noyb vs TikTok, SHEIN and Temu: GDPR China Cases in 2026

noyb's cases against TikTok and SHEIN in 2026: the short answer

noyb's complaints against TikTok, AliExpress, SHEIN, Temu, WeChat and Xiaomi, filed on January 16, 2025, are about unlawful data transfers to China under the GDPR.[1][4] We found no published regulator decision on those six complaints as of 2026.

The issue itself did produce one large fine. On May 2, 2025 the Irish Data Protection Commission fined TikTok 530 million euros for transfers of EEA user data to China and for transparency failures, after its own inquiry.[5] In July 2025 noyb filed three follow-up complaints against TikTok, AliExpress and WeChat for not answering access requests.[6]

Timeline: from complaints to the TikTok fine

What changed since 2025

The biggest change is the TikTok decision in Ireland. The regulator found that TikTok failed to verify, guarantee and demonstrate that EEA user data remotely accessed by staff in China had protection essentially equivalent to EU law.[5] The fine was split into 485 million euros for the transfers under Article 46(1) and 45 million euros for transparency under Article 13(1)(f).[5][7] TikTok was given six months to bring its processing into compliance, or its transfers to China would be suspended.[5]

The Irish regulator also said TikTok had first told it that no EEA data was stored on servers in China, and then reported in April 2025 that limited EEA data had in fact been stored there. The DPC said it was considering further action.[5]

On the noyb side, the group says SHEIN, Temu and Xiaomi gave the complainants more information during the proceedings, while TikTok, AliExpress and WeChat did not. That led to three new complaints in Belgium, Greece and the Netherlands in July 2025.[6] noyb notes that a fine can reach 4% of global revenue, for example 1.35 billion euros for Temu.[1]

Risks and scams around SHEIN, Temu and TikTok

This section is our analysis. The legal cases are about data transfers, but shoppers searching for SHEIN or TikTok also meet more direct risks.

• Lookalike shop domains that copy SHEIN or Temu branding and take card details for goods that never arrive. Type the official address yourself.
• Fake free gift and coupon pages that ask you to fill in surveys, install apps or share your phone number.
• Browser notification spam and redirect sites that appear after you click a fake shopping link. Our virus removal guides explain how to clean them.
• Modified TikTok or shopping apps from outside official stores, which can carry adware or worse.
• Phishing messages about a parcel, refund or account problem that lead to a fake login page.

Steps to protect your data on Chinese shopping and social apps

1. Use official apps. Install TikTok, SHEIN or Temu only from the official app stores or type the official web address yourself. Lookalike sites are the most direct risk to your money.

2. Share less. Leave optional profile fields empty and refuse permissions such as contacts or precise location unless a feature really needs them.

3. Use a unique password. A new password for each shop limits damage if one account leaks. You can test your email on our leak check.

4. Pay with protection. Use a credit card or payment wallet that offers refunds and chargebacks, rather than bank transfer or gift cards.

5. Ask for your data. EU residents can file an access request under Article 15 GDPR. noyb's July 2025 complaints show that some companies answer partly or not at all, so keep copies of every reply.[6]

6. Complain if ignored. If a company does not answer within the legal time, you can complain to the data protection authority in your country, as the noyb complainants did.[1][6]

What is still unknown

• When the regulators in Austria, Belgium, Greece, Italy and the Netherlands will decide on the six January 2025 complaints. We found no decision as of 2026.
• Whether TikTok's transfers to China were actually suspended after the six month deadline. We found no follow-up statement from the DPC in the pages we read.
• Whether any fine will follow for SHEIN, Temu, Xiaomi, AliExpress or WeChat.

We will update this page when a regulator publishes a decision.

Our original 2025 report

The text below is our report as first published in 2025. We keep it unchanged for the record; the sections above bring it up to date.

The European Privacy Group has accused popular apps of illegal data transfers to China. None of Your Business (noyb), the Austrian privacy activist group, has filed a series of official complaints against six major organizations, alleging serious violations of the European Union's General Data Protection Regulation.[1]

The companies in question – TikTok, AliExpress, Temu, SHEIN, Xiaomi, and WeChat – are accused of having illegally transferred personal data of EU users to China. Complaints about such practices have been filed with regulators in Austria, Belgium, Greece, Italy, and the Netherlands, urging immediate actions to stop such data practices and to impose penalties where deemed appropriate.

Noyb's action brings forward continuing questions about the safety of data transferred to countries outside the EU. The practices attributed to the companies give rise to serious doubts about their adherence to the obligations of the GDPR, especially those touching on users' rights and the guarantee of transparency.

Allegations of GDPR breaches

The complaints focus on violations of Chapter V of the GDPR, which regulates cross-border data transfers. Noyb has identified specific breaches, including:

• Article 44: This article sets general principles for international data transfers, ensuring that user privacy is maintained to EU standards regardless of where the data is processed.
• Article 46: It requires organizations to implement robust safeguards, such as legally binding agreements, to protect personal data when transferred outside the EU.
• Article 46(1): Companies are obligated to conduct thorough data transfer impact assessments to evaluate and mitigate potential risks to user privacy, which the accused firms allegedly failed to do.

According to noyb, the lack of comparable data protection standards in China amplifies the risks. Chinese law permits government authorities to access private company data, which, combined with the absence of independent oversight, leaves EU user data vulnerable. Xiaomi's transparency reports, for instance, reveal that Chinese authorities have virtually unrestricted access to user information.

These violations not only undermine the GDPR's foundational principles but also jeopardize the privacy and security of millions of EU citizens who use these platforms daily.

Companies are ignoring privacy requests

Besides illegal data transfers, noyb also accuses them of violating GDPR Article 15, a provision granting EU users rights to access comprehensive information regarding their personal data. The group observed that none of the companies approached them with satisfactory responses to its requests pertaining to data transfer policy and practice.

Noyb's investigations revealed varying degrees of transparency. Companies like TikTok, AliExpress, SHEIN, and Xiaomi openly acknowledge transferring data to China in their privacy policies, while Temu and WeChat obscure these details by vaguely referring to transfers to "third countries." This lack of clarity and responsiveness raises concerns about the companies' overall commitment to privacy regulations.

The financial stakes are high. If found guilty of GDPR violations, these companies could face fines of up to 4% of their global annual revenue. For example, Xiaomi and Temu, two major players in the tech and e-commerce industries, risk fines of approximately $1.75 billion and $1.35 billion, respectively. Beyond financial penalties, regulators are urged to enforce immediate changes to ensure compliance with GDPR and protect user data.

Data might end up in the wrong hands

This wave of complaints represents a significant expansion of noyb's focus, marking its first major action against Chinese companies after targeting U.S.-based tech giants like Google[2] and Meta in the past. The allegations have broader implications for global data privacy enforcement, particularly concerning jurisdictions with minimal data protection safeguards.

Tiktok, already under the microscope for its data practices, now faces a new set of challenges as regulatory bodies around the world investigate its role in data privacy and election integrity. The platform is also fighting a potential nationwide ban in the U.S.,[3] while European regulators continue to investigate it over compliance with privacy laws.

The Chinese government has consistently denied directing companies to share data unlawfully, insisting that organizations operate independently. However, critics argue that China's laws on corporate data-sharing effectively grant authorities broad access to private user information. While Xiaomi has stated its willingness to cooperate with regulatory authorities if approached, other companies implicated in these complaints have remained silent.

Related guides on 2-Spyware

• Check whether your email appeared in a leak
• Recent data breaches
• Virus and malware removal guides
• How to report phishing