The video-sharing platform owned by the Chinese social media giant ByteDance, is one of the most popular social media services in the world, with an estimated 800 million users. However, its zealous data collection, use of Chinese infrastructure, and its parent company’s close ties to the Chinese Communist Party make it a perfect tool for massive surveillance and data collection by the Chinese government.
After reviewing TikTok’s data collection policies, lawsuits, cybersecurity white papers, past security vulnerabilities, and its privacy policy, Protonmail found TikTok to be a grave privacy threat that likely shares data with the Chinese government. They recommend everyone approach TikTok with great caution, especially if your threat model includes the questionable use of your personal data or Chinese government surveillance.
As with just about every social media platform, the answer is: “a lot.” According to its privacy policy, even if you just download and open the app but never create an account, TikTok will collect your:
- IP address
- Browsing history (i.e., the content you viewed on TikTok)
- Mobile carrier
- Location data if you are using a mobile device (including GPS coordinates and WiFi and mobile cell data)
- Info on the device you used to access TikTok (for Android devices, this includes your IMEI number, which is essentially your device’s fingerprint so it can be identified, and potentially your IMSI number, which is used to track users from one phone to another)
To open an account, you must enter a phone number or email and your date of birth. Once you have created an account, TikTok asks your permission for access to your social media accounts (like Twitter, Instagram, Facebook, etc.), your phone’s contact list, and GPS data.
Once you start using the app, TikTok logs details about:
- Every video you upload
- How long you watch videos
- Which videos you like
- Which videos you share
- Any messages you exchange in the app
Finally, if you buy coins, the in-app currency you can use to support your favorite video creators, TikTok will store your payment information.
According to TikTok, if you delete your account, the company will delete your account data, videos, and information within 30 days. This claim is impossible to independently verify, as is the case with most social media companies.
TikTok’s data collection is extreme, even for a social media platform that collects its users’ data to serve them with targeted ads. And TikTok explicitly states in its privacy policy that it shares your browsing data and email address with third parties so that it can serve you with targeted advertising.
