On 15 September 2026 the Court of Justice of the European Union opened proceedings to answer four questions referred by the Irish High Court concerning the €530 million penalty imposed on TikTok. The referral targets the methodology for calculating administrative fines under the Regulation. The decision will affect TikTok and other large online platforms that are subject to similar penalties.

Full News Breakdown

The dispute originated from a fine levied by the Irish Data Protection Commission for breaches of EU data‑protection rules. TikTok contested the way the amount was derived, prompting the Irish court to refer the matter to the EU’s highest court for clarification. The CJEU has now agreed to consider the four questions.

• Case Name: TikTok GDPR fine appeal

• Court: Court of Justice of the European Union

• Date: 15 September 2026 (referral opened)

• EU Instruments Cited: Regulation (EU) 2016/679

• Key Provisions: Article 83 (administrative fines)

• Primary Legal Issue: Methodology for calculating GDPR administrative fines

• Applicant Arguments: The fine‑calculation formula breaches the proportionality principle and exceeds the limits set by the Regulation.

• Respondent Arguments: The Irish Commission applied a methodology consistent with the Regulation’s objectives and precedent.

• Court’s Reasoning: Not yet delivered; the Court will interpret the relevant provisions in response to the four questions.

• Holding: Pending – the Court will issue an opinion on the questions referred.

• Operative Order: Referral of four questions to the Court of Justice for a preliminary ruling.

• Practical Outcome: The fine remains in force pending the Court’s answer; the methodology may be adjusted thereafter.

How Does This Affect You?

Before the referral, practitioners faced uncertainty about how supervisory authorities should balance the factors in Article 83 when setting penalties. The Court’s forthcoming opinion will clarify the permissible weighting of turnover, nature of the infringement and previous violations. This clarification makes the calculation of future fines more predictable while preserving case‑by‑case assessment.

For Lawyers & Advocates

• Practitioners may wish to review pending GDPR enforcement matters and document fine calculations with a transparent weighting of turnover, culpability and mitigation measures.

• They may consider amending data‑protection compliance policies to include a step‑by‑step methodology that aligns with the forthcoming interpretation of Article 83.

• Citing the forthcoming opinion as persuasive authority when challenging excessive fines in other Member State proceedings may be advisable.

• Advising clients that the risk of a proportionality challenge is reduced, while supervisory authorities retain discretion to adjust factor weighting, may be prudent.

• Updating internal audit checklists to require a pre‑assessment of potential fine exposure based on the clarified methodology may enhance risk management.

For Law Students

This case illustrates how EU courts interpret the scope of supervisory discretion under the Regulation. The core doctrinal focus is the proportionality analysis embedded in Article 83. The decision is particularly relevant for the study of:

• EU data‑protection enforcement mechanisms

• Administrative law principles in the EU context

• Comparative analysis of fine‑setting regimes across Member States

• The role of preliminary rulings in harmonising EU law

• The interaction between national supervisory authorities and the Court of Justice

Comparable cases include Google Spain SL v. AEPD (2014 C‑131/12) and Schrems II (2020 C‑311/18), which together demonstrate how the Court balances fundamental rights against regulatory objectives. Comparing them with the present matter highlights the evolving judicial approach to proportionality in the digital economy.

For Businesses

• Platform operators may consider reassessing their financial exposure by modelling fine scenarios that incorporate the clarified weighting of turnover and culpability.

• Boards may wish to approve updated risk‑assessment frameworks that reflect the new methodology before the next supervisory audit.

• Compliance teams may want to revise internal reporting templates to capture the specific factors that will be scrutinised under the clarified approach.

• Marketing and product teams may consider documenting consent‑management practices more rigorously, as these influence the culpability factor in future calculations.

Key Takeaways

• The Court will define how Article 83’s proportionality test must be applied when setting GDPR fines.

• Practitioners may wish to embed a transparent, factor‑based calculation model into all enforcement risk assessments.

• Supervisory authorities will be constrained to a methodology that the Court deems consistent with the Regulation, limiting arbitrary fine inflation.

• Monitoring the European Data Protection Board’s forthcoming guidance on fine calculation, expected in early 2027, may be advisable for implementation details.

• In‑house counsel may consider revising their GDPR compliance frameworks before the next supervisory audit cycle, anticipated in Q1 2028.

Source: Questions in TikTok's appeal over GDPR fine calculation land at EU court