring TikTok to bring its processing activities in line with the GDPR within three months. GDPR Articles: Art. 5 (1) c), 5 (1) f) GDPR, Art. 12 (1) GDPR, Art. 13 (1) e) GDPR, Art. 24 (1) GDPR, Art. 25 (1), (2) GDPR Industry: Media, Telecoms and Broadcasting

Processing Social Media applies Art. 5(1)Art. 12(1)Art. 13(1)Art. 24(1)

How it connects

2 of 2 paragraphs apply legislation or carry a topic — see them in the full text ↓

References

All 10

Related across sources

C-311/18 Data Protection Commissioner v Facebook Ireland and Maximillian Schrems C-311/18 (Schrems II) CJEU Jul 16, 2020 Privacy Shield Processing Agreement International Transfer
Guidelines 03/2022 Deceptive design patterns in social media platform interfaces: how to recognise and avoid them Guidelines ·EDPB Feb 24, 2023 Privacy by Design & Default Privacy by Design Privacy by Default
2022 EDPB Annual Report 2021 Enhancing the depth and breadth of data protection 2 EDPB Annual Report 2021 2 ENHANCING THE DEPTH AND BREADTH OF DATA PROTECTION An Executive Summary of this report, which… May 12, 2022 Privacy Shield Processing Agreement International Transfer
Guidelines 1/2020 processing personal data in the context of connected vehicles and mobility related applications Guidelines on processing of personal data through video devices Guidelines ·EDPB Jan 28, 2020 Personal Data Privacy by Design & Default Processing
Guidelines 4/2019 Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020 Guidelines on data protection by design and by default Guidelines ·EDPB Oct 20, 2020 Privacy by Design & Default Privacy by Default Privacy by Design
2020 EDPB Annual Report 2019 EDPB Annual Report 2019 1 EDPB Annual Report 2019 1 European Data Protection Board 2019 Annual Report WORKING TOGETHER FOR STRONGER RIGHTS An Executive Summary of this report,… May 18, 2020 Privacy by Design & Default Privacy by Default Supervision
Related documents