South Korea’s Personal Information Protection Commission (PIPC) has imposed financial penalties on TikTok and Apple after concluding that both companies violated the country’s data protection rules. The regulator found shortcomings in the way the companies handled users’ personal information, although the violations differed between the two technology firms. The decision is part of South Korea’s ongoing efforts to strengthen enforcement of its privacy legislation against major global technology companies.
TikTok received the larger penalty after the PIPC determined that the platform failed to properly protect users’ personal data and did not fully comply with legal transparency requirements. According to the regulator, the company did not provide sufficient information about how certain personal data was collected, processed, and shared. Investigators also found deficiencies in the company’s internal privacy management practices, prompting authorities to order corrective measures in addition to the financial sanction. The regulator said TikTok must improve its privacy procedures and bring its operations into compliance with South Korean law.
Apple was also fined following a separate investigation into its handling of user information. The PIPC concluded that the company violated provisions of South Korea’s Personal Information Protection Act by failing to adequately meet certain privacy obligations. While the regulator did not accuse Apple of a large-scale data breach, it found that aspects of the company’s data processing practices did not satisfy local legal requirements. Apple has been instructed to address the identified issues and strengthen its compliance measures.
The investigations focused on whether users were given sufficient information about how their personal data would be processed and whether the companies obtained consent in accordance with South Korean privacy rules. Regulators increasingly expect technology companies to clearly explain what information they collect, why it is collected, how long it is retained, and whether it is shared with third parties. Failure to provide transparent disclosures or obtain legally valid consent can result in administrative penalties under the country’s data protection framework.
South Korea has become one of the world’s most active privacy regulators in recent years, frequently investigating major technology companies over alleged violations of personal data protection laws. The PIPC has previously issued significant penalties against companies including Google, Meta, Facebook, and Coupang for a range of privacy-related issues, demonstrating its willingness to enforce compliance regardless of a company’s size or country of origin.
The latest enforcement action adds to growing regulatory scrutiny of TikTok worldwide. The company has recently faced multiple privacy investigations and financial penalties in other jurisdictions, including the European Union, where regulators fined TikTok €530 million over unlawful transfers of European user data to China and ordered corrective measures. TikTok has disputed several regulatory findings and appealed some of the decisions, maintaining that it has invested heavily in data security and privacy protections.