Cybersecurity Policy Report, Privacy Authorities Warn Europeans About TikTok’s Data Transfers to China, (Jan 2, 2026)
The Spanish and Norwegian data protection authorities have issued warnings to TikTok users regarding the company’s transfer of personal data to China, where national laws could require that data be shared with Chinese authorities.
TikTok already faces fines over violations of the European Union’s General Data Protection Regulation (GDPR) and was ordered to stop transferring personal data to China (CPR, May 2, 2025).
But TikTok disputes that it has done anything illegal and has appealed the fine. TikTok has been granted an interim injunction that allows the company to continue transferring personal data to China until the case is resolved.
In light of the continued transfer of personal data by TikTok to China, Spain’s Agencia Española de Protección de Datos (AEPD) has warned users to carefully read the notifications and privacy policies of online platforms and review their privacy settings.
Similarly, Norway’s Datatilsynet has issued recommendations for all TikTok users that include, among others, that users read TikTok’s privacy policy, check their privacy settings, and be careful what they share in the app. Datatilsynet also recommends that businesses consider whether to continue using TikTok, conduct risk assessments and data protection impact assessments, and be open with their target audiences about the risks that their business may face by maintaining a presence on TikTok.
News: InternationalLegislation DataPrivacy GDPR