TikTok has grown exponentially since its launch, becoming one of the most popular social media platforms worldwide. In just a few years, TikTok went from virtually unknown to over 1 billion monthly active users, with about 100 million in the US alone123. It has become an integral part of internet culture and changed the way people create and consume short-form video content.
However, TikTok’s Chinese ownership has raised alarms about data privacy and security. Critics argue its parent company ByteDance could be compelled to hand over US user data to the Chinese government under the country’s national intelligence laws. There are concerns TikTok’s algorithms could push certain types of content and that China may censor politically sensitive topics. This has led some US policymakers to take actions restricting TikTok’s operations over fears it poses a national security threat. Understanding the facts around data collection and sharing practices is important amid the ongoing controversy.
TikTok’s Ties to China
TikTok is owned by the Chinese company ByteDance Ltd., which was founded in 2012 by Chinese entrepreneur Zhang Yiming. ByteDance is headquartered in Beijing and subject to Chinese laws on data sharing (Wikipedia). TikTok originated from the Chinese app Douyin, which was created and operated by ByteDance for the Chinese market. In 2017, ByteDance launched TikTok for markets outside of China. While TikTok and Douyin share the same underlying technology and functionality, they operate on separate, non-connected servers to store user data locally (“The Truth About TikTok”).
What Data Does TikTok Collect?
TikTok collects a significant amount of data from its users. According to their privacy policy, TikTok collects information such as:
- User account information like your username, password, email address, phone number, and profile information.
- Device information like your IP address, device IDs, operating system, settings, and browser information.
- Location data based on your SIM card and/or IP address.
- Metadata about the videos you watch and create, such as length, views, shares, comments, captions, sounds, hashtags, your interactions with videos, and more.
- Information about your online activity on TikTok such as your search terms, interactions with other users like following or blocking, and content you’ve liked, shared, or commented on.
- Messages and content you send through the app.
According to a 2022 analysis, TikTok gathers “an exceptional amount of personal data” compared to other social media apps (https://pirg.org/articles/demystifying-tiktok-data/). This allows them to build very detailed user profiles and track nearly every aspect of user behavior on their platform.
Does TikTok Share Data with China?
TikTok has repeatedly claimed that it stores all international user data on servers located outside of China, and not on servers in China. Specifically, TikTok stores U.S. user data in Virginia, with backup servers located in Singapore [1]. Despite storing data outside of China, TikTok is still subject to Chinese laws on sharing data with the government.
In 2021 testimony to the U.S. Senate, TikTok Chief Operating Officer Vanessa Pappas stated that the company would not hand over U.S. data to the Chinese government even if asked [2]. However, under China’s national intelligence law, companies are required to “support, cooperate with, and collaborate in national intelligence work” when requested [3]. This has raised concerns that if pressured, TikTok’s parent company ByteDance may be obliged to share international user data with the Chinese government after all.
While there is no public evidence so far of TikTok sharing international user data with China, the company’s legal obligations have created distrust. TikTok claims it would not comply with any requests, but experts argue their statements do not supersede Chinese law.
[1] https://www.cnn.com/2023/06/08/tech/tiktok-data-china/index.html
[2] https://www.theguardian.com/technology/2022/nov/07/tiktoks-china-bytedance-data-concerns
[3] https://www.forbes.com/sites/alexandralevine/2023/06/21/tiktok-confirms-data-china-bytedance-security-cfius/
Legality of TikTok Data Sharing
TikTok’s data collection practices have come under scrutiny regarding whether they comply with U.S. privacy laws. The main concerns relate to the Children’s Online Privacy Protection Act (COPPA) which regulates how companies can collect and use data from children under 13 years old.
According to TikTok’s privacy policy, the company does not knowingly collect any personal information from children under 13. However, critics argue that TikTok likely collects data from underage users who lie about their age to create accounts. TikTok claims it deletes accounts if it learns the user is under 13.
Another issue is that TikTok’s privacy policy says it may share user data with its parent company ByteDance Ltd based in China. This has raised concerns that data on U.S. citizens could end up in the hands of the Chinese government. TikTok asserts it stores U.S. user data in the U.S. and Singapore, not China.
While some policymakers have called for banning TikTok over data privacy issues, legal experts say TikTok’s practices may not clearly violate U.S. law.Much depends on how strictly TikTok implements its privacy policy to protect minors and limit foreign access to data. More regulation and oversight could help ensure better compliance.
Attempts to Restrict TikTok
There have been several attempts by various governments to restrict or ban TikTok due to concerns around data privacy and ties to China. The most notable efforts have come from the U.S. and India.
In the U.S., there have been various efforts to ban TikTok. According to The Guardian, in 2022 momentum seemed to be building for a federal TikTok ban. However, in 2023 Congress stalled on passing legislation to restrict TikTok. Some U.S. states have taken action on their own, with Texas and Montana banning TikTok on government devices. But efforts for a nationwide federal ban have not succeeded so far.
India was the first country to ban TikTok, doing so in 2020 along with dozens of other Chinese apps. According to The New York Times, India justified the ban over concerns about data privacy and security. The Indian government stated TikTok and other Chinese apps were “stealing and surreptitiously transmitting users’ data.” India’s ban on TikTok remains in effect today.
TikTok’s Counterarguments
TikTok has repeatedly claimed that they do not share data with the Chinese government nor store personal data in China. As per their transparency report, “We store all US user data in the US and Singapore. Our data centers are located entirely outside of China, and none of our data is subject to Chinese law.” https://newsroom.tiktok.com/en-us/statement-on-tiktoks-content-moderation-and-data-security-practices
In response to allegations, TikTok said it has taken steps to limit access to user data from outside the country where it is stored. As of February 2022, TikTok claims to have “minimized employee access” to user data and built systems that allow engineers to “access user data only as needed to perform their job functions.” https://iapp.org/news/a/tiktok-defends-third-party-tracking-in-privacy-lawsuit/
TikTok says their data security teams control and authorize data access based on a business need to know, and claims that they do not send any user data to China or share it with the Chinese government.
Third Party Expert Assessments
Cybersecurity experts have conducted analysis on the potential risks of TikTok data being accessed by China. According to a report by Forbes, TikTok collects a significant amount of user data including browsing history, biometric data, content consumption habits, and geolocation. While TikTok has said this data is stored in the US and Singapore, experts say the broad data collection provides opportunity for misuse if accessed by the Chinese government.
TikTok has released several transparency reports detailing government requests for user data and content removal. As of 2021, TikTok claims to have not removed any content or provided user data to the Chinese government. However, cybersecurity experts note that these reports may not reveal potential covert data access by China through TikTok’s parent company ByteDance.
Ultimately, independent analysis concludes TikTok presents a heightened risk of data access compared to other social media apps due to its ownership ties to China. However, the extent of any covert data sharing with China is difficult to conclusively confirm. Users must weigh these potential risks given TikTok’s popularity and ubiquity.
Protecting Yourself on TikTok
Despite the concerns, many users still find value in using TikTok. For those who wish to continue using the platform, there are some steps you can take to limit data collection and be more cautious about what you share:
In TikTok’s privacy settings, you can limit data collection by disabling personalized ads, restricting your account, and turning off the “Suggest your account to others” setting. You can also choose not to share certain data like your birthday, phone number, and email address. According to CyberGuy, limiting ad tracking in your device settings outside of TikTok can also help.
Users should also be very wary of what personal information they post on their account. Avoid sharing private details like your home address, phone number, or any financial information. Consider not linking your other social media accounts. And as general social media safety tips, don’t accept friend requests from strangers, be cautious about clicking unknown links, and don’t overshare personal details in your videos.
Conclusion
The relationships between China and companies based in China like TikTok raise important questions about data security and user privacy. Based on the evidence, there are clearly some risks to using TikTok, especially for sensitive user data. However, the true extent of data sharing between TikTok and the Chinese government is still unknown. While some security experts have found evidence of data being accessed from China, TikTok denies these claims and it’s unclear if China is actually using TikTok data in any systematic way.
For most individual users, the privacy risks of using TikTok are likely relatively small. Avoiding posting sensitive personal information can help mitigate these risks further. However, for those working in government, the military, or companies that handle sensitive data, it may be wise to avoid TikTok. There are also risks around TikTok’s algorithm and potential censorship or manipulation of content.
In summary, while the evidence is concerning, for casual personal use the privacy risks of TikTok to most individuals are probably acceptable. But users should make an informed decision based on their own privacy sensitivity. There are also larger data security risks for governments and companies that deserve further investigation. Maintaining public pressure on TikTok to improve transparency and data security practices will also be important going forward.
