EU Opens Fresh Investigation Into TikTok Over Data Stored in China

Ireland’s Data Protection Commission said it remained concerned over accuracy of information provided by the company.

File photo of the TikTok app logo shown on an iPhone in Houston, Texas, on Jan. 17, 2025. Ashley Landis/AP Photo

The European Union has launched a fresh privacy investigation into micro-video platform TikTok over the storage of European users’ data in China, the regulator announced on July 10.

Ireland’s Data Protection Commission (DPC) opened the inquiry as a follow-up to an earlier probe, which concluded on May 2 and resulted in TikTok being fined $620 million (530 million euros) for violating the EU’s data protection rules.

The DPC is serving as the bloc’s lead regulator for TikTok, owned by Beijing-based tech giant ByteDance, because the company’s European headquarters is in Dublin.

Due to its tax breaks, many tech firms are based in the Republic of Ireland.

The data regulator said that during the earlier investigation, TikTok had stated that personal data belonging to users in the European Economic Area (EEA) had only been accessed remotely and was not stored on servers located within China.

However, TikTok informed the DPC in April that it had discovered in February that users’ data had been stored in servers in China.

The DPC said that at the time, it was deeply concerned that the company had submitted inaccurate information and was considering what further regulatory action to take.

“As a result of that consideration, the DPC has now decided to open this new inquiry into TikTok,” the regulator said on July 10.

“The purpose of the inquiry is to determine whether TikTok has complied with its relevant obligations under the [General Data Protection Regulation] in the context of the transfers now at issue, including the lawfulness of the transfers.”

TikTok’s Response

In response, TikTok said it had notified the DPC of the rules breach, after it had embarked on data localization program Project Clover, which involves building three data centers in Europe in a bid to ease the bloc’s security concerns.

The company said: “Our teams proactively discovered this issue through the comprehensive monitoring TikTok implemented under Project Clover.

“We promptly deleted this minimal amount of data from the servers and informed the DPC. Our proactive report to the DPC underscores our commitment to transparency and data security.”

TikTok had said following the May 2 ruling that it would appeal against the DPC’s earlier decision.

A statement published on the social media platform’s website at the time said: “This decision has implications not just for TikTok, but for any company in Europe operating globally. We disagree with this decision and intend to appeal it in full.”

Data Protection Regulation

The GDPR is an EU law that sets out rules on how companies can handle the personal data of residents of the EEA (the EU’s 27 member states, plus Norway, Iceland, and Liechtenstein).

Breaches are policed by the local regulator in which the companies are based, and regulators can impose fines of up to 4 percent of a firm’s global revenue if it violates the law.

In 2023, the DPC fined TikTok $368 million (345 million euros) for failure to protect children’s privacy.

Under the regulations, European users’ data can only be transferred outside of the bloc if there are safeguards in place to ensure users have the same level of protection.

There are only 15 other countries worldwide that are considered to have the same level of data privacy, and China is not one of them.

Divest-or-Ban Law

It is not only Europe that has concerns over how TikTok handles user data.

U.S. lawmakers have also cited national security concerns over ByteDance’s ties to the Chinese Communist Party (CCP), and that Americans’ data could be accessed by the CCP.

On June 19, President Donald Trump extended by 90 days the deadline by which ByteDance must sell U.S. assets and operations to comply with a national security law, which has come to be known as the divest-or-ban law.

On July 4, Trump said his officials would begin talks this week with Beijing about a potential sale of TikTok.

Speaking to reporters while aboard Air Force One, the president said the United States “pretty much” has a deal for the sale of the video platform’s U.S. operations.

When asked whether he was confident that Beijing would approve the sale, Trump responded, “I’m not confident, but I think so.”

“President Xi [Jinping] and I have a great relationship. I think the deal is good for China, and it’s good for us,” he added.

The Associated Press contributed to this report.