TikTok has seen explosive growth since launching outside of China in 2017, becoming one of the most popular social media apps worldwide. As of January 2023, TikTok has over 1.5 billion monthly active users globally (1). Part of the app’s success lies in its algorithm that quickly learns user preferences and serves up engaging short-form videos.
However, TikTok’s Chinese ownership has raised concerns, especially regarding data privacy. TikTok is owned by ByteDance, a Beijing-based tech company. With tensions between China and Western countries, particularly the US, worries have emerged that TikTok user data could be shared with the Chinese government or used for surveillance (2).
In response, TikTok has aimed to distance itself from its Chinese roots. But suspicions around its data practices persist, sparking government actions to ban or sell TikTok operations in various countries.
Sources:
(1) https://bloggingwizard.com/tiktok-statistics/
(2) https://www.konstructdigital.com/content-marketing/tiktok-stats-roundup/
TikTok’s Chinese Ownership
TikTok is owned by the Chinese company ByteDance. ByteDance was founded in 2012 by Zhang Yiming and is headquartered in Beijing, China [1]. Although TikTok operates independently from its parent company, ByteDance owns 100% of TikTok. This means that ultimately, a Chinese firm has control over the popular short-form video app.
ByteDance also owns other technology and content platforms such as Douyin, the Chinese version of TikTok. However, TikTok and Douyin operate on separate networks to comply with Chinese censorship laws. While Douyin is available only in mainland China, TikTok operates internationally outside of the Chinese market [2].
Despite TikTok being one of ByteDance’s most successful products globally, the app’s Chinese ownership has raised concerns, especially in Western markets like the United States.
Data Storage Locations
TikTok has historically stored US user data in the United States as well as in data centers in countries like Singapore and China, where its parent company ByteDance is based. However, as tensions with the US government escalated, TikTok began a major transition to store all US user data exclusively in the US.
In June 2022, TikTok announced that 100% of US user traffic is now routed to Oracle Cloud servers located in the US. US user data is stored at data centers in Virginia, Oregon, Iowa and California. TikTok claims US user data has been migrated from other locations and is now fully isolated from ByteDance.
For European users, TikTok is also transitioning to store data locally. It plans to store European user data at its newly opened data center in Ireland, as well as at existing Oracle data centers in Europe. The migration aims to be completed by 2024.
US Government Concerns
In 2020, the US government began voicing strong suspicions that the Chinese government could access data on US TikTok users. Officials feared that TikTok’s Chinese parent company ByteDance could be compelled to hand over data under China’s national intelligence laws. This raised concerns over national security risks such as blackmail and espionage. There was additional worry that the Chinese government was using TikTok to influence US public opinion and censor certain content. Overall, the US government grew increasingly uneasy about the vast amounts of data that TikTok was accumulating on American citizens.
Will Oracle Actually Benefit From the TikTok Deal?.
Attempts to Sell TikTok
In 2020, the Trump administration raised national security concerns over TikTok’s Chinese ownership and pressured the company to sell its US operations to an American company. This led to negotiations for Microsoft and Oracle to acquire TikTok.
Microsoft engaged in talks to buy TikTok’s operations in the US, Canada, Australia and New Zealand. However, in September 2020, Microsoft announced that its offer was rejected by TikTok’s parent company ByteDance [1].
Soon after, ByteDance chose Oracle as TikTok’s technology partner in the US, rejecting Microsoft’s bid. However, it was unclear if Oracle would take a majority ownership stake in TikTok [2]. The proposed Oracle deal aimed to address the Trump administration’s concerns by having Oracle manage TikTok’s US user data.
In the end, the deal between ByteDance, Oracle and Walmart to sell TikTok’s US operations did not go through. According to Microsoft, the failed TikTok acquisition was an unusual situation imposed by the Trump administration [3].
Data Privacy Changes
In response to mounting criticism over privacy concerns, TikTok has made several changes to its data privacy policies and practices. In 2020, TikTok announced new restrictions on data access for employees, stating that only approved employees with a legitimate business need could access user data. TikTok also partnered with Oracle to store US user data securely in the Oracle Cloud.
In June 2022, TikTok introduced new tools allowing users more control over their privacy settings, including deciding who can download their videos and automatically deleting old videos. Most significantly, TikTok stopped collecting data on users’ precise locations and changed default privacy settings for younger users (ages 13-15) to minimize data collection.
While these changes represent steps in the right direction, experts say TikTok still collects vast amounts of data and its privacy protections lag behind leading platforms. Continuous scrutiny will be required to ensure TikTok lives up to its privacy commitments.
Oversight by US Officials
In response to concerns about data privacy and security, TikTok has implemented mechanisms for US oversight of its operations. In 2022, TikTok announced the creation of a new organization called TikTok U.S. Data Security (USDS) to oversee data security for American users [1]. USDS is led by a team of experts in cybersecurity, privacy, and data compliance based in the United States.
The USDS team focuses on restricting access to TikTok data from outside the United States. Only approved employees can access this data, with strict access controls and auditing procedures in place. Additionally, TikTok stores American user data in servers located in the US and Singapore, not in China where its parent company ByteDance is headquartered [2].
Beyond the USDS organization, TikTok has also committed to external oversight by independent third parties to monitor its data practices. This includes regular audits and compliance assessments to validate that TikTok is meeting its commitments to protect US user data [3].
Remaining Concerns
Despite the steps TikTok has taken to store U.S. user data in the United States, concerns still remain about the app’s data privacy practices. As recently as June 2023, TikTok came under congressional fire over alleged national security risks posed by the vast amounts of U.S. user data it collects (TikTok’s Data Privacy Concerns Spark Global Debate).
Critics argue that even with data stored in the U.S., ByteDance could still potentially access it. Additionally, the Chinese government could leverage its influence over ByteDance to obtain U.S. user data, as Chinese laws require companies to share data with the government upon request. There are ongoing debates about whether the privacy risks have been fully addressed.
Many lawmakers remain skeptical about TikTok’s data practices despite its efforts. Some security experts say TikTok poses unacceptable risks no matter where it stores data. Concerns linger over China’s potential influence and control through ByteDance’s ownership.
While TikTok is taking steps in the right direction, only time will tell if U.S. officials and the public are ultimately reassured about its data privacy protections. For now, the public policy debates seem likely to continue as people weigh the risks and benefits of using the hugely popular app.
The Complex Reality
Verifying the data practices of technology companies with international operations and ownership is extremely challenging. Companies like TikTok span multiple countries with differing laws and oversight mechanisms. Ensuring proper protections for user data would require evaluating the entire data pipeline across jurisdictions.
According to a 2022 report from the U.S. Federal Trade Commission, “thoroughly examining legal status, reputation, quality assurance and trade compliance is critical when verifying foreign suppliers.” However, technology companies operate at a scale where traditional supplier vetting methods may fall short.
The situation is further complicated by conflicting laws on data privacy and security. As explained in a 2016 analysis by Brookings, “U.S. laws allow greater access to data by law enforcement than most other countries.” This gap between legal environments makes unified compliance very difficult.
Bridging these differences requires intensive collaboration between governments, closer alignment on regulations, and transparency from companies on their data flows. But progress remains slow amid continued concerns over user privacy and national security interests.
Conclusion
In summary, the data storage practices of TikTok remain complex. While TikTok has made efforts to store more US user data within the United States, some experts believe Chinese laws may still enable access to data stored overseas. However, concrete evidence of data compromise has yet to emerge.
Key points:
- TikTok is owned by Chinese company ByteDance but operates partially separate entities in the US and other countries.
- Initially, TikTok stored all user data in China, raising concerns about Chinese government access.
- In response, TikTok made efforts to store more US user data within the US and build transparency centers.
- However, TikTok likely still stores some backup data in China, and Chinese laws may enable government data access.
- US officials and third party audits provide some oversight, but uncertainties remain around exactly what data China can access.
In conclusion, while TikTok has made improvements, some risks likely remain around Chinese government access to US user data. However, the true extent of these risks is difficult to definitively determine from publicly available information.
