TikTok
Verified“Chinese-controlled app, EU-regulated but not EU-governed.”
- EU users
- 150M+ MAU
- Ownership
- ByteDance (private)
- DPC fine
- 530M euros
- Data enclave
- 12B euros / 10yr
28 = midpoint of Control 23 & Data 32
Sovereignty Quadrant
Control ↑ who owns & governs the company · Data → where your data lives. Every dot is a company — click to open it.
Every number below traces to 14 sourced facts across 12 independent sources, last verified 2026-06-12. 3 open questions hold confidence at 82% — they lower confidence, never the score.
Control ↑
Who legally and economically controls the company
Legal & Jurisdiction
30
The EU-facing service is an Irish entity that EU law clearly reaches (a 530M-euro DPC fine proves enforceability), but ultimate control sits with a Cayman-incorporated, Beijing-run parent under Chinese jurisdiction.
Why 30? 4 sourced facts · click to expand
TikTok's European service is operated by TikTok Technology Limited, an Ireland-incorporated entity named as the data controller by the Irish DPC.
Irish Data Protection Commission · as of 2025-05-02
ByteDance Ltd, TikTok's ultimate parent, is incorporated in the Cayman Islands and headquartered in Beijing, China.
Wikipedia (ByteDance) · as of 2026-06
The Irish DPC acts as lead supervisory authority and ordered TikTok to bring transfers into compliance within six months or face suspension of transfers to China.
European Data Protection Board · as of 2025-05-02
The 2026 US joint venture (ByteDance reduced to 19.9%) restructures only TikTok's US operations, not the EU business, which remains a ByteDance subsidiary.
ITIF · as of 2026-01-26
Control & Ownership
15
ByteDance is privately held and controlled by Chinese founder Zhang Yiming via supervoting shares; despite ~60% foreign institutional equity, voting control is firmly Chinese, and the EU entity is wholly owned by that parent.
Why 15? 3 sourced facts · click to expand
ByteDance founder and Chinese national Zhang Yiming holds roughly 20-25% of equity but retains supervoting control via a dual-class structure.
Harvard Law / Corp Gov Forum · as of 2025-01-03
About 60% of ByteDance equity is held by global institutional investors (e.g., Susquehanna, General Atlantic, KKR), but they do not hold voting control.
Atlantic Council · as of 2025
ByteDance is privately held with no EU listing; the EU TikTok business is a wholly-owned subsidiary of ByteDance, not an EU-controlled entity.
Music Business Worldwide · as of 2026
Data →
Where your data lives and who can reach it
Data & Infrastructure
28
Project Clover localizes most European data to data centres in Norway and Ireland with independent NCC Group oversight, but the enclave still includes US hosting and regulators proved EEA data was remotely accessed from, and partly stored in, China.
Why 28? 4 sourced facts · click to expand
Project Clover is a 12-billion-euro, 10-year initiative storing European user data in a dedicated enclave across data centres in Norway, Ireland, and the US.
TikTok Newsroom · as of 2025
The Irish DPC found TikTok allowed China-based personnel remote access to EEA user data and that TikTok admitted in April 2025 some EEA data had been stored on servers in China.
Irish Data Protection Commission · as of 2025-05-02
The Norwegian data centre is provided by Green Mountain and independent cybersecurity firm NCC Group oversees and verifies Project Clover's controls.
Silicon Republic · as of 2024
ByteDance remains subject to Chinese law (e.g., national intelligence and data laws), creating foreign-law exposure analogous to CLOUD Act risk for the underlying infrastructure operator.
Congressional Research Service · as of 2024
Operations & People
38
TikTok has a substantial European footprint (Dublin HQ ~3,000 staff, T&S teams in Dublin/Berlin/London), but global leadership, the algorithm, and strategic control sit with ByteDance in Beijing and TikTok's LA/Singapore global HQ.
Why 38? 3 sourced facts · click to expand
TikTok's European headquarters is in Dublin, with roughly 3,000 staff and content moderation, trust & safety, and a Transparency Centre serving Europe.
Irish Times · as of 2025-07-04
TikTok's global headquarters are in Los Angeles and Singapore, and global product and engineering direction sits with ByteDance in Beijing.
Wikipedia (ByteDance) · as of 2026-06
TikTok is a designated Very Large Online Platform under the EU DSA with over 150 million monthly active users in the EU.
Music Business Worldwide · as of 2025
Aligned to the EU Commission’s official Cloud Sovereignty Framework (SEAL, Jun 2026) →
What we don’t know
3 open questions — they lower confidence, never the score
- ?
Does the European data enclave still rely on US-hosted infrastructure, and on which provider, after the Norwegian and Irish centres came online?
If a meaningful share of EEA data still sits on US infrastructure or a US cloud, the infra score should be lower; full EU residency would raise it.
- ?
Has TikTok fully eliminated China-based remote access to EEA user data following the DPC's six-month compliance order, and was the order stayed pending appeal?
Persisting China access keeps infra and legal scores depressed; verified elimination would improve both.
- ?
What is the precise current breakdown of ByteDance voting versus economic ownership after the 2026 US joint venture?
Affects the ownership score, though the US deal does not change control of the separate EU business.
EU Cloud Sovereignty Framework lens
The EU Cloud Sovereignty Framework targets cloud service providers, so these category ratings are an analogous sovereignty mapping for TikTok as a platform operator, not a SEAL certification.
Strategic
Strategic control sits with ByteDance in Beijing; the EU is a regulated market, not a decision-making centre.
Legal & jurisdictional
EU entity is Irish and reachable (530M-euro fine), but ultimate parent is Cayman-incorporated and subject to Chinese law.
Data & AI
Regulators proved EEA data was accessed from and stored in China; the recommendation algorithm is ByteDance-controlled.
Operational
Genuine EU operations in Dublin/Berlin (moderation, T&S, transparency), but global leadership is non-EU.
Supply chain
European data centres use EU/Norwegian partners (Green Mountain) and NCC Group oversight, though US hosting persists in the enclave.
Technological
Core platform, app, and recommendation engine are built and controlled by ByteDance outside the EU.
Security & compliance
Project Clover plus independent NCC Group audits, but a major GDPR breach finding and ongoing DSA scrutiny weigh against it.
Environmental sustainability
Norwegian data centres use renewable hydro power, but no verified EU-wide sustainability disclosure reviewed here.
EU alternatives
Open-source, decentralized short-video on ActivityPub; privacy-first but small, and core development is led from outside the EU (Canada).
French-owned video platform with EU hosting options; not a like-for-like short-video TikTok clone but EU-controlled.
Mainstream TikTok-style alternative (~45M users) but US-based, so it does not improve EU sovereignty.
How the method works
Methodology v2 (provisional): the score is the midpoint of two axes — Control (who owns and governs the company) and Data (where your data lives and who can reach it). Each axis is scored only on verified evidence; unknowns reduce confidence, never the score. Every input below is sourced; the weights and judgments are open to challenge.
Spotted an error? Every claim is sourced — challenge it and we correct the record.
- 2026-06-12 — Initial golden profile, authored from primary sources (human + AI review).
Report Incorrect Data
Found an error in this company's profile? Help us improve our data by submitting a correction.
Verified 2026-06-12 · Human + AI joint review (sources independently checked) · Methodology