▲ TikTok
The Personal Information Protection Commission (PIPC) has imposed a fine of 10.3 billion won on TikTok for unlawfully utilizing the third-party behavioral information of 9.45 million users for targeted advertising, and a total of 250 million won on Apple's affiliate for using voice recordings and transcripts converted from voice data collected during Siri usage to improve services without authorization.
During a full meeting yesterday (July 22), the PIPC issued corrective orders and public announcements alongside the fines against TikTok and Apple's affiliate for violating the Personal Information Protection Act and the former Act on Promotion of Information and Communications Network Utilization and Information Protection, respectively.
According to the PIPC's investigation, while providing ad and content performance analysis services, TikTok distributed behavioral data collection tools to other web and app operators, collecting user activity records such as clicks, purchases, shopping cart additions, searches, and content views from the web and apps where these tools were installed.
The information collected in this manner was linked to member accounts along with device identifiers to infer user interests and characteristics, which were then used for customized advertisements.
Approximately 71,000 companies in South Korea use these tools, and the investigation revealed that TikTok secured the third-party behavioral data of 9.45 million active users in South Korea through them.
Furthermore, the PIPC determined that TikTok failed to notify users clearly so that they could recognize this fact, and instead bundled it with other personal information processing consents required to use the service, packaging it as a mandatory consent that effectively restricted users' freedom of choice.
Consequently, the PIPC deemed this a "very serious violation," concluding that it constituted the collection, utilization, and overseas transfer of personal information without a lawful basis under the Personal Information Protection Act, thereby imposing the fine.
The investigation showed that until August 2019, Apple utilized voice recordings and transcripts collected during Siri usage to improve voice recognition functions and search results without obtaining separate consent from users.
Starting in October of the same year, Apple began obtaining separate consent for the use of voice recordings, but continued to use transcripts for service improvement without a lawful basis.
Additionally, it was revealed that when Apple transferred users' personal information to Apple Inc. in the United States and other entities, it failed to sufficiently state the items transferred, purposes of use, and retention periods in its privacy policy.
The PIPC stated that this disciplinary action reaffirms the principle that foreign operators processing the personal information of domestic users must also secure transparency in personal information processing and guarantee users' rights to self-determination over their personal information.
※
Copying, redistribution, and unauthorized use in AI training are strictly prohibited.