By Kelvin Chan
LONDON (AP) – Tiktok is facing a fresh European Union privacy investigation into user data sent to China, regulators said Thursday.
The Data Protection Commission began its investigation as a follow-up to a previous investigation that ended earlier this year after discovering that video sharing apps risk spying by allowing data from China.
Because the company’s European headquarters is based in Dublin, the Ireland National Watchdog serves as Tiktok’s lead data privacy regulator in 27 countries and EU.
During previous investigations, Tiktok initially told regulators that it did not store European user data in China, and that data could only be accessed remotely by Chinese staff. But later backtracked it and stated that in reality some data was stored on a Chinese server. Watchdog responded at the time, saying it would consider further regulatory measures.
“As a result of that consideration, DPC has decided to open this new inquiry to Tiktok,” Watchdog said.
“The purpose of the investigation is to determine whether Tiktok complies with relevant obligations under the GDPR in the context of the currently in questionable transfer, including the legality of the transfer,” the regulator said, referring to the European Union’s strict privacy regulations known as the General Data Protection Regulation.
Tiktok, owned by Chinese ordinance, is being scrutinized in Europe for how it processes individual user information amid concerns from Western officials pose security risks.
Tiktok noted that it notified the Data Protection Commission after embarking on a data localization project called Project Clover, which involves building three data centres in Europe to alleviate security concerns.
“Our team has actively discovered this issue through comprehensive surveillance Tiktok implemented under Project Clover,” the company said in a statement. “We immediately deleted this minimal data from our server and notified the DPC. Proactive reporting to the DPC highlights our commitment to transparency and data security.”
Under GDPR, European user data can only be transferred outside the block if it is in place to ensure the same level of protection. Only 15 countries or regions are considered to have the same data privacy standards as the EU, but China is not one of them.
Original issue: July 10th, 2025, 7:49pm EDT
