ByteDance’s TikTok has been fined $600 million by the European Union for illegally transferring user data to China, a move that has generated major attention for violating the EU’s tough privacy requirements.

The penalty was levied by Ireland’s Data Protection Commission (DPC), TikTok’s primary regulator in the European Union, due to the company’s headquarters in Dublin.

According to the DPC, TikTok breached the General Data Protection Regulation (GDPR) by transmitting personal data from European users to servers in China. The DPC’s inquiry into the site found that TikTok acknowledged the transfers in April, clearly contradicting previous allegations made throughout the investigation.

The regulator expressed concern that TikTok had failed to install necessary protections to prevent potential access to European user data by Chinese state authorities, citing China’s national security regulations, which give the government the authority to seek and access data under certain conditions.

Graham Doyle, Deputy Commissioner at the DPC, explained that the company had not adequately addressed the risk of Chinese authorities accessing users’ data within the European Area (EEA), citing concerns about China’s anti-terrorism and counter-espionage laws, which differ from EU standards.

In reaction to the penalties, TikTok said it will appeal the verdict. The corporation argues that it has never received a data request from Chinese authorities or provided them with European user data. TikTok says that user data security is a key concern and that it follows the law.

This is the third-largest penalty ever given under the GDPR framework, after similar measures against other internet behemoths such as Meta Platforms Inc. and Amazon, which faced significant fines for comparable offences. TikTok has had past run-ins with regulatory authorities, including a €345 million fine last year for mishandling children’s data.

The DPC’s inquiry into TikTok began in 2021, prompted by rising fears that TikTok’s developers and maintenance personnel in China had accessed European customers’ data. This inquiry followed growing global worries about data privacy and how big digital corporations handle user information.

Beyond privacy concerns, TikTok has further legal hurdles in the EU. The corporation is presently being investigated under the EU Digital Services Act (DSA), which is intended to guarantee that social media platforms combat the proliferation of false accounts, misinformation, and foreign intervention. TikTok has been accused of failing to sufficiently avoid these concerns during Romania’s 2024 presidential election, exacerbating the platform’s legal problems.

In addition to existing investigations in the European Union, the Nigerian Data Protection Commission (NDPC) is looking into TikTok. The NDPC has said that it is looking into TikTok and other internet companies, such as Truecaller, for data privacy concerns. Dr. Vincent Olatunji, the NDPC’s National Commissioner and Chief Executive Officer, announced that the commission is investigating compliance with Nigerian data protection legislation and would take necessary regulatory action based on its findings.

Read also: The $50 Billion Chrome Question: If Google loses its browser, who wins the Internet?

Unlike the EU regulators, who have been quick to levy large fines, the NDPC is focusing on repair efforts, asking enterprises to enhance their data protection processes and ensure compliance with local laws.

As TikTok navigates these legislative difficulties, it is under increasing pressure to integrate its operations with worldwide privacy standards and demonstrate its commitment to user data protection. The platform’s worldwide expansion and influential role in the social media space makes it an important player in the continuing debate over data privacy and corporate accountability in the digital age.

For the time being, TikTok must address the DPC’s concerns, install required protections, and try to fix its compliance difficulties within the six-month deadline set by authorities. As the platform grows, its handling of user data will likely be a source of conflict, with regulators throughout the world keenly scrutinising its policies.