TikTok users in the United States are expressing widespread concern over recent updates to the app’s privacy policy. The changes, delivered via an in-app message, detail the types of data the platform may collect, including sensitive personal information like sexual orientation and immigration status. While the policy language has sparked alarm, experts say the disclosure isn’t new and largely stems from compliance with existing state privacy laws, though the specificity is raising eyebrows.
The updated policy follows a period of intense scrutiny regarding TikTok’s data security and potential ties to the Chinese government, culminating in a deal to transfer U.S. operations to a domestic entity. However, the policy changes have ignited a fresh wave of anxiety among users, who fear potential misuse of their data.
Understanding the TikTok Privacy Policy Changes
The revised privacy policy outlines that TikTok could process information from user content and surveys, encompassing details about racial or ethnic origin, religious beliefs, health diagnoses, sexual life, gender identity, citizenship, and financial information. This broad scope is what has triggered the current backlash on social media platforms like Threads and X.
According to legal experts, the inclusion of these categories isn’t necessarily indicative of new data collection practices. The language largely exists to satisfy requirements under laws like the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). These laws mandate companies to inform consumers about the “sensitive information” they collect and how it’s used.
Compliance with State Privacy Regulations
The CCPA, for example, specifically defines sensitive personal information, including social security numbers, financial account details, precise geolocation, and details about a consumer’s racial origin, religious beliefs, or sexual orientation. TikTok’s policy aims to align with these definitions, ensuring transparency and legal compliance.
California’s AB-947, signed into law in October 2023, further expanded the definition of sensitive personal information to explicitly include citizenship and immigration status. This addition explains why those categories are now prominently featured in TikTok’s updated policy.
Ashlee Difuntorum, an associate at Kinsella Holley Iser Kump Steinsapir, explained that the policy’s wording is often geared towards regulators and litigators, rather than everyday users. “Policies like this often look alarming because they’re written for regulators and litigators, not for ordinary consumers,” she said.
Why the Concern Now?
While the policy language has existed for some time, the recent in-app alert coinciding with the completion of the deal to transfer U.S. operations to Oracle prompted many users to review the terms for the first time. This increased visibility, coupled with ongoing geopolitical tensions and concerns about data privacy, fueled the current wave of anxiety.
The escalation of immigration enforcement in recent years has also contributed to the sensitivity surrounding the collection of citizenship and immigration data. Protests and economic boycotts, such as the recent business closures in Minnesota in response to ICE activity, demonstrate the heightened awareness and concern regarding immigration-related issues.
Meanwhile, the transfer of TikTok’s U.S. operations was intended to address concerns about potential Chinese government access to user data. The irony of increased privacy worries following this move isn’t lost on observers, as users now question the extent of data collection by a U.S.-based entity.
Meta, the parent company of Facebook and Instagram, also includes detailed information about data collection in its privacy policy, including categories similar to those outlined by TikTok. This suggests that comprehensive data collection is a common practice among major social media platforms.
Implications and What to Watch
The current situation highlights the complexities of data privacy in the digital age and the challenges of balancing transparency with user understanding. While TikTok’s policy changes appear to be driven by legal compliance, the way the information is presented has understandably caused concern among users.
The long-term impact of this controversy remains to be seen. It’s possible that TikTok will attempt to clarify its policy language to address user concerns. However, the fundamental issue of data collection by social media platforms is likely to persist, requiring ongoing dialogue and regulatory oversight.
Looking ahead, the focus will be on how Oracle manages TikTok’s U.S. data and whether it can effectively address security concerns. The implementation of Project Texas, the initiative to secure TikTok’s U.S. data, is expected to be completed by the end of 2024, and its effectiveness will be a key factor in determining the future of the app in the United States. Continued monitoring of TikTok’s data practices and adherence to U.S. privacy laws will be crucial in the coming months.
