TikTok distributed a tool that collected behavioural data — clicks, purchases, add-to-cart actions — from other websites and apps, linked it to account and device identifiers, and used it for targeted advertising.
The penalty
Korea's Personal Information Protection Commission found that personal data had been collected, used and transferred overseas without lawful consent.
| Party | Fine |
|---|
| TikTok | KRW 10.306 billion |
| Apple affiliate | KRW 252 million |
| Total | KRW 10.558 billion |
Corrective and disclosure orders accompanied the fines. Apple was additionally sanctioned over consent procedures and safeguards relating to Siri transcript collection.
What advertisers are left with
The investigation found that roughly 71,000 companies used the collection tool, gathering behavioural data on approximately 9.45 million active domestic users.
Those numbers are the point. TikTok was penalised, but the 71,000 advertisers are the ones who embedded the tool on their own properties and let the data flow. Pasting in a pixel or SDK is where personal data processing begins.
What to audit now
- Which tracking tools are installed — including tags added for old campaigns and forgotten
- Whether consent scope matches actual collection — especially disclosure of overseas transfer
- What the platform tool's defaults are — check whether automatic collection is switched on
Bottom line
Even when the media platform supplies the tool, the data passes through your site. So does the first line of responsibility.
If you need an audit of your measurement stack, get in touch.