TikTok fined W10.31b for collecting data on 9.45 million users of rival apps

TikTok and Apple have been fined for collecting, using and transferring personal data overseas without a lawful basis.

South Korea's Personal Information Protection Commission said Thursday it would impose a combined fine of 10.56 billion won ($7.16 million) on TikTok and Apple for violations of the Personal Information Protection Act and the former Act on Promotion of Information and Communications Network Utilization and Information Protection.

TikTok was fined 10.31 billion won for collecting behavioral data on about 9.45 million users of third-party apps and using it for targeted advertising without proper disclosure.

The commission launched its investigation after media reports raised concerns about potential violations by TikTok and TikTok Lite and confirmed that the platforms had collected, used and transferred third-party behavioral data overseas without a lawful basis.

TikTok distributes behavioral data collection tools to other web and app operators as part of its advertising and content performance analytics services.

Through these tools, TikTok collects activity records — referred to as third-party behavioral data — from users who visit the websites or apps of operators that have installed the tools.

According to the commission, more than 71,000 companies in South Korea use TikTok's behavioral data collection tools. TikTok analyzes the data to infer users' characteristics and interests and then uses those inferences for targeted advertising.

The commission found that TikTok had failed to notify users in a way they could clearly understand at the time of sign-up.

It also found that by requiring consent as a condition of signing up, TikTok in effect compelled anyone wishing to use its service to agree to the collection of third-party behavioral data for targeted advertising — leaving users unable to exercise meaningful consent.

In addition, the commission confirmed that TikTok Lite had transferred users' personal data to affiliates during the provision of its points cash-withdrawal service without disclosing or notifying users of the transfer.

Apple was separately fined 252 million won.

The commission found that Apple had collected voice recordings and transcripts when users activated its Siri voice assistant without obtaining separate consent until August 2019.

From October 2019, Apple began obtaining separate consent to use voice recordings for service improvement, but the commission found it had continued to use transcripts for the same purpose without a separate lawful basis.

The commission also found that Apple had transferred users' personal data to affiliates in the United States and elsewhere without adequately disclosing the transfers in its privacy policy.

However, Apple corrected the violations during the investigation, including by revising its privacy policy.

"We will continue to monitor how overseas operators handle personal data and respond strictly to any unlawful conduct, applying the same standards to both domestic and foreign companies," the commission said. "We will work to ensure that the personal data of our citizens is protected safely and transparently,</style> even as it crosses borders in increasingly complex environments."