South Korea fines TikTok $7 million over unlawful collection of user data for ads

South Korea's privacy regulator has fined TikTok 10.3 billion won (about $7 million) for unlawfully collecting and using millions of users' behavioural data for personalised advertising.

The Personal Information Protection Commission (PIPC) said on Thursday that Singapore-based TikTok Pte. Ltd., which operates the platform's services in South Korea, breached the country's personal information protection law by gathering user activity data through third-party websites and mobile applications without properly informing users.

According to the commission, TikTok collected behavioural information from around 9.45 million users in South Korea using tracking tools embedded in external websites and applications. The data was subsequently used to deliver targeted advertisements.

The regulator said the company failed to provide adequate notice to users about the collection and use of their personal information and imposed corrective measures alongside the financial penalty.

In a separate action, the commission fined two Apple subsidiaries a combined 252 million won for privacy violations linked to the company's Siri voice assistant.

The watchdog said Apple collected voice recordings and text transcripts of Siri users without obtaining their consent until August 2019. Although the company introduced consent requests for voice recordings from October 2019, it continued collecting text transcripts without separately seeking users' permission, the regulator said.

The latest action comes weeks after the commission imposed a record 624.7 billion won (around $410 million) penalty on South Korean e-commerce giant Coupang over multiple privacy violations.

The fine included 423.6 billion won for a data breach affecting more than 37 million users and an additional 201.1 billion won for the unauthorised collection of users' online activity records and other breaches of privacy regulations.

The commission said its investigation found that the breach resulted from inadequate security management rather than a sophisticated cyberattack.

Coupang has expressed regret over the record penalty and said it intends to challenge the regulator's findings through legal proceedings.

With IANS inputs