How TikTok, AliExpress & WeChat ignore your GDPR rights

Data Subject Rights Today, noyb has filed GDPR complaints against AliExpress, TikTok and WeChat.

Social Media Right of Access Procedures Right of Access Personal Data

Jul 17, 2025Sourcenoyb.eu

Full text

Data Subject Rights Today, noyb has filed GDPR complaints against AliExpress, TikTok and WeChat. All three tech companies have failed to comply with access requests under Article 15 GDPR. This makes it impossible for European users to exercise their fundamental right to privacy, to find out how their personal data is being processed – and if the companies actually comply with other GDPR provisions, for example regarding data transfers. EU law usually allows users to get a full copy of their data. Complaint against TikTok (EN)Complaint against TikTok (EL)Complaint against AliExpress (EN)Complaint against AliExpress (FR)Complaint against WeChat (EN)Complaint against WeChat (NL)Chinese Apps are even worse than US Providers. Most major tech companies have by now implemented some sort of automation tool that allows them to fulfil GDPR access requests on a mass scale, usually via a “download your information” tool. Theoretically, this would make it extremely easy for them to comply with EU l

How it connects

Related across sources

Danish DPA finds employer unlawfully refused former employee's access request The DPA received a complaint from a former employee (data subject) of the controller concerning the refusal of an access request. More specifically, the data subject was dismissed… 2025-31-2078 ·Denmark ·Datatilsynet (DK) Sep 24, 2026 Right of Access Personal Data Supervisory Authorities

C/16/608667 / HA RK 26-54 The data subject was involved in disputes with a school organisation ("controller") Those disputes concerned a communication ban, their membership in a participation council, and their internship. The data subject submitted an access request under Article 15… C/16/608667 / HA RK 26-54 ·Rb. Midden-Nederland Sep 22, 2026 Right of Access Personal Data Controllers

W101 2326836-1 40 natural persons submitted access requests to a mobile communications provider (controller) via an attorney Some of these persons were (former) customers of the controller, others have never been in a contractual relationship with the controller. In the access requests, the data… BVwG - W101 2326836-1 ·Federal Administrative Court Oct 2, 2026 Personal Data Right of Access Right to Restriction

C/09/697386 / HA ZA 26-52 Den Haag District Court: 51 gamblers sue Unibet operator Risepoint over unanswered GDPR The District Court of The Hague (the Court) considered an action brought by 51 individuals who had participated in online gambling offered through the website Unibet before 1… Rb. Den Haag Sep 2, 2026 Right of Access Personal Data Data Portability

2984/2026 Bulgaria SAC: Controller must provide copies of loan documents under GDPR Art. 15 access The data subject requested that a Bulgarian non-banking financial institution specialized in providing online fast loans and installment loans (the controller) provide copies of… Oct 13, 2026 Controllers Right of Access Personal Data

€100,000 HDPA fines Teleperformance for failing to properly handle employee access request The DPA received a complaint from a former employee of the Service 800 Teleperformance Single Member S.A. (the controller), after the controller failed to comply with the data… Greece ·Art. 5, 12, 13 +3 Personal Data Right of Access Storage Limitation