The High Court upheld TikTok’s GDPR liability and its €530m fine, but sent the order suspending transfers to China back to the regulator for review.
TikTok lost the argument that mattered most and won itself some breathing room on the rest.
Ireland’s High Court has upheld the Data Protection Commission’s findings that the company breached EU privacy law by transferring European users’ data to China, and it left standing the €530 million fine that came with them.
But it ordered the regulator to reconsider the corrective measure that would suspend those transfers, which is the part TikTok cares about commercially.
The ruling, handed down in early June, settles the underlying liability. The court rejected TikTok’s contention that the Data Protection Commission had misapplied the EU rules governing international data transfers, affirming the core of the regulator’s inquiry into how data belonging to users in the European Economic Area moved to the People’s Republic of China.
On the central question of whether TikTok broke the law, the answer was yes.
The practical effect, though, is more favourable to the company than that suggests. By directing the Data Protection Commission to revisit its order suspending future transfers, the court has left TikTok able to keep moving European data to China while the regulator reconsiders how, or whether, to impose the ban.
A finding of wrongdoing that does not immediately stop the conduct is a partial reprieve, and TikTok has taken it.
The €530 million penalty is not necessarily fixed either. The court indicated it would consider TikTok’s appeal regarding the size of the fine, leaving both the corrective measures and the amount open to further argument even as the company’s liability is now settled.
The case, in other words, is decided in principle and unresolved in its consequences, which is an awkward place for everyone involved.
The dispute sits on one of the most sensitive fault lines in the TikTok story: the fear, voiced by Western governments for years, that data on European and American users could be accessed by the Chinese state.
TikTok has consistently denied that its data is improperly accessed, and has spent heavily to localise European data storage, building data centres in Dublin and across the continent under a programme it calls Project Clover, designed to keep that information on European soil.
The Irish case is about the transfers that happened regardless, and what the law requires be done about them.
The original DPC decision was sharpened by a late admission: TikTok, having long maintained that it did not store European data on servers in China, disclosed in 2025 that limited EEA user data had in fact been stored there, contradicting its earlier assurances to the regulator.
The regulator at the centre of it is one whose record is contested. The Irish Data Protection Commission polices GDPR compliance for the many large technology firms that base their European headquarters in Dublin, a concentration that has made it the de facto enforcer of EU privacy law and drawn persistent criticism that it is too lenient on the companies it oversees.
A court telling the DPC to reconsider a tough corrective order will not quiet those critics.
The timing adds an edge. Ireland recently took up the rotating presidency of the EU Council, putting it in a position of unusual influence over the bloc’s direction at a moment when its handling of Big Tech enforcement is under scrutiny.
The TikTok ruling lands as a live example of the tension between Ireland’s role as host to the tech giants and its duty to regulate them.
Where this goes next depends on the Data Protection Commission. It must now reconsider the suspension order under the court’s direction, and TikTok’s challenge to the fine has yet to be heard.
The liability is established and the principle is set: transferring EEA data to China as TikTok did breached the law.
What remains unsettled is the price, and whether the transfers will actually be stopped, the two questions the company has the most reason to keep fighting.
