TikTok has become a global giant. The US is threatening to rein it in
For much of the tech industry, this summer was a season of economic uncertainty – one that led to a drop in bitcoin prices, hundreds of laid-off workers, and a hiring freeze. For the video platform TikTok, it was also the summer that US regulators crossed the aisle to come to something of a consensus: it was time for stricter rules.
Since Buzzfeed reported in June that employees of TikTok’s Chinese parent company ByteDance had access to US consumer data, TikTok has been the focus of rare bipartisan calls for regulation and inquiry.
Those inquiries became more pressing when in July, the FBI director, Christopher Wray, called Chinese espionage the “greatest long-term threat to our nation’s … economic vitality”.
“If you are an American adult, it is more likely than not that China has stolen your personal data,” Wray said. “We’ve now reached the point where the FBI is opening a new China-related counterintelligence case about every 10 hours.”
The China question
TikTok is a relatively new player in the arena of massive global social media platforms but it’s already caught the eye of regulators in Europe. New laws around child safety and general internet safety in the UK and the EU have forced the company to become more transparent about the way it operates and the way content spreads on its platform.
In the US, moves to rein in the video platform have gained momentum only relatively recently, although there’s little debate that the round of regulatory pressure is warranted. With 1 billion users, the platform, which uses an algorithmic feed to push users shortform videos, has had its fair share of run-ins with misinformation, data privacy and concerns about child safety.
Among the issues US lawmakers are most publicly focused on is the app’s connection to China.
TikTok has always said that the data of its US users is stored in data centers in Virginia, and backed up in Singapore. In June, the company announced that all US user data would be routed through servers from the American computing giant Oracle.
But recordings of TikTok executives leaked to BuzzFeed News suggest that China-based ByteDance employees accessed US user data multiple times between September 2021 and January 2022. “Everything is seen in China,” one TikTok employee reportedly said in a meeting.
After that report, members of Congress sprang into action. On 23 June, a bipartisan group of five senators proposed a new bill that would prohibit companies from sending the data of American users to “high risk foreign countries”.
And in July, Senators Mark Warner and Marco Rubio called for the Federal Trade Commission (FTC) to open an investigation into TikTok.
“TikTok, their parent company ByteDance, and other China-based tech companies are required by Chinese law to share their information with the Communist party,” Warner said. “Allowing access to American data, down to biometrics such as face prints and voiceprints, poses a great risk to not only individual privacy but to national security.”
Brendan Carr, the senior Republican commissioner at the Federal Communications Commission (FCC), said the BuzzFeed News story marked a turning point in lawmakers’ approach to TikTok. “What really changed things was it wasn’t people theorizing or government officials saying stuff in talking points that you weren’t really sure if there was any there, there. This was a report that had internal communications and leaked audio of internal meetings … that just blew the doors off of all of [TikTok’s] representations about how it handled data and showed it to be gaslighting.”
Carr, who has advocated for Google and Apple to boot TikTok from their stores, said the revelations made the national security concerns with TikTok more real than ever before, and brought people across the aisle together.
“People can look at me and say, you’re a Republican, you’re a member of the FCC, I don’t believe you for these reasons. But Mark Warner is a serious national security stalwart. He gets daily briefings on this. And he’s out there saying that TikTok scares the dickens out of him.”
TikTok said US legislators’ national security concerns were overblown, and that the platform does not share user data with the Chinese government. “Nor would we if asked,” said company spokesperson Maureen Shanahan.
Shanahan said the company has talked openly about its efforts to limit employees’ access to US user data and the BuzzFeed News report shows TikTok is “doing what it said it was going to”.
“In 2021, TikTok engaged consultants to help assess how to limit data access to US user data,” Shanahan said in a statement. “In the 80 leaked meetings, there were 14 statements indicating that engineers in China had access to US data … It is unfortunate that BuzzFeed cherry-picked quotes from meetings about those very efforts and failed to provide adequate context.”
The company said there are strict controls on who is granted access to US user data and that engineers outside of the US, including in China, can be given access on an as-needed basis. “Like many global companies, TikTok has engineering teams around the world,” Shanahan said. “We employ access controls like encryption and security monitoring to secure user data, and the access approval process is overseen by our US-based security team.”
Bigger than China
Experts the Guardian spoke with did not question the cybersecurity threat China posed to the US. However, some said they worried regulators’ hyper-focus on TikTok’s China connection could distract from other pressing concerns, including TikTok’s algorithm and how much user data the company collects, stores and shares with other US entities.
Little is known about the amount of user data TikTok collects and shares with entities in the US. Even Oracle, the company TikTok tapped to audit its algorithms and data privacy policies to assure lawmakers the platform is free from Chinese influence, has faced its own accusations that it kept dossiers on 5 million people around the world. There are currently no federal regulations that protect such information.
“The China question to me is almost a red herring because there’s so little being done to protect user privacy generally in the US,” said Sara Collins, a senior policy counsel at the non-profit public interest group Public Knowledge. “The thing I would be concerned about is the same stuff that we’re concerned about with Facebook or with Google. It’s their data privacy practices, what they’re doing with that data, how they’re monetizing it and what adverse effects are there on users.”
One measure that could start addressing those concerns is a federal privacy bill that is making its way through Congress. The American Data Privacy and Protection Act (ADPPA) would “actually create a privacy framework for all these companies that would affect TikTok and its busi
ness model”, said Collins, whose employer Public Knowledge works on content moderation and regulation issues. (Public Knowledge has accepted donations from TikTok.)
In the meantime, states are taking matters into their own hands. California passed a landmark child only safety bill that would require platforms such as TikTok and Instagram to vet any products that are geared toward children before rolling them out and implement privacy protections for younger users by default.
Marc Faddoul, the co-director of Tracking Exposed, an organization that keeps tabs on how TikTok’s algorithm works, thinks congressional leaders’ focus on the platform’s China connections misses the mark on pushing for more answers about the app’s algorithm.
“To me, what’s missing from regulators’ radars is that the biggest leverage point in disseminating content online is the mechanics of algorithmic promotion and algorithmic demotion because taking down an individual piece of content, especially if it has already been spread, does little to mitigate the potential harm,” Faddoul said. Those opaque mechanisms, he argued, pose “the biggest threat in terms of interference in internal politics or popular opinion”.
There’s not much insight into how the the algorithm decides what content to promote to the top of each person’s For You Page. But that content has in many cases proven to have realworld ramifications. A Department of Homeland Security intelligence document shows, for instance, that domestic extremists used TikTok to promote violence and call on their followers to bring guns to the US Capitol in the lead up to the January 6 riots. The document also indicates the platform is rife with violent extremist content.
TikTok says it uses “a combination of technology and thousands of safety professionals” to identify and remove videos that violate its policies. AB ObiOkoye, a spokesman for the company, said TikTok will continue those efforts, factchecking content in over 30 languages.
“Factchecking is just one component of how we moderate content,” Obi-Okoye continued. “We use a combination of publicly available information as well as the information we receive from our factchecking partners to help us assess content.”
Getting the details of how TikTok’s algorithm works is also important, Faddoul said. As the Guardian first reported, the company has in the past directed its moderators to censor certain posts, including content that mentioned Tiananmen Square or Tibetan independence Faddoul said. Obi-Okoye said those policies were old and out of use. “Today, we take a nuanced approach to moderation, including building out a global team with deep industry experience and working with external content and safety advisory councils,” Obi-Okoye said.
Too much oversight or too little?
While experts and lawmakers agree more regulation is needed, there’s considerable disagreement about how much regulatory scrutiny TikTok has historically received, particularly relative to players such as Facebook, Twitter and Google.
Carr, the FCC commissioner, partly attributes what he perceives as a seeming lack of focus on TikTok to a politicization of the debate after Donald Trump in 2020 signed an executive order that would force ByteDance to sell or spin off its US TikTok business. (Joe Biden has since revoked that order.)
To him, the threats he believes TikTok poses are in a different class than Facebook and Google’s because of the company’s ties to China. And compared with other China-based tech companies such as Huawei and ZTE, Carr said, TikTok has “largely skated and avoided having to account for some very serious national security concerns”.
Faddoul, the platform algorithm researcher, says he doesn’t think TikTok has received less scrutiny than its counterparts, particularly when comparing the relative sizes of the platforms’ user base. But he says the new level of scrutiny is “absolutely warranted”.
“There is good reason to do this and there is an additional level of concern [because] the Chinese government is autocratic and it has shown in many instances that it can have arbitrary power on Chinese companies.”
Allowing access to American data, down to biometrics such as face prints and voiceprints, poses a great risk to not only individual privacy but to national security
Senator Mark Warner