Section 1.1: Understanding Data Collection by TikTok

Like many social media platforms, TikTok gathers an extensive array of information about users. According to its privacy policy, the app collects various data types, including:

• Registration details, such as age, username, password, language, and email or phone number.
• Profile specifics, including name, social media connections, and profile photo.
• User-generated content like comments, photos, livestreams, and audio or video recordings, collected upon creation or upload.
• Text, images, and video from your device's clipboard, which can be disabled.
• Payment information, if necessary.
• Contacts from your phone and other social networks, with the option to disable.
• Responses from surveys or participation in challenges or contests within the app.
• Data from linked social networks (Facebook, Twitter, Instagram, Google, etc.) regarding your usage of those services.
• Information from advertising partners, data providers, and analytics firms, often gathered via tracking technologies in the app, as well as data from publicly accessible sources.

While this list is extensive, it is comparable to what other social media services collect. However, given that TikTok is primarily a video-sharing platform, the volume of data collected is even more substantial.

More insights from TikTok's privacy policy include:

• Information about the device used to access the app, such as IP address (indicating geographical location), mobile carrier, time zone, ad trackers, device model, and device IDs.
• If granted permission, the app may gather precise location data, like GPS coordinates.
• Regarding uploaded images and audio, TikTok can analyze objects and scenery, facial and bodily features, spoken words, and biometric details (like faceprints and voiceprints).
• When communicating via messages, TikTok collects data on message content, timing, and participants.
• Every time content is generated or uploaded, TikTok automatically creates metadata, detailing how, when, where, and by whom the content was created, collected, or modified.

While it may seem concerning that TikTok tracks aspects of your videos, this data is crucial for content moderation—to ensure that posted videos adhere to platform guidelines. The primary issue with TikTok lies not in the amount of data collected, but in the potential sharing of that data.

Section 1.2: Data Sharing Practices of TikTok

TikTok has consistently denied that U.S. user data is accessible in China, claiming that such data is stored domestically. Nevertheless, reports suggest that ByteDance employees in China may have access to U.S. user data.

According to TikTok's privacy policy, the company “may share all of the information we collect” with its parent company or other affiliates. Reports indicate that TikTok is working on a project to store sensitive U.S. user information, such as phone numbers and birthdays, in a Texas data center, with access restricted to specific U.S.-based personnel.

However, it remains unclear if publicly shared data from videos and messages will be secure in the Texas facility. While TikTok asserts it has never shared user data with the Chinese government and would resist such requests, its privacy policy indicates that it might disclose information to comply with law enforcement or government inquiries.

The reality is that TikTok could be compelled to comply with requests from the Chinese government for information, as ByteDance is legally obligated to assist with Chinese intelligence operations. This presents a significant risk for TikTok users, as the seemingly harmless and sometimes embarrassing content shared by teenagers today could potentially be leveraged for blackmail by foreign entities in the future, a concern highlighted by national security experts.