South Korea's data protection regulator has levied a major penalty against TikTok for gathering user activity from third-party applications and websites to inform advertising without sufficient legal basis. The platform distributed tracking tools to tens of thousands of businesses that collected user behaviour—including clicks, searches, and purchases—which was then linked to personal accounts for targeting purposes. The regulator determined that TikTok had tied consent for third-party data collection to its terms of service, effectively requiring users to accept such collection as a condition of app access. The decision found violations of South Korea's privacy law regarding both data collection and overseas transfers.

In the same enforcement action, a subsidiary of Apple was also fined for gathering Siri voice recordings and related transcripts without obtaining explicit separate consent from users. These cases represent part of a broader pattern of international regulatory action against major technology companies over data practices. TikTok has previously faced substantial fines from regulators in Europe and the United Kingdom, while both companies continue to face scrutiny over how they gather and utilise user information. The decision underscores growing regulatory vigilance regarding data collection practices that rely on bundled consent or lack transparency about third-party data sharing.