TLDR: South Korea’s Personal Information Protection Commission has spent 2026 handing out its largest fines ever, hitting Coupang, KT, TikTok, Apple, Google, and Meta in quick succession. A rewritten privacy law that took effect in September now ties penalties directly to company revenue and to CEO accountability, and the fallout has already reached Washington.
The Fines That Finally Got Washington’s Attention
For years, South Korea’s privacy regulator issued fines that barely registered as a cost of doing business. That changed fast. South Korea fined Google and Meta more than $71 million collectively for gathering users’ personal information without consent for tailored ads, the country’s highest-ever data protection fines at the time. Investigators found both companies had been collecting and analyzing user data to infer interests for customized advertising, without clearly informing users or getting their consent first.
And the numbers kept climbing from there.
South Korea’s Privacy Watchdog Has Teeth Now
The Personal Information Protection Commission, known locally as the PIPC, isn’t a new agency. What’s new is how often it’s swinging, and how hard.
A Short History of the PIPC’s Escalating Penalties
In July 2026, the PIPC fined TikTok roughly KRW 10.3 billion over unlawful data collection and transfers, along with a corrective order. That same month, an Apple affiliate was fined KRW 252 million for similar cross-border data transfer violations. A few months earlier, telecom giant KT Corporation was hit with a fine of about KRW 54 billion, roughly $39 million, over a customer data breach tied to negligent equipment management.
None of those, though, come close to what happened with Coupang.
The Coupang Case Changed the Calculus
South Korea’s biggest e-commerce platform became the test case for just how serious the PIPC intends to get.
Why 33 Million Users Mattered
The breach, which happened around June 2025, exposed personal information belonging to more than 33 million customers, roughly two-thirds of South Korea’s population. The PIPC found Coupang had failed to securely manage user authentication, neglected access controls, and violated breach notification and data destruction rules. The resulting fine, around KRW 625 billion, became the largest data breach penalty in Korean history, well above the previous record of roughly KRW 135 billion against SK Telecom.
The Diplomatic Fallout No One Expected
This is where the story stopped being a local compliance matter. U.S. officials argued South Korea’s enforcement was creating a favorable environment for domestic and Chinese competitors, and some even floated an international arbitration claim against the South Korean government. At a House Foreign Affairs Committee hearing, one congressman went as far as accusing the country of shifting its politics in a direction that opened the door to Chinese influence. The PIPC, for its part, reportedly held a marathon 13-hour meeting before finalizing the fine, giving Coupang a full chance to argue its case.
Pressure from Washington didn’t change the outcome. That alone tells you something about where Korean regulators think this is headed.
The Law Itself Just Got Sharper
Fines are one thing. A rewritten statute is another, and that’s exactly what arrived in 2026.
On March 10, 2026, South Korea promulgated its most significant rewrite of the Personal Information Protection Act since the 2023 overhaul, tying fines of up to 10% of revenue to CEO accountability. The regulator’s reasoning was blunt: fines alone don’t change corporate behavior unless they’re big enough to actually hurt. The new rules took effect six months later, and they specifically target repeat offenders, meaning any company careless enough to leak the same category of data twice in three years faces the steepest end of the scale.
That’s a different kind of pressure than a one-time penalty. It puts the person signing off on security budgets directly on the hook.
What This Means for Companies Operating in Korea
If you’re running a platform, an app, or any service that touches Korean user data, a few things are now non-negotiable. Consent has to be explicit, not buried in a settings menu nobody reads. Breach notification has a firm clock attached to it. And the days of treating a Korean privacy fine as a rounding error are over, full stop.
Companies that have operated the same way in Korea as everywhere else are going to find that approach expensive going forward.
Where This Is Headed
South Korea isn’t waiting for global consensus on how to regulate big tech. It’s writing its own playbook, enforcing it against domestic giants and foreign ones alike, and absorbing diplomatic friction in the process rather than backing down. Whether other regulators in the region follow that example is the question worth watching next.
