Terms of Misuse?: Breaking Down the Data TikTok Collects on Its U.S. Users

TikTok has come under renewed scrutiny over how it handles U.S. data, with some lawmakers calling for an investigation into the Culver City-based company.

What kind of data does TikTok collect? And should we worry about a potential national security threat when Americans’ data is accessed by employees of ByteDance, TikTok’s Chinese parent company?

To answer these questions, dot.LA reviewed TikTok’s privacy policy and interviewed Thomas Germain, a technology writer for Consumer Reports who specializes in privacy issues.

What Data TikTok Collects

Like other social media giants, TikTok gobbles up a lot of user information. To start, TikTok receives names, ages, phone numbers and emails when people sign up for the service. The app also knows users’ approximate locations and mobile device identifiers, such as IP addresses.

Germain told dot.LA the most valuable info may come from the way users interact with the video sharing app. TikTok is quite good at figuring out peoples’ interests based on the videos or accounts they’ve previously liked or followed. Those insights are useful for advertisers and—potentially—for spreading political messages, Germain noted.

“This vast trove of data that every social media company has—on what people are interested in, what makes them upset, what makes them happy—is incredibly valuable,” he said.

The company’s privacy policy permits TikTok to collect a wide range of additional data, from consumers’ keystroke patterns to biometric info. However, the company says it doesn’t necessarily take in or store all of this. For example, keystroke patterns may be used solely for anti-fraud and spam purposes, according to TikTok. Regarding biometrics, TikTok said editing features may automatically locate a person’s face to apply an effect, but those features do not uniquely identify individuals.

Why U.S. government officials are concerned

TikTik is owned by Beijing-based tech giant ByteDance and China is an economic and foreign policy rival to the U.S. government. With the Chinese Communist Party (CCP) exerting considerable power over the nation’s tech companies, U.S. lawmakers and administration officials contend that TikTok’s Chinese ownership poses a national security risk.

“The CCP has a track record longer than a CVS receipt of conducting business & industrial espionage as well as other actions contrary to U.S. national security, which is what makes it so troubling that [ByteDance] personnel in Beijing are accessing this sensitive and personnel data,” Federal Communications Commissioner Brendan Carr recently said.

TikTok says it has never provided any U.S. user data to the Chinese government, nor would it do so if asked. Additionally, the company recently announced that all of U.S. user traffic is now routed to American software giant Oracle’s servers.

“The TikTok app is not unique in the amount of information it collects, compared to other mobile apps,” the company said.

TikTok is hardly the only company swallowing a lot of data on Americans, from car makers to smart doorbell firms. Consumers’ credit card purchases, contact lists and recent GPS locations are hawked by hundreds, if not thousands, of companies in the so-called data broker industry, Germain noted.

“If the Chinese government wanted it, they could just go out and buy it because it's for sale,” he said. “...I think people, when they're worried about TikTok doing something, they should ask themselves whether they should be worried about American companies doing the same thing.”

Still, Germain said there’s some genuine cause for concern, since China’s government has previously pushed the country’s companies to do its bidding. But to Germain, that concern has less to do with China knowing your phone number and more to do with propaganda.

“The Chinese government could instruct Tiktok to manipulate its algorithm to show people content that promotes the goals of the Chinese government,” Germain said. “That could totally happen and that is something that is of concern. But that does start to move away from questions of data privacy.”