TikTok has grown exponentially since launching in 2016, and is now one of the most popular social media apps globally. As of December 2022, TikTok has over 1 billion monthly active users worldwide (Statista). The app allows users to create and share short videos, and its addicting algorithm is a big driver of its success.
However, TikTok is owned by ByteDance, a Chinese company. This has led to concerns that TikTok may be sharing data with the Chinese government. In the US in particular, there are worries that TikTok poses a national security risk. Claims of censorship and restricting content that paints China in a negative light have added to the suspicions. Understanding the truth about if and how TikTok shares data with China is important as the app continues to expand its userbase around the world.
TikTok’s Association with China
TikTok is owned by the Chinese company ByteDance Ltd., which was founded in 2012 by Zhang Yiming. While ByteDance is headquartered in Beijing, TikTok operates as a separate entity with headquarters in Culver City, California (The Truth About TikTok). However, some critics argue that TikTok is still subject to Chinese laws which require Chinese companies to share data with the government upon request (Wikipedia). This has raised concerns that TikTok may be required to provide user data to the Chinese government if requested, although TikTok maintains that it stores American user data in the U.S. and Singapore, not China.
Claims of Censorship
TikTok has faced accusations that it censors content deemed politically sensitive by the Chinese government. There are concerns that TikTok suppresses posts related to topics like the Tiananmen Square protests, Tibetan independence, and the treatment of Uyghurs in Xinjiang.
A notable example is TikTok’s alleged censorship of videos related to the Hong Kong protests in 2019. Employees claimed that managers in China gave orders to censor Hong Kong protest content. According to leaked documents, TikTok used blanket bans on phrases like “hongkongprotests” and censored livestreams showing police brutality.
However, TikTok denies accusations of Chinese political censorship. The company states its content policies are not influenced by foreign governments and that moderation is handled by a U.S.-based team. TikTok claims controversial topics are allowed as long as they follow community guidelines.
Independent audits have found no evidence of systemic censorship. While anecdotal cases exist, there’s limited data showing TikTok currently suppresses content at China’s behest. However, concerns remain about potential censorship if ByteDance faces pressure from Chinese authorities.
Security Concerns
There are widespread worries that TikTok’s data collection and storage practices could allow the Chinese government to access user data. As a Chinese-owned company, TikTok is subject to Chinese cybersecurity laws that require companies to share data with the government upon request. This raises fears that the Chinese Communist Party (CCP) could leverage TikTok’s data for surveillance, profiling, and intelligence gathering on foreign citizens.
Specifically, some analysts warn that TikTok’s algorithm could be used to create detailed psychological profiles on users which could then be handed to the CCP by ByteDance. There are also concerns around potential backdoors in TikTok’s code that could give Chinese authorities covert access (Kaspersky). While concrete evidence of Chinese government access is lacking, the theoretical ability of the CCP to obtain TikTok data is enough to generate significant apprehension.
Data Storage and Access
TikTok has faced scrutiny over where it stores user data and who has access to it. As of June 2022, TikTok states that 100% of US user traffic is now routed to Oracle Cloud servers located in the US. However, prior to this change, some US user data was stored in Singapore and China, according to TikTok’s privacy policy at the time.
In a statement, TikTok said “We know we are among the most scrutinized platforms from a security standpoint, and we aim to remove any doubt about the security of US user data” (https://usds.tiktok.com/where-does-tiktok-store-u-s-user-data/). The company maintains that even when US user data was stored outside the US, strict controls were in place to prevent unauthorized access.
However, in June 2023, Forbes reported that TikTok admitted in a confidential briefing that some US creator data is still accessible from China. Specifically, the technical teams of TikTok’s parent company ByteDance in China can access these US users’ data subject to “robust cybersecurity controls” according to TikTok (https://www.forbes.com/sites/alexandralevine/2023/06/21/tiktok-confirms-data-china-bytedance-security-cfius/).
TikTok states they are working to minimize data access across regions. But the revelations have fueled ongoing concerns about Chinese government access to TikTok user data.
TikTok’s Defenses
TikTok has issued numerous statements defending its data practices and denying that the Chinese government has access to U.S. user data. In October 2022 Congressional testimony, TikTok CEO Shouzi Chew stated that the Chinese government has never requested data on U.S. users and that TikTok would refuse any such request (source).
TikTok claims that U.S. user data is stored on servers in the U.S. and Singapore, not China. The company says that access to data by employees is limited based on need and is carefully controlled and monitored. TikTok states it has taken steps to minimize access to user data from China, including storing U.S. data in its own data centers and restricting external access (source).
In June 2022 Congressional testimony, TikTok Chief Operating Officer Vanessa Pappas stated that no employee in China has access to TikTok U.S. user data and that the company uses encryption and internal controls to protect data (source).
Attempts to Restrict TikTok
Several countries and companies have attempted to restrict or ban TikTok due to concerns over data privacy, censorship, and security risks.
India was the first country to implement a nationwide ban on TikTok in June 2020, citing concerns that the app was being used to distribute anti-national content and pornography. TikTok had over 200 million monthly active users in India at the time.1
The United States under the Trump administration issued executive orders in 2020 that aimed to ban TikTok unless it was sold to an American company, citing national security concerns over data being accessed by the Chinese government.2 However, courts blocked the attempted bans.
Additional countries that have implemented full or partial bans on TikTok include Afghanistan, Australia, Belgium, Canada, Denmark, Nepal, and The Netherlands. Reasons ranged from cybersecurity risks, objections to censoring content, and halting TikTok’s rapid growth and influence.3
Some government agencies and private companies have also restricted employee use of TikTok on government-issued devices or on corporate networks, including the US Navy, US Army, US Marines, US Air Force, US Coast Guard, US Department of Defense, and Wells Fargo.
Oversight and Transparency
There have been calls from outside experts and government officials for TikTok to provide more transparency into its data collection and security practices. Many feel that without external oversight, it’s impossible to verify TikTok’s claims about how user data is handled.
Cybersecurity experts like Brian Krebs have conducted external analyses of TikTok’s mobile app and raised concerns about the amount of data collected and the encryption practices used. Analysis revealed TikTok was collecting MAC addresses, GPS location data, network information, and other telemetry even when some permissions were disabled.
Some US senators introduced a bill in 2020 called the No TikTok on Government Devices Act, citing national security concerns. Senator Josh Hawley said, “TikTok threatens the security of the United States and should not be distributed in U.S. app stores.” The act called for TikTok to be banned from US government devices.
In response to pressures, TikTok published several transparency reports explaining their data practices, moderation policies, and information requests from governments. However, cybersecurity experts say more external auditing and oversight is still needed.
Looking Forward
As the debate around TikTok continues, there are a few possible changes that could increase oversight of the platform and ease data privacy concerns:
The U.S. government could pass legislation like the proposed bill to protect TikTok user data (Reuters, 2023). This would give U.S. regulators more control over what types of data TikTok can access and require transparency around how data is handled. TikTok could also make efforts to further separate itself from its Chinese parent company ByteDance and store U.S. user data solely on servers based in the U.S.
Tensions between the U.S. and China will likely impact the future of TikTok as well. If relations continue to worsen, there may be more pressure on lawmakers to restrict TikTok due to national security concerns. However, an outright ban could also strain diplomatic ties. There is a possibility that TikTok’s operations in the U.S. could be sold to an American company, which would relieve some of the data privacy fears.
Overall, TikTok’s future in the U.S. depends heavily on addressing data privacy concerns through increased transparency, oversight, and separation from its Chinese owners. Diplomatic relations between the two countries will also shape whether TikTok continues to grow or faces new restrictions.
Conclusion
In summary, there is evidence to suggest TikTok may share some user data with its parent company ByteDance and by extension, the Chinese government. However, the extent of data sharing is unclear. TikTok claims it stores American user data in the US and Singapore only, but its complex corporate structure and China-based engineering teams raise questions.
Several countries have banned or threatened to ban TikTok over data privacy concerns. In response, TikTok is making efforts to increase transparency such as allowing experts to examine its algorithm. It remains to be seen whether these efforts will satisfy regulators.
While the risks cannot be ignored, they may be overblown in some cases. There are many popular apps and services with concerning data practices. And platforms like Facebook also censor content. One could argue similar US apps pose as much risk of US government surveillance.
In conclusion, the evidence suggests TikTok presents some data privacy risks due to its Chinese ownership, but the severity depends on one’s perspective. Users concerned about privacy may want to refrain from sharing sensitive data. However, occasional use for entertainment may pose limited risk for most people.
