The Spanish Data Protection Agency (AEPD) has once again raised concerns about the popular short video social network TikTok : the platform continues to send personal data of European users to third countries , including China, despite the fact that EU regulators had already concluded that these practices clash with the General Data Protection Regulation (GDPR).
This situation places millions of users in Spain and the rest of Europe in a precarious position: their data continues to leave the European Economic Area while the legal battle between TikTok and data protection authorities plays out in Irish courts. The service is functioning normally, but its data processing model is under increasingly intense scrutiny.
A record fine of 530 million and an open investigation
The conflict originated with an investigation coordinated by EU data protection authorities, led by the Irish Data Protection Commission (DPC) , which acts as TikTok's main regulator in Europe since the company's EU headquarters are in Dublin. After years of analyzing international data flows, the authorities concluded that transfers to third countries did not comply with GDPR requirements.
As a result, in April 2025, the DPC fined the platform €530 million and ordered a series of corrective measures. These included the obligation to suspend transfers of European user data to China and other territories outside the European Economic Area if TikTok did not guarantee a level of protection comparable to that of Europe within a specified timeframe.
The Spanish Data Protection Agency (AEPD), which actively participated in this process through the European Data Protection Board, points out that the Irish decision was not isolated, but rather the result of a joint analysis . The regulators agreed that the safeguards offered by the company did not adequately mitigate the risks associated with the legislation of countries such as China.
The resolution primarily highlighted remote access from China to user information within the European Economic Area over several years, without a safeguards framework deemed sufficient by European regulators. This potential access by employees located outside the EU is at the heart of the conflict with the GDPR.
The appeal to the Irish courts and the temporary suspension of the blockade
Far from simply complying with the DPC's ruling, TikTok decided to appeal the sanction and the imposed measures in Irish courts. The company maintains that it has used the EU's own legal mechanisms to enable limited and controlled remote access to data, and that its system offers sufficient safeguards.
In November 2025, the competent court in Ireland granted a temporary lifting of the order blocking the transfers while the legal proceedings are resolved. In practice, this means that, although the assessment by the supervisory authorities remains in place, TikTok can continue sending data to third countries , including China, until a final ruling is issued.
This precautionary suspension does not invalidate the DPC's resolution or the position of the other regulators, but it does put some of the most stringent measures on hold, such as the blocking of data transfers. The Spanish Data Protection Agency (AEPD) emphasizes that the legality of these data flows remains under judicial review and that the Irish decision remains fully valid in its findings.
In return, the temporary lifting of the ban is conditional on the company fulfilling additional transparency obligations . In response to this requirement, TikTok has begun displaying specific notices within the app to European users, explaining that an investigation is underway and that data transfers to China may continue while the appeal is being processed.
In Spain and the rest of the European Economic Area, many internet users have already seen a message under headings such as “Transfer of EEA user data to China via remote access,” which summarizes the €530 million fine, the suspension order, and the appeal before the Irish court . The platform itself has confirmed that these notifications are part of its compliance with transparency commitments.
What data can leave Europe and why does this worry regulators?
The core of the problem lies not only in the existence of remote access from China or other countries, but also in the legal framework to which the data is subject once it leaves the European environment . The GDPR requires that, when personal data is transferred to third countries, these countries offer a level of protection essentially equivalent to that of Europe or establish robust safeguards through specific clauses and mechanisms.
In the case of China, EU data protection authorities point out that national security, counterterrorism, and counter-espionage laws allow authorities to demand access to the information that technology companies manage if they deem it necessary. This potential legal capacity, in the regulators' view, directly clashes with the European framework and makes it difficult to guarantee the confidentiality of the data of citizens of the European Union.
During the investigation, TikTok maintained that it did not systematically store user data from the European Economic Area on physical servers located in China. However, as the investigation progressed, the company had to acknowledge that some data had reached Chinese systems due to internal errors or isolated incidents, a fact that reinforced regulators' concerns.
European authorities insist they have not provided public evidence that the Chinese government has actually accessed TikTok user data in Europe. However, they point out that the risk depends not only on access that has already occurred, but also on the legal framework that would allow such access without controls comparable to those required by the GDPR.
For the average user, this legal framework translates into something simpler to understand: if you use TikTok in Europe, some of your data may be accessible from China and other countries outside the EEA while the injunction against the ban remains in place and the legal challenge is ongoing. This includes technical information, data on app usage, and, depending on the permissions granted, potentially sensitive data.
The response from the Spanish Data Protection Agency (AEPD) and the other European authorities
Given the concerns raised by the in-app warnings, the Spanish Data Protection Agency (AEPD) has issued several statements reiterating that the legal assessment of European authorities remains unchanged . In its view, TikTok continues to transfer the personal data of European users to third countries, including China, under conditions that do not comply with the GDPR.
The Spanish agency emphasizes that the corrective measures agreed upon by the DPC, although temporarily suspended by court order, continue to be based on a joint investigation and analysis by the European Data Protection Board. In other words, the basis for the sanction and the proposed restrictions remains valid in the eyes of the regulators.
Furthermore, the Spanish Data Protection Agency (AEPD) emphasizes that TikTok designated Ireland as its main establishment in Europe , making the Irish Data Protection Commission (DPC) the primary supervisory authority, but always in coordination with its national counterparts. The Spanish agency participates in the cooperation and consistency mechanisms established by the GDPR and confirms that it is closely monitoring developments in the case within its remit.
One of the main concerns expressed by the Spanish Data Protection Agency (AEPD) is the impact of these practices on younger users, who make up a significant portion of TikTok's audience . The regulator considers it essential that children and teenagers receive clear and understandable information about how their data is used, in age-appropriate language and without unnecessary technical jargon.
Meanwhile, the Spanish agency wanted to send a direct message: although the suspension of some measures is temporary, the risk has not disappeared . Therefore, it considers it crucial that European citizens not simply wait for the court ruling, but rather take practical steps to better protect their privacy.
TikTok's discourse: security projects and compliance promises
While regulators highlight the shortcomings, TikTok has chosen to reinforce its public message on privacy. The company states that it takes the protection of European users' data very seriously and that, in recent years, it has made significant investments in infrastructure and controls.
Among these initiatives, its well-known Project Clover stands out , a plan that, according to the company, mobilizes billions of euros to locate and secure the data of users of the European Economic Area in data centers located in Ireland, Norway, other European countries and some external centers such as Brazil or the United States, under restricted and supervised access schemes.
The platform claims that employees based in China cannot access certain types of sensitive data , such as phone numbers or full IP addresses, and that techniques such as pseudonymization and strict permission control are used to limit the risk of unauthorized access as much as possible.
From the company's perspective, these measures offer solid guarantees and are compatible with the European framework . TikTok maintains that it has relied on the GDPR's own legal tools—such as standard contractual clauses and impact assessments—to authorize specific and justified remote access for tasks such as technical support, content moderation, and overall service maintenance.
Even so, regulators maintain a cautious stance. The Spanish Data Protection Agency (AEPD) and other authorities acknowledge that these steps are a move in a more responsible direction, but warn that, as long as Chinese legislation continues to allow for potentially broad access requirements , a company's internal safeguards are not sufficient to completely eliminate risks to the rights and freedoms of European users.
Advice from the Spanish Data Protection Agency (AEPD): Review permissions and consider continuing to use the app.
Beyond the specific case of TikTok, the Spanish Data Protection Agency (AEPD) has taken advantage of the notoriety of the matter to reiterate a series of recommendations that can be applied to any digital service , but which are especially relevant on platforms with intensive use of personal data and a very young user base.
First, the agency advises users to carefully read the privacy notices and policies that appear when registering or accepting changes to the terms of service. Although they may seem lengthy, they contain key information about what data is collected, for what purposes, and to which countries it may be transferred . In the case of TikTok, these notices already explicitly mention the situation with China and the ongoing legal proceedings.
Secondly, the agency emphasizes the importance of frequently reviewing app privacy settings . This involves checking what permissions have been granted—access to camera, microphone, contacts, location, storage, etc.—and assessing whether they are all truly necessary for how you use the service. Minimizing these permissions can help limit the amount of information sent to the platform's servers.
The Spanish Data Protection Agency (AEPD) also encourages caution regarding the content shared on social media and video apps. It recommends avoiding the dissemination of particularly sensitive data, such as medical information, financial details, official documents, or intimate aspects of personal life, which could be problematic if they fell into the wrong hands or were reused out of context.
Finally, the regulator sends a clear message, albeit not in such a blunt way: it urges users to seriously consider whether they wish to continue using services that transfer information to countries whose level of data protection is not comparable to that of Europe. In practice, this amounts to considering ceasing to use TikTok or other similar applications if a person is uncomfortable with the possibility of their data being subject to more intrusive legislation.
This entire debate is framed within a broader European controversy over international data transfers to jurisdictions such as the United States or China, where the guarantees offered by local laws are not always considered sufficient by the Court of Justice of the EU and privacy regulators.
The TikTok case has thus become a particularly visible example of the tensions between global platforms, European authorities, and the legal frameworks of third countries. While Irish courts decide whether to uphold the fine and restrictions , the social network continues to operate normally in Spain and the rest of Europe, maintaining its data transfers to third countries under intense public and regulatory scrutiny. In this context, the Spanish Data Protection Agency (AEPD) reminds users that they are not mere spectators: they have the power to adjust their account settings, restrict permissions, and decide whether it is worthwhile to continue using a service whose methods of managing personal data remain controversial.
