Facts
The Commission opened its TikTok inquiry after press reports and its Apple inquiry after reports on the outcome of US litigation over Siri voice data. TikTok distributed tracking tools such as TikTok Pixel, Events SDK and Events API to other websites and apps, used by about 71,000 Korean businesses. Through them it collected 9.45 million active users' clicks, purchases and searches on other services, linked them to accounts via device identifiers, and inferred interests for targeted advertising. Apple, until August 2019, used Siri voice recordings and their text transcripts to improve speech recognition and search results without separate consent. From October 2019 it obtained consent for recordings but not for transcripts.
Question
For TikTok, the question was whether consent to processing off-platform behavioural data for targeted advertising could be valid when collected as a mandatory tick alongside data genuinely needed for the service. For Apple, the issue was whether consent to the use of a voice assistant's recordings also covered the use of their text transcripts to improve the service. For both companies the Commission examined whether transfers of personal data to foreign affiliates within the same group were properly disclosed, including the categories of data, the recipient's purposes and retention periods.
Decision
At its 14th plenary meeting on 22 July 2026 the Commission imposed fines totalling KRW 10,558,000,000. TikTok's collection, use and overseas transfer of behavioural data without a legal basis breached Articles 15(1) and 28-8(1) of the Personal Information Protection Act; it was fined KRW 10,306,000,000 and ordered to take corrective measures and publish the decision. Consent bundled into a mandatory tick without clear notice hollowed out the user's right to choose and was invalid. Apple's affiliate ADI was fined KRW 252,000,000 under the former Network Act, and ASPL received a corrective order to review its overseas transfers. The Commission took into account that Apple, during the inquiry, gave users a choice over transcripts and began filtering personal information from them.
Why it matters
The decision indicates that data used to improve AI functions such as speech recognition needs a legal basis for each type of data. Consent to a voice recording does not extend to its transcript. For TikTok, the Commission restated that consent for advertising profiles built on inferred interests must be free and separate. It also made clear that any transfer to a place where Korean protection is not assured, even within a corporate group or within one country, is subject to the rules on overseas transfers.
Related stages
The full decision text was not available alongside the press release reviewed for this entry, and no decision number is given. Whether either company has sought judicial review could not be verified.