TikTok Fined 10.36 Billion Won for Unauthorized Data Collection; Apple Also Penalized 252 Million Won

TikTok Collected Users' Behavioral Data Without Consent
Failed to Properly Notify Users About Overseas Transfer of Personal Information
Apple Used Voice Recordings to Improve Siri Without User Consent

TikTok and Apple have been ordered to pay a total of 10.6 billion won in fines for collecting user activity records without consent and using them for targeted advertising and their own service improvement.

On the 22nd, the Personal Information Protection Commission held its 14th plenary session and decided to impose fines totaling 10,558 million won on two affiliates of TikTok and Apple for violating the Personal Information Protection Act and other related laws. The commission also ordered corrective actions and public disclosure, it announced on the 23rd.

TikTok logo. TikTok

According to the commission's investigation, both companies collected and used users' personal information or transferred it overseas without proper legal grounds.

TikTok was fined 10,360 million won and also received corrective and public disclosure orders. TikTok collected behavioral information such as users' visited pages without adequately notifying them. While providing advertising and content performance analysis services, TikTok distributed behavioral data collection tools to other businesses. These tools collected activity records (such as clicks and purchases) of users who visited third-party web or app pages.

As of December last year, TikTok collected third-party behavioral data from 9.45 million domestic users using this tool. In the process, device identifiers were also collected and linked to TikTok accounts for use in targeted advertising. During this process, TikTok did not clearly notify users that their data was being collected, and effectively forced users to consent to this collection by making it a mandatory requirement during sign-up, thus coercing the collection of third-party behavioral data, according to the commission.

It was also found that TikTok Light, the lightweight version of TikTok, failed to adequately disclose the transfer of personal information. During the process of cashing out points from the app-tech service offered by TikTok Light, users' personal data was transferred to an affiliate without publicly notifying or disclosing which items were being transferred.

Apple was imposed a 252 million won fine along with a corrective order. Until August 2019, Apple collected voice recordings and transcripts from users of its voice assistant service Siri to improve voice recognition and search results without proper notification. The commission's investigation revealed that Apple had not obtained separate user consent for this process. While Apple began obtaining user consent to use voice recordings for service improvement from October 2019, it continued to use transcripts for service improvement without a proper legal basis.

Furthermore, Apple transferred users' personal information to its headquarters in the United States, yet did not sufficiently explain in its privacy policy which items were transferred, the purposes for which Apple Inc. would use the data, or the retention and usage period for the information.

However, during the investigation, Apple addressed the violations by giving users the option to allow transcript collection and use, strengthened privacy protection measures by filtering personal information from transcripts, and revised its privacy policy accordingly.

The commission explained that the significance of this action lies in warning global businesses that they must ensure transparency and sufficiently guarantee users' right to control their own data when processing personal information.

A commission official stated, "We will continue to closely monitor how global companies handle personal information and will firmly respond to illegal conduct without discrimination between domestic and international businesses. We will strive to ensure that the personal information of our citizens is protected safely and transparently even in increasingly complex cross-border environments."

This content was produced with the assistance of AI translation services.