• Badge: ⚠️ Caution
• Red Flags:
  • RF1 — Own advertising / cross-service profiling
  • RF2 — High-risk third-country exposure without meaningful mitigation
• Risk Indicators:
  • Own-purpose data use (advertising); problematic profiling; high-risk international transfers (China)

Key Facts: TikTok operates a fully integrated advertising platform with cross-publisher behavioural profiling (RF1). Irish DPC fined TikTok €530 million (May 2025) for transferring EU user data to China without adequate safeguards — the most severe RF2 case on this list, as China represents one of the highest-risk third-country jurisdictions due to its broad national security laws (RF2). TikTok Technology Ltd. (Dublin) is EEA controller; Project Texas infrastructure initiative partially mitigates US transfer risk but Chinese parent ByteDance access remains a concern.

Framework Note (v2.2): FRAMEWORK NOTE (v2.2): RF2 (high-risk third-country exposure) is recorded here as a significant risk factor and lowers the domain E score. Under the revised framework, RF2 alone does not trigger Caution — the Caution badge for this service is driven by RF1 / RF3 / RF4 (as noted above). The US transfer risk (where applicable) is covered by DPF participation and/or SCCs, which GDPR treats as a compliant transfer mechanism.

Quellen:

• TikTok Privacy Policy (tiktok.com/legal/page/eea/privacy-policy)
• Irish DPC TikTok fine (€530M
• May 2025, dataprotection.ie)
• TikTok European data transfer documentation.

• Support marketing analytics
• Receive personalised marketing offers
• Customise online ads (non-TCF)

• TPP Notified?: Not yet notified
• Decision Contested?: [nicht dokumentiert]