Spain's AEPD seeks TikTok information and plans to block links after report of child sexual abuse material
The regulator says it will order access to specific unlawful links blocked, but notes Ireland's DPC leads on TikTok and its own powers are limited to exceptional cases such as the GDPR urgency procedure.
Spain’s data protection authority, the AEPD, has opened actions after a Maldita.es investigation reported child sexual abuse material circulating on TikTok. It will ask Maldita.es for the links where unlawful processing is said to occur, require TikTok to provide specific information on how it removed the reported content, and, once that information is analysed, order the blocking of specific links and content that involve unlawful processing of minors’ data. The AEPD describes this as a targeted, proportionate measure.
The AEPD notes that TikTok has designated Ireland as its main establishment in Europe, making the Irish DPC the supervisory authority responsible for the platform under the GDPR. Its own options are limited to exceptional cases such as the urgency procedure under Article 66 GDPR.
The AEPD will pass the information to the DPC, the EDPB and other authorities where appropriate, and to the European Commission for the Digital Services Act. It says criminal investigation falls to police, prosecutors and the courts.
Why it matters
The case shows the limits of a national authority under the one-stop-shop: the AEPD plans to block specific links, says other measures are confined to exceptional routes such as the Article 66 urgency procedure, and is passing the case to the Irish lead authority and the Commission. Platforms hosting user content should be able to show regulators, on short notice, a documented record of takedown actions for specific reported URLs. Trust and safety and privacy teams should also check that reports involving minors' images feed into both content moderation and data protection workflows.
Status: Investigation. Information requested from TikTok; AEPD plans a blocking order after analysing it
Sources
Was this useful?
Thanks. What was the problem?
Thank you — this helps us choose what to cover. If you spotted an error, please tell us what it is.
Prepared with AI assistance and reviewed by the editor before publication. Spotted an error? Tell us — see our editorial policy and methodology.
Governance areas
Enforcement
- Action
- Investigation
- Authority
- AEPD (Spanish Data Protection Agency)
- Concerning
- TikTok
- Law
- GDPR (Ireland's DPC is lead authority; Article 66 urgency procedure as the exceptional route)
Case status: Open
Enforcement trackerInstitutions
Who should care
- DPO
- Legal & compliance
- Trust and safety lead