TikTok is a popular short-form video app with over 1 billion monthly active users worldwide. User data storage has become an important issue for the platform as it continues to grow. With large amounts of user data being collected, there are understandable concerns around how this data is stored and protected by TikTok. Proper data storage policies and practices are crucial for maintaining user trust and complying with regulations. This article will provide an overview of how TikTok stores user data and address key questions around data security, access policies, and recent controversies.
What User Data Does TikTok Collect?
TikTok collects a wide range of user data from its users. This includes both data that users actively provide, as well as data that is passively collected by TikTok as users interact with the platform [1]. Some of the key types of user data collected by TikTok include:
Personal information like name, email, phone number, and date of birth provided during account registration. TikTok requires this information to create an account.
User content such as videos, comments, captions, and messages. This includes all the content users actively create and share on TikTok.
Device data and identifiers like IP address, device model, operating system, and unique device identifiers. This allows TikTok to identify users across devices.
Location data as provided by users or derived from IP address. TikTok uses location to personalize content and serve localized ads.
Watch and search history including videos viewed, search terms used, clicks and taps within the app. This data allows TikTok to understand user interests.
Interactions data showing how users engage with other accounts and content on TikTok through likes, shares, follows, comments etc.
[1] https://ocholavenue.com/what-user-data-does-tiktok-collect/
Where is TikTok User Data Stored?
TikTok stores user data primarily in its own data centers located around the world. According to DGTL Infra, TikTok’s main data center locations include:
- Northern Virginia, USA
- Hillsboro, Oregon, USA
- Singapore
- Mumbai, India
- Dublin, Ireland
TikTok rents space for its servers within large multi-tenant data centers operated by companies like Equinix in the US. However, TikTok manages the servers and data storage itself within its leased spaces in the data centers. For example, TikTok rents significant data hall space from Equinix in Northern Virginia, near Washington DC, according to Forbes.
In addition to company-owned data centers, TikTok leverages major cloud providers like Oracle Cloud and Google Cloud for additional compute power and data storage as needed. However, the core user data repositories remain within TikTok’s own data centers.
How Does TikTok Protect User Data?
TikTok utilizes several methods to protect user data and information. According to The SSL Online, TikTok stores user data on servers in data centers that have physical and environmental security controls. This includes 24/7 interior and exterior surveillance and flood and fire protection systems.
TikTok also employs industry-standard encryption to protect user data in storage and in transit. This prevents unauthorized parties from accessing user data. Additionally, TikTok has internal data access protocols to control employee access to user data based on job responsibilities. Employees only have access to the data required to do their jobs.
TikTok states that user data is fragmented and stored separately from account information. This compartmentalization of data helps limit exposure in the event of a breach. TikTok also conducts regular audits and risk assessments of its security practices and protocols to ensure user data remains protected.
TikTok’s Data Access Policies
According to TikTok’s Privacy Policy, TikTok has access to user data to operate, provide, improve, understand, customize, support, and market the Service.
TikTok may share user data with its parent company ByteDance Ltd. and other affiliates to provide joint content and services like registration, sign-in, and cross-device access across ByteDance products. TikTok states that their affiliates follow practices at least as protective as TikTok’s Privacy Policy regarding user data. [1]
TikTok may share user data with third party service providers who assist in providing and improving the Service. This includes data storage, infrastructure, IT services, customer service, and advertising services. TikTok states they only provide third parties with the minimum amount of data necessary and have strict contracts regarding data privacy and security. [2]
TikTok may also share user data with law enforcement agencies, public authorities, or other third parties if compelled by legal request and if necessary to comply with law enforcement and national security activities. [3]
User Control Over Data
TikTok provides users with several options to manage their privacy settings and delete their data from the app. Users can control some of the data collection in the app by adjusting their privacy settings.
In the app’s privacy settings, users can choose whether or not TikTok can collect certain types of data, like their precise location, contacts, and browsing history. They can also limit some features that utilize their data, like personalized ads.
Users can request to delete their TikTok account at any time, which erases the content they’ve posted. However, some data may still be retained by TikTok, such as analytics data that does not directly identify the user. Users can also download a copy of the data TikTok has collected about them.
While users have some control, TikTok’s data collection and use is still quite broad by default. The onus is largely on users to go through settings and limit data access. Overall, users have limited but present options to manage their privacy and delete certain TikTok data.
Third-Party Access
TikTok shares some user data with third parties like advertisers and marketing partners in order to personalize ads and provide relevant recommendations. Their Privacy Policy states that they may share non-identifying information as well as an advertising ID that can be linked to a user’s device with third parties.
While TikTok states that they don’t sell user data directly to third parties, some data like advertising IDs, device IDs, and device fingerprint data may be shared to allow tailored advertising. TikTok works with third-party ad partners like Facebook and Google to provide targeted ads to users based on data collected by TikTok.
According to their Privacy Policy, users can opt-out of targeted advertising through their device settings. However, other analytics data is still collected and shared in aggregated or non-identifiable forms. The extent of user control over data sharing with third parties is limited compared to other platforms.
Sources:
https://www.tiktok.com/legal/privacy-policy-row
https://www.tiktok.com/legal/page/row/privacy-policy/en
Data Storage Regulations
TikTok is subject to data protection laws and regulations around the world, including prominent regulations like the General Data Protection Regulation (GDPR) in the European Union. In September 2023, TikTok was fined $379 million by the Irish Data Protection Commission for violating the GDPR in relation to the processing of children’s data between May 2018 and July 2020. The regulators found that TikTok’s privacy practices did not sufficiently protect children and their data.
Under the GDPR, companies like TikTok must provide transparency around data collection practices, allow users to access their data, and implement data protection principles like data minimization and purpose limitation. TikTok claims it has made changes to address the regulators’ concerns, including introducing additional safeguards for teens. However, critics argue the company still has work to do when it comes to GDPR compliance.
Recent Controversies
TikTok has faced scrutiny over its data practices and ties to China in recent years. In 2020, former President Trump threatened to ban TikTok in the U.S. over data privacy concerns and the app’s Chinese ownership (Economic Times). Trump issued executive orders to block TikTok unless it was sold to an American company, though the ban was blocked in court.
More recently in 2022, TikTok admitted some employees in China can access U.S. user data (PrivacyHawk). This admission renewed concerns about Chinese government access to data. Around the same time, TikTok’s Global Chief Security Officer Roland Cloutier stepped down amid growing data privacy concerns (Economic Times). The controversies have fueled distrust of the platform’s data practices, despite TikTok’s claims it protects U.S. user information.
Conclusion
In summary, TikTok collects and stores a range of user data to power the platform’s algorithms and target advertising. While the company claims to store most user data in data centers located in Singapore and the United States, its complex corporate structure and operations in China have raised concerns about government access to data.
TikTok states that it will not share personal information with the Chinese government, but its privacy policy does allow broad internal access to user data. While TikTok gives users some ability to control privacy settings, the opaque nature of data flows remains an issue.
As social media platforms continue to amass huge amounts of user data, there is an increasing focus on ensuring proper data protections are in place, particularly for younger users. The privacy controversies surrounding TikTok highlight the need for transparency from tech companies, thoughtful data regulations, and vigilant consumer advocacy.
Ultimately, TikTok users must weigh the benefits and risks of sharing their data. While TikTok’s popularity continues to skyrocket, data privacy remains an evolving and vitally important issue.
