Kakao—Kakao Pay transferred 54.2 billion records on 40 million users to Alipay without consent, drawing record fines
Kakao Pay transferred approximately 54.2 billion records of personal information covering roughly 40 million users to Alibaba-owned Alipay between April 2018 and May 2024, without obtaining specific user consent, ostensibly to build credit-risk scores for Apple service payments. South Korea's Personal Information Protection Commission fined Kakao Pay roughly 5.96 billion won and issued a corrective order in January 2025; the Financial Supervisory Service imposed an additional 12.976 billion won fine and institutional warning in February 2026 for violating the Credit Information Act and Electronic Financial Transactions Act; Apple was separately fined for failing to disclose the outsourcing. The Seoul Administrative Court upheld the PIPC penalty on June 11, 2026, rejecting Kakao Pay's argument that users had consented, and Gyeonggi police raided Kakao Pay headquarters on July 6-7, 2026 as part of a criminal investigation into company executives.
Scoring Impact
| Topic | Direction | Relevance | Contribution |
|---|---|---|---|
| Data Security | -against | secondary | -0.50 |
| User Privacy | -against | primary | -1.00 |
| Overall incident score = | -0.362 | ||
Score = avg(topic contributions) × significance (high ×1.5) × confidence (0.64)× agency (negligent ×0.5)
Evidence (2 signals)
South Korea's FSS fines Kakao Pay ~12.98 billion won over Alipay data transfers, police raid HQ
South Korea's Financial Supervisory Service imposed a roughly 12.976 billion won fine and institutional warning on Kakao Pay in February 2026 for violating the Credit Information Act and Electronic Financial Transactions Act in its data transfers to Alipay. Gyeonggi Southern Provincial Police conducted a two-day raid on Kakao Pay's Seongnam headquarters on July 6-7, 2026 as part of a criminal investigation into company executives.
Seoul court upholds PIPC's ~5.96 billion won fine on Kakao Pay over Alipay data transfers
The Seoul Administrative Court upheld South Korea's Personal Information Protection Commission's roughly 5.96 billion won penalty against Kakao Pay for transferring users' personal data to Alipay without adequate consent, rejecting the company's argument that users had consented to the transfer.