TikTok has been fined KRW 10.3 billion (USD $7 million) by South Korea’s data protection regulator for collecting people’s activity from third-party apps and websites without a lawful basis, and using it to serve targeted advertising.
The Personal Information Protection Commission (PIPC) announced the penalty on Thursday (July 23), having imposed it at the regulator’s 14th plenary meeting the previous day.
The commission also ordered TikTok to correct the practices and publish the outcome, and in the same decision it fined one Apple subsidiary and ordered corrective measures against another.
The fine falls on TikTok Pte. Ltd., the Singapore-based entity that operates the app in South Korea.
According to the PIPC, TikTok distributed data-collection tools — among them TikTok Pixel, Events SDK and Events API — to other companies’ apps and websites, then gathered the activity of users who visited those pages.
That activity included clicks, purchases, searches, downloads and content views, the commission said, and was collected from 9.45 million active users in South Korea as of December 2025.
The tools were in use across roughly 71,000 companies in the country, the PIPC said.
TikTok linked that third-party activity to users’ device identifiers and to their TikTok accounts, the regulator found, and used it to infer their interests for targeted ads.
The PIPC said TikTok bundled consent for the collection together with the consent needed to use the service, so that people had to accept third-party data collection in order to use the app.
“At TikTok, protecting our users’ privacy and ensuring the security of their information are among our highest priorities. We are committed to complying with all applicable laws and regulations in Korea.”
TikTok Korea
The commission found the collection breached Article 15 of South Korea’s Personal Information Protection Act, and that moving the data overseas breached Article 28-8.
It separately found that TikTok Lite had transferred users’ data to an affiliate, through its points cash-out feature, without disclosing the required details of the transfer.
A spokesperson for TikTok Korea said in a statement: “At TikTok, protecting our users’ privacy and ensuring the security of their information are among our highest priorities.
“We are committed to complying with all applicable laws and regulations in Korea. We are awaiting the details of the ruling and will review them carefully before providing any further comment.”
In the same decision, the regulator fined Apple subsidiary Apple Distribution International KRW 252 million (about $170,000) over the collection of Siri voice recordings and transcripts without separate consent, and ordered corrective measures at a second affiliate.
MBW has reached out to TikTok parent ByteDance and Apple for comment
TikTok runs its own music distribution and promotion service, SoundOn, which in April began screening uploads with content-recognition firm ACRCloud.
The South Korean penalty adds to a run of data-protection actions against TikTok internationally.
In May 2025, Ireland‘s regulator fined the company €530 million ($601 million) over transfers of European user data to China and related transparency failures.
The UK’s Information Commissioner’s Office had earlier fined TikTok £12.7 million ($15.8 million) over its handling of children’s data.
TikTok does not publish its financial results as a standalone company.
TikTok generated an estimated $23 billion in revenue in 2024, around 77% of it from advertising, according to Business of Apps.
Parent company ByteDance posted revenue of $155 billion in 2024, Bloomberg reported.
ByteDance was valued at $480 billion in a November 2025 share auction, as covered by MBW.
At roughly $7 million, the PIPC fine equals about 0.03% of TikTok‘s estimated 2024 revenue.
The TikTok penalty is one of a series of recent PIPC actions against large platforms.
In June 2026, the PIPC imposed a total of KRW 624.7 billion (about $409 million) on e-commerce company Coupang over a data breach and a separate data-collection violation.
The PIPC described it as the largest fine it has levied on a single company.
The regulator has also fined Meta KRW 21.6 billion (about $15 million) for collecting the data of some 980,000 Facebook users and passing it to advertisers.
South Korea’s National Assembly in February 2026 passed amendments introducing a higher penalty tier of up to 10% of a company’s total revenue for serious violations, above the existing ceiling of 3% of revenue related to the violation, with the change due to take effect on September 11, 2026.Music Business Worldwide
