On July 17, 2025, the privacy organization noyb filed GDPR complaints against three Chinese tech giants—AliExpress, TikTok, and WeChat—for failing to comply with data subject access requests under Article 15 of the General Data Protection Regulation (GDPR). These companies failed to provide comprehensive responses to inquiries about how they handle personal information. While most major technology firms can easily automate the processing of GDPR data requests, these Chinese entities struggled significantly. TikTok and AliExpress provided incomplete or unintelligible data, while WeChat ignored the request entirely. In response, noyb is urging these companies to comply with GDPR requirements and proposing administrative fines for non-compliance, potentially totaling up to 4% of their annual revenue. This enforcement action highlights ongoing concerns about data privacy practices by Chinese tech firms in Europe and underscores the complexities associated with transferring EU user data to China due to differing legal standards regarding personal information protection.
Recent Efforts to Combat Unlawful Data Transfers from European Platforms to China
The noyb organization has initiated several actions aimed at curbing unlawful data transfers from prominent European platforms like TikTok, AliExpress, and others to China, where privacy laws are perceived as less stringent compared to the EU’s GDPR framework. These efforts have included legal challenges in multiple countries and advocacy for stricter regulatory oversight to ensure compliance with international data protection standards.
Similar questions
What is GDPR?
Who filed the complaint against Chinese tech giants?
Which companies were involved in this complaint?
Why did noyb file complaints against these companies?
How do most major technology firms handle GDPR data requests?
What was WeChat’s response to the request according to the text?
Does TikTok provide complete information regarding personal data handling?
What is the potential fine for non-compliance with GDPR requirements as mentioned in the text?
Why are there concerns about transferring EU user data to China?
How do Chinese tech firms’ privacy practices compare to those of European standards?