TikTok and privacy: What's the issue?

• TikTok data practices raise national security concerns
• App collects user data, including demographic and device information
• TikTok taking steps to address security issues

From state bans to hefty fines for data misuse, video sharing app TikTok is at the center of a privacy storm over alleged intelligence gathering by China.

Montana last week became the first U.S. state to ban the Chinese-owned app, while an investigation this month found it had been tracking LGBTQ+ users based on the content they watched. 

Lawmakers fear the popular app could pose a national security threat due to the amount of data it collects - something the company has continuously denied.

Here's what you need to know about TikTok and privacy concerns:

What data does TikTok collect about users?

TikTok's privacy policy lists a wide range of information the company can collect about its users.

When setting up an account, users are asked to provide their age, email and phone number. TikTok can also collect bank details, and users' social media and phone contacts.

The app automatically collects information such as a device's IP address, phone model, carrier settings, and specific keystroke patterns or rhythms.

It can also gather approximate location, and analyse objects in videos, should users give permission or use features like filters.

This includes "identifying the objects and scenery that appear, the existence and location within an image of face and body features and attributes, the nature of the audio, and the text of the words spoken".

TikTok says it uses this data to provide services to users - including recommending videos to them.

What are the biggest privacy concerns about TikTok?

TikTok associates the videos that users watch with a specific ID, which can be weaponised against minorities and other vulnerable people, rights groups warn.

Videos categorised as LGBTQ+-related were reportedly catalogued internally and linked to affiliated users, according to the Wall Street Journal - posing a potential threat to users in countries where LGBTQ+ people face violence and harassment.

TikTok told the Wall Street Journal the dashboard that employees used to access the data was deleted in the U.S. nearly a year ago, and that the app does not identify information such as sexual orientation or race.

That is not the only concern over how TikTok and its parent company ByteDance, manage users' information.

The app has been banned on governmental devices in Canada, Britain and several EU bodies, as well as for citizens in India and Taiwan.

Last month Britain's data watchdog fined TikTok $15.9 million for breaching data protection law including by using the personal data of children aged under 13 without parental consent.

In February the Canadian federal privacy regulator started an investigation into TikTok over "whether valid and meaningful consent is being obtained for the collection, use and disclosure of personal information".

And a report from Forbes magazine last year found that ByteDance had used the TikTok app to track multiple journalists to discover the source of leaks.

For Estelle Massé, global data protection lead at rights group Access Now, poor privacy and data practices are "not just a TikTok problem".

"TikTok is applying the rock-bottom data protection standards that have been set by U.S. tech giants' data harvesting business model. The entire industry is harming the privacy rights of millions around the globe and it needs to change," she told Context.

How has the company responded to such concerns?

TikTok has repeatedly denied that it has ever shared data with the Chinese government and has said the company would not do so if asked.

The company last week said the new Montana law "infringes on the First Amendment rights of the people of Montana by unlawfully banning TikTok," and that it will "continue working to defend the rights of our users inside and outside of Montana."

TikTok is working on an initiative called "Project Texas", which creates a standalone entity to store American user data in the U.S. on servers operated by U.S. tech company Oracle, to protect it from surveillance.

Not everyone thinks the partnership will address national security concerns.

"I reject the entire premise behind Project Texas", Milton Mueller, a professor of the political economy of information and communication at the Georgia Institute of Technology School of Public Policy, told Context.

"If you want to track data that has espionage value, you have to be a lot more targeted. What specific people, activities, locations are we talking about? Is the data secret, exclusive and sensitive or relatively accessible?"

Electronic Frontier Foundation, an advocacy group, said in March that "banning TikTok from operating here probably would not stop China from acquiring the location data of people here."

"The better approach is to limit how all businesses here collect personal data. This would reduce the supply of data that any adversary might obtain."

(Reporting by Adam Smith; Editing by Zoe Tabary.)