Targeted Ads Hidden Behind “Mandatory Consent” Lead to 10.558 Billion Won in Fines for TikTok and Apple

[Financial News] The Personal Information Protection Commission (PIPC) imposed a combined 10.558 billion won in fines on TikTok and Apple for collecting and using personal data without a lawful basis. The commission said it reached the decision because consent obtained without users clearly understanding how their personal information would be processed cannot be regarded as valid consent.
On the 22nd, the PIPC held a plenary meeting and decided to impose fines on TikTok and two Apple affiliates for violating the Personal Information Protection Act and the former Act on Promotion of Information and Communications Network Utilization and Information Protection. It also approved corrective orders and a public announcement, the commission said on the 23rd.
TikTok was fined 1.036 billion won, while Apple was fined 252 million won.
According to the PIPC investigation, TikTok distributed behavioral data collection tools, including TikTok Pixel, to domestic websites and apps while providing advertising and content performance analysis services. About 71,000 companies in South Korea were using the tools, and investigators found that they collected records of clicks, purchases, searches and content views from about 9.45 million domestic active users. TikTok linked this information to device identifiers and user accounts, then used it to analyze users’ interests and characteristics for targeted advertising.
The PIPC concluded that TikTok failed to clearly inform users that it was collecting such behavioral data. It also said the company bundled that consent with mandatory approval required to use the service, making it difficult for users to exercise meaningful choice.
The commission also cited a violation in TikTok Lite’s point-cash withdrawal service, saying the company transferred users’ personal data to overseas affiliates without disclosing the data involved, the purpose of the transfer or the retention period.
Apple was found to have used voice recordings and transcripts from its voice assistant service Siri to improve the service without obtaining proper consent. Transcripts refer to text data converted from collected voice recordings.
Apple began obtaining separate consent for the use of voice recordings after October 2019, but it continued using transcripts converted from voice into text to improve the service without a separate legal basis.
The commission also confirmed that Apple failed to sufficiently state in its privacy policy the personal data transferred to its U.S. affiliates, the purpose of use and the retention period when transferring users’ personal information overseas. However, the PIPC said Apple corrected the issues during the investigation by introducing an opt-in choice for transcript use and revising its privacy policy.
The PIPC said the sanctions were significant because they served as a warning that foreign companies, even in complex data-processing environments involving multiple affiliates across global operations, must fully implement measures to ensure transparency in personal data processing and protect individuals’ right to self-determination over their information.
In particular, the commission stressed that a data subject’s consent must be given freely and with full awareness of how personal information will be processed. It added that even if consent is obtained in form, it cannot be recognized as valid if meaningful choice is not guaranteed.
The commission also explained that cross-border transfers of personal data do not refer only to the physical movement of data overseas. Providing, storing or processing data through foreign companies or affiliates must also comply with the relevant rules.
A PIPC official said, "We will continue to monitor how foreign companies handle personal information and will respond strictly to violations without discrimination between domestic and overseas firms." The official added, "We will work to ensure that our citizens’ personal data is protected safely and transparently across borders, even in complex environments."

[email protected] Jo Yoon-ju Reporter