What TikTok Has on You

The social media app’s data collection practices are not unlike its competitors’, but its links to China add a sinister layer to the debate.

By , a reporter at Foreign Policy.
A young man holding a phone casts a shadow as he walks by an ad for social media company TikTok in Berlin.
A young man holding a phone casts a shadow as he walks by an ad for social media company TikTok in Berlin.
A young man holding a phone casts a shadow as he walks by an ad for social media company TikTok in Berlin on Sept. 21, 2020. Sean Gallup/Getty Images

TikTok wants to convince the West that it’s just another social media platform, even as the immensely popular short-form video app has been banned from U.S. federal government devices and by several state governments, too. Several lawmakers and officials want to go even further and ban TikTok completely. 

The primary concern, they say, is the likelihood of data collected by the app ending up in the hands of the Chinese government because of TikTok’s ownership by Chinese tech firm ByteDance. 

And TikTok collects a lot: It can access users’ names, ages, phone numbers, email addresses, details about the devices and mobile networks they’re using, keystrokes, messages on the app, and even biometric information such as “faceprints and voiceprints,” according to the app’s privacy policy. TikTok’s algorithm also tracks what users watch and how much time they spend on each video so it can better tailor the content it serves them, giving the app key insights into behavior patterns, likes, and dislikes.

Listen to this article

TikTok wants to convince the West that it’s just another social media platform, even as the immensely popular short-form video app has been banned from U.S. federal government devices and by several state governments, too. Several lawmakers and officials want to go even further and ban TikTok completely. 

The primary concern, they say, is the likelihood of data collected by the app ending up in the hands of the Chinese government because of TikTok’s ownership by Chinese tech firm ByteDance. 

And TikTok collects a lot: It can access users’ names, ages, phone numbers, email addresses, details about the devices and mobile networks they’re using, keystrokes, messages on the app, and even biometric information such as “faceprints and voiceprints,” according to the app’s privacy policy. TikTok’s algorithm also tracks what users watch and how much time they spend on each video so it can better tailor the content it serves them, giving the app key insights into behavior patterns, likes, and dislikes.

“There’s an extensive profile that can be created from this app in terms of privacy violations and things being easily linked back to you as a unique individual,” said Alexis Hancock, a director of engineering at the Electronic Frontier Foundation, a digital rights nonprofit.

Ultimately, however, Hancock and other cybersecurity experts say TikTok’s data collection practices are little different from those employed by its Silicon Valley competitors such as Google and Facebook, which have previously faced controversies of their own on that front. 

“We’re already used to tech companies having this enormous amount of access to our personal life,” said Bruce Schneier, a lecturer at Harvard University’s Kennedy School of Government who specializes in privacy issues. “By extension, the U.S. government has that access, and so how do we feel about another country having that access?” 

For government and intelligence officials, lawmakers, or other individuals working on sensitive issues that could be exploited by the Chinese government, the risk is clear. TikTok has admitted that its data, even if stored outside Chinese borders, can be accessed by employees in China, and recent revelations that the company tracked journalists who were writing about it has further heightened the alarm at its possibility. (ByteDance said it fired the employees involved in tracking journalists.) And while TikTok has repeatedly said it does not share data with Beijing and would not do so if asked, its parent company, ByteDance, could be compelled to do so by Chinese law. 

For everyone else, including the tens of millions of young Americans who are avid TikTok users, it comes down to more personal notions of privacy and security. 

“It depends on who you are—are you concerned, are you worried, that the Chinese government knows what kind of porn you like, the Chinese government knows if you are clinically depressed, the Chinese government knows if you are having an affair?” Schneier said. “You just have to decide who you trust. None of these companies are working in your best interest.” 

Banning TikTok would also not necessarily prevent China from accessing data on Americans. Chinese hackers have been linked to some of the biggest data breaches in U.S. history, including at the Office of Personnel Management under the Obama administration and a massive 2018 cyberattack on Marriott Hotels that compromised the private information of more than 500 million customers. Moreover, large amounts of the same information TikTok collects are already hoovered up by so-called data brokers, companies that collect and sell that information for targeted advertising. 

In the absence of effective U.S. privacy laws that curb data collection across the board, banning TikTok would “kind of be putting a Band-Aid on a bigger problem,” Hancock said. “If you were truly concerned about everyday Americans, you would target a federal privacy law that targets all of these malicious, insidious companies that repeat our data throughout advertising ecosystems without our knowledge,” she added. “You would need to target that ecosystem, not just one app.”

TikTok may face a bigger challenge in Europe, with the European Union’s General Data Protection Regulation (GDPR) and the Digital Services Act laying out stricter guidelines for user privacy and content moderation. TikTok CEO Shou Zi Chew met with EU officials earlier this week to reassure them that the company will comply with the laws. But European officials have not sought to single out TikTok’s links to China in the way some American counterparts have.

“We don’t look, legally, at where companies are headquartered,” Gerard de Graaf, Europe’s senior digital envoy to Silicon Valley, told Foreign Policy in a recent interview. “They will all be treated equally. They will have to comply fully with the rules.” TikTok is under an ongoing investigation by European regulators, however, to ensure its data collection practices comply with the GDPR.

Back in Washington, it’s a somewhat different conversation.

Without any meaningful online privacy laws on the books—and none in sight for the next Congress—forcing TikTok to store its data in the U.S. will not stop Beijing from acquiring data on Americans,” Dakota Cary, a consultant for cybersecurity firm Krebs Stamos Group who focuses on China’s cybercapabilities, wrote in a recent op-ed for tech news outlet CyberScoop. 

But Cary argues that Chinese ownership of TikTok is a big enough threat to warrant a U.S. ban, not because of its data collection but because of the enormous influence it is capable of wielding. China can compel TikTok to censor sensitive topics, push certain types of content, or sway political discourse in other countries. (The same could be said for other social media platforms that have recently acquired new owners.)

TikTok has previously faced controversy on that front, with an executive admitting to U.K. lawmakers in 2020 that it censored some videos about China’s Xinjiang region and the region’s Uyghur population. The company said those policies have since been abandoned, but there are continued fears that the Chinese government could easily force TikTok to censor other topics it doesn’t want discussed, such as Taiwan.

“Overall, TikTok’s greatest issue is that discretion regarding content censorship, demotion, or promotion are at the discretion of a company whose staff can be coerced by the [Chinese] government,” Cary said in an email to Foreign Policy. The risk, he said, is heightened for members of the Chinese diaspora globally, who could be targeted by Beijing through the app. 

“China chose to export its repression and surveillance abroad; TikTok is unfortunately paying for that policy choice,” he said. 

Rishi Iyengar is a reporter at Foreign Policy. Twitter: @Iyengarish

Join the Conversation

Commenting on this and other recent articles is just one benefit of a Foreign Policy subscription.

Already a subscriber? .

Join the Conversation

Join the conversation on this and other recent Foreign Policy articles when you subscribe now.

Not your account?

Join the Conversation

Please follow our comment guidelines, stay on topic, and be civil, courteous, and respectful of others’ beliefs.

You are commenting as .

More from Foreign Policy

A Panzerhaubitze 2000 tank howitzer fires during a mission in Ukraine’s Donetsk region.
A Panzerhaubitze 2000 tank howitzer fires during a mission in Ukraine’s Donetsk region.

Lessons for the Next War

Twelve experts weigh in on how to prevent, deter, and—if necessary—fight the next conflict.

An illustration showing a torn Russian flag and Russian President Vladimir Putin.
An illustration showing a torn Russian flag and Russian President Vladimir Putin.

It’s High Time to Prepare for Russia’s Collapse

Not planning for the possibility of disintegration betrays a dangerous lack of imagination.

An unexploded tail section of a cluster bomb is seen in Ukraine.
An unexploded tail section of a cluster bomb is seen in Ukraine.

Turkey Is Sending Cold War-Era Cluster Bombs to Ukraine

The artillery-fired cluster munitions could be lethal to Russian troops—and Ukrainian civilians.

A joint session of Congress meets to count the Electoral College vote from the 2008 presidential election the House Chamber in the U.S. Capitol  January 8, 2009 in Washington.
A joint session of Congress meets to count the Electoral College vote from the 2008 presidential election the House Chamber in the U.S. Capitol January 8, 2009 in Washington.

Congrats, You’re a Member of Congress. Now Listen Up.

Some brief foreign-policy advice for the newest members of the U.S. legislature.