EU Privacy Crackdown: noyb Files GDPR Complaints Against TikTok, AliExpress, and WeChat

A new chapter in the ongoing debate about global data privacy has unfurled, with Austrian privacy advocacy group None of Your Business (noyb) launching formal GDPR complaints against three tech giants: TikTok, AliExpress, and WeChat. The trio, all managed by China-based companies, have reportedly fallen short of the strict requirements laid out in the European Union’s General Data Protection Regulation (GDPR). This latest confrontation shines a fierce spotlight not just on the compliance failings of specific corporations, but also on the wider tension between the EU’s powerful privacy regime and the practices of international tech platforms, particularly those headquartered outside the bloc.

Who Is noyb and Why Does This Matter?

None of Your Business, better known as noyb, was founded by Max Schrems—a prominent privacy activist well known in the digital rights ecosystem for his campaigns against global tech companies and his role in landmark court cases shaping international data flow policy. noyb’s latest filings don’t just challenge the technicalities of corporate privacy paperwork; they signal the EU’s willingness, through civil society intermediaries, to demand absolute transparency and accountability from companies accessing European citizens’ personal data.

Their complaints speak loudly to consumers: if globally beloved apps like TikTok, shopping platforms like AliExpress, or vast social connectors like WeChat are not meeting GDPR standards, Europeans have the right to know—and to demand remediation.

The Core Issues: What Are the Alleged Violations?

The crux of noyb’s complaints centers on Article 15 of the GDPR, which grants every individual a right to access and receive a copy of the personal data a company holds on them. It’s a right intended to offer transparency, monitor abuses, and facilitate further action if individuals believe their rights have been breached.

According to noyb, TikTok, AliExpress, and WeChat all provided unsatisfactory responses to data access requests. Typical issues included:

• Refusals or delays in fulfilling data access requests: Users reportedly waited extensive periods for a response, sometimes receiving no meaningful data at all.
• Obfuscation and incomplete data: Where companies responded, the information was often unclear, partial, or so technical as to be useless to the average consumer.
• Opaque cross-border data transfers: All three companies failed to make sufficiently clear whether — and how — data is transferred outside the EU, especially to jurisdictions like China where legal frameworks are markedly different.
• Insufficient user control: Even when data was accessible, options for deletion, correction, or restrictions on processing appeared hard to find or practically unavailable.

These failings go beyond bureaucratic missteps. They spotlight a troubling pattern where international companies appear to pay only lip service to EU privacy law, putting European data at risk of opaque processing and cross-border transfer to legal regimes without adequate protections.

TikTok, AliExpress, WeChat: Global Scope, Patchwork Compliance

Europe takes its privacy rules seriously. The GDPR, enforced since 2018, imposes severe penalties on companies that flout user rights—up to €20 million or 4% of global turnover, whichever is higher. Yet global platforms, particularly those based outside the EU, are routinely flagged by advocacy groups and regulators for incomplete compliance.

• TikTok, under ByteDance, has faced repeated scrutiny over its data-sharing practices with Chinese authorities and ambiguous privacy communications. Previous enforcement efforts have already forced TikTok to make some changes to its privacy architecture for European minors, but these new complaints allege persistent issues with non-transparent data access processes.
• AliExpress, owned by Alibaba, is alleged to have left users in the dark regarding their stored purchase and browsing data, as well as international data transfer specifics. Allegations suggest responses are incomplete and do not clearly satisfy the user’s right to know how their data is collected and used.
• WeChat, operated by Tencent, is accused of similar obfuscations. Given its role not only as a messaging platform but also a payment and social networking channel, WeChat’s handling of data carries particularly wide implications.

This cross-platform noncompliance exposes a striking weakness in the global digital ecosystem: while the EU sets the world’s strictest privacy bar, companies far beyond its borders often find it challenging—or show little willingness—to adapt fully, even when they profit from European users.

The Special Challenge of Data Security in China

Part of the problem, say privacy advocates and EU regulators, lies in the chasm between Chinese cybersecurity and data regulations and those of the European Union. While China has established its own data security laws, including the Personal Information Protection Law (PIPL), enforcement practices, state access, and the ability of foreign residents to exercise effective oversight differ sharply from European norms.

• Legal asymmetry: In Europe, data privacy is a fundamental right. In China, state security and regulatory access to company-held data come first.
• Opaque government access: European regulators have voiced ongoing concerns that personal data processed in or accessed from China could be made available to Chinese authorities, often with little transparency or recourse.

These systemic contrasts explain much of the friction. For companies like TikTok, AliExpress, and WeChat, GDPR compliance is not just a question of internal policy, but of reconciling fundamentally different legal obligations.

Analysis of online discussions and feedback from European users reveals both growing awareness and acute frustration with the current situation. On forums and social media, many users report:

• Difficulty navigating the process of exercising their data rights, with language barriers, unclear instructions, and inconsistent company response formats cited as key obstacles.
• Skepticism that “download your data” tools provided by these platforms actually deliver the full scope of data collected.
• Alarm at how easily sensitive information—ranging from personal identifiers to behavioral activity—could potentially be transferred outside of European legal jurisdiction.

Yet there’s also a sentiment of resignation: as cross-border tech companies dominate digital spaces, individual users sense that their efforts to control their data are tenuous and uncertain without firmer regulatory enforcement.

How GDPR Complaints Work in Practice

When a complaint such as noyb’s is filed, it triggers a process involving both national data protection authorities (DPAs) and, for companies that operate across the EU, coordination through the European Data Protection Board (EDPB). The result can be anything from forced company remediation to the imposition of blockbuster fines.

Cases typically unfold as follows:

1. The DPA reviews the initial complaint for sufficiency and jurisdiction.
2. It may launch an investigation, soliciting further evidence from complainants and the target companies.
3. Provisional findings are released, sometimes allowing firms the ability to voluntarily address deficiencies.
4. If noncompliance persists, formal findings and financial penalties follow.

Past precedent shows that well-founded complaints, especially those coordinated through expert groups like noyb, can yield significant regulatory action.

The Stakes for International Tech: Fines, Reputation, and Market Access

For companies, stakes are extraordinarily high. Beyond the towering threat of fines, which can inflict serious financial damage even on global enterprises, there is also the risk of being required to halt data transfers or even disable services in Europe.

History is instructive here:

• Meta/Facebook endured a €1.2 billion fine in 2023 for privacy violations under the GDPR relating to data transfers to the US.
• Amazon was similarly fined €746 million in 2021.
• TikTok, even prior to these current complaints, has faced substantial fines and investigations throughout Europe, including a £12.7 million penalty from the UK’s Information Commissioner’s Office for failing to protect children’s privacy.

Each action doesn’t just hurt the bottom line—it signals that Europe is prepared to defend its privacy paradigm, even against the world’s largest companies.

Setting a Global Standard

The GDPR’s influence extends far beyond the borders of the European Union. Its strict approach to user consent, transparency, and data access rights has established a global benchmark, pushing even non-European companies to upgrade their compliance systems lest they lose access to a crucial market.

• User Empowerment: The right to access personal data, as enshrined in Article 15, provides a potent mechanism for individuals to understand and control how tech giants use their information.
• Cross-border Vigilance: The GDPR gives European authorities a tool to demand accountability from any company, regardless of where it is headquartered, as long as it does business with EU residents.

Strategic Activism: The Role of Civil Society

Organizations like noyb have become crucial to enforcing GDPR rights. By orchestrating well-researched complaints and shepherding cases through complex legal processes, they bridge the gap between abstract regulations and the everyday consumer.

• Pressure and Precision: Advocacy groups are able to target recurring problem areas—such as opaque cross-border data flows—systematically and at scale.
• Public Awareness: Strategic PR and well-timed complaints turn seemingly arcane regulatory disputes into headline-grabbing showdowns, bolstering consumer understanding and engagement.

Uneven Implementation and User Frustration

For all its strengths, GDPR enforcement remains uneven.

• Backlogs and Delays: National DPAs are often overwhelmed, lacking the resources to immediately investigate and resolve every complaint—leaving users in limbo.
• Complexity for Average Users: The process of submitting data access requests is difficult for those not fluent in technical jargon or legal language.
• Risk of Legal Loopholes: Tech giants, with armies of lawyers, can sometimes exploit ambiguities or technicalities to delay or dilute enforcement.

Global Tech’s Structural Challenges

Even with the best intentions, international compliance is not always straightforward:

• Clashing Laws: Companies subject to both EU and Chinese law may face contradictory requirements, such as responding to Chinese government access requests while simultaneously upholding GDPR guarantees.
• Technical and Organizational Hurdles: For sprawling global platforms, harmonizing data governance practices across jurisdictions is costly and complex; central “download your data” portals are often blunt tools that miss the deeper nuances of backend data infrastructure.

The new wave of complaints from noyb marks both an escalation and an opportunity. If successful, they will force TikTok, AliExpress, and WeChat to overhaul their European privacy interfaces, offering users more complete and comprehensible access to their personal data—and ensuring that data flows comply meaningfully with European law.

But the complaints also underscore a harder truth: the battle for digital sovereignty and individual privacy rights is only intensifying. As the EU continues to flex its regulatory muscles, and as privacy groups become more sophisticated and assertive, the pressure on global tech companies will only grow. Those that fail to adapt may find themselves not just in hot water with regulators, but facing a skeptical and increasingly empowered user base.

The privacy showdown between the EU and Chinese tech giants isn’t just a legal or technical story: it’s a defining narrative for the global digital age, with consequences for every user, company, and government operating online. While GDPR stands as a beacon of rights-based digital regulation, its real-world impact will ultimately depend on the tenacity of activists, the agility of regulators, and the willingness of global companies to see privacy not as a compliance burden, but as a basic social contract with their users.

For Windows enthusiasts and digital citizens alike, the lesson is clear: vigilance, advocacy, and technical literacy are more vital than ever. As the data privacy landscape evolves, the power to control our digital destinies rests not just in the hands of the regulators or tech titans, but in the collective will of an informed, engaged community.