TikTok’s ties to China: why concerns over your data are here to stay
In 2021 Android phone users around the world spent 16.2tn minutes on TikTok. And while those millions and millions of users no doubt had an enjoyable time watching clips on the addictive social video app, they also generated a colossal amount of data.
TikTok collects information on how you consume its content, from the device you are using to how long you watch a post for and what categories you like, and uses that information to fine tune the algorithm for the app’s main feed.
For anyone with a passing knowledge of how platforms like Facebook, Instagram and Google function – or who has read Shoshana Zuboff’s Age of Surveillance Capitalism– this data harvesting is not revelatory. However, when it comes to TikTok, the question that consumes many politicians and sceptics is where that data goes. More specifically: does all that information end up being accessed by the Chinese state?
Owned by the Chinese company
ByteDance, TikTok’s success – more than 1 billion users worldwide – is combining with well-established fears about social media’s data collection practices and concerns over China’s geo-political ambitions to generate a background hum of distrust about the app.
“As the geopolitical situation changes I suspect we will see companies such as TikTok will continue to be treated with some caution in the west,” says Alan Woodward, a professor of cybersecurity at Surrey University.
The distrust has already been expressed in scrutiny from regulators and politicians around the world, worried about the amount of data TikTok col
lects and whether Chinese authorities have access to it.
In the US, Donald Trump in August 2020 signed an executive order that blocked people from downloading the app, which was followed by an order for TikTok to sell its US business.
The order issued on 6 August 2020 stated: “TikTok automatically captures vast swaths of information from its users, including Internet and other network activity information such as location data and browsing and search histories. This data collection threatens to allow the Chinese Communist party access to Americans’ personal and proprietary information.”
This, the order claimed, paves the way for China to track the locations of government employees, build dossiers for blackmail and conduct corporate espionage.
The orders were never enforced due to legal challenges and then Trump leaving office. Trump’s successor, Joe Biden, revoked the orders and instead directed the US commerce department to work with other agencies to produce recommendations to protect the data of people in the US from foreign adversaries. The US Committee on Foreign Investment, which scrutinises business deals with non-US companies, is also conducting a security review of TikTok. According to analytics firm data.ai, which produced the 16tn estimate, there are 112 million TikTok iPhone and Android users in the US. Both Democratic and Republican lawmakers have in recent months called for stricter regulation and inquiry.
In India, where TikTok had more than 200 million users, the government in September 2020 banned the platform and dozens of other Chinese apps, after warning that user data was being mined and profiled “by elements hostile to national security and defence of India”.
In Ireland, the data protection watchdog, which regulates TikTok on behalf of the EU, in September 2021 launched an investigation into “transfers by TikTok of personal data to China and TikTok’s compliance with the GDPR’s requirements for transfers of personal data to third countries”.
And the UK parliament shut down its TikTok account this August after a lobbying campaign by Conservative politicians, including former Tory leader Iain Duncan Smith and recent leadership candidate Tom Tugendhat. In a letter to the speakers of the Houses of Commons and Lords, politicians claimed “data security risks associated with the app are considerable”. They also alleged that data from the UK, where the app has an estimated 18 million users, was “routinely transferred to China”.
TikTok’s use of data have also been the subject of several news investigations, including a report from BuzzFeed in June that, based on leaked recordings of internal TikTok meetings, said that China-based employees at ByteDance have accessed nonpublic data abut US TikTok users. In one recording a member of TikTok’s trust and safety department said “everything is seen in China”, according to BuzzFeed.
Separately, Forbes reported in October that a China-based team at ByteDance planned to track two American citizens through the collection of TikTok location data.
Last week TikTok spelled out to its European users that in certain circumstances, for instance checking on the functioning of algorithms or for security reasons, China-based employees can access their data. Earlier this year it acknowledged similar access to US user data.
But experts and analysts differ in their assessments of the TikTok data issue. Mere weeks after the UK lawmakers expressed their concern, the director of UK spy agency GCHQ, Jeremy Fleming, said he would encourage young people to use TikTok. This reflects a British security establishment view that the app is not problematic because it does not process data in China.
In July, a US-Australian cybersecurity firm, Internet 2.0, published a report in which it said data collection on the app was “overly intrusive” and flagged a connection in the app to a server in mainland China, run by Guizhou BaishanCloud Technology Co Ltd. The report said the data that TikTok can access on your phone includes device location, calendar, contacts and other running applications.
TikTok’s approach to data gathering is more aggressive than WeChat, the Chinese super app that performs multiple functions from messaging to ridehailing, according to David Robinson, co-chief executive of Internet 2.0.
“In our opinion, based on detailed analysis, TikTok harvests much more data than WeChat. Their aggressive way of continuously requesting access to contacts after a user has decided not to share contacts is unusual,” he says.
But last year a study by the University of Toronto’s Citizen Lab found that the app did not exhibit “overtly malicious behavior” in terms of data collection and its use of advertising and user activity tracking software was “not exceptional when compared to industry norms”.
TikTok has disputed both the accusations that it collects more data than other social media companies, and that Chinese authorities could access data from its users.
TikTok says that its use of data is in line with industry practices and helps the app function properly and operate securely, as well as helping give users more of what they want. A spokesperson adds: “the TikTok app is not unique in the amount of information it collects”.
The company says its data is not held in China, but in the US – where US user data is routed through cloud infrastructure operated by US firm Oracle – and Singapore, and that it plans to start storing European user data in Ireland next year.
“Since beginning transparency reporting in 2019, we have received zero data requests from the Chinese government,” a TikTok spokesperson added.
The company has denied it is used to “target” US citizens in the wake of the Forbes report. In response to the BuzzFeed report, a TikTok spokesperson said the company has talked openly about its efforts to limit employees’ access to US user data and the BuzzFeed News report shows TikTok is “doing what it said it was going to”.
Referring to the Chinese server claim by Internet 2.0, a TikTok spokesperson said the IP address cited in the report is in Singapore and the network traffic does not leave the region.
TikTok insists that the app is independent. “TikTok is an independent platform, with its own leadership team, including a CEO based in Singapore, a COO based in the US and a Global Head of Trust & Safety based in Ireland,” it says.
Woodward says that even if there is no evidence that TikTok is doing anything with user data other than what is being done by the other major social media platforms, the background presence of China will remain difficult to shake for sceptics.
“The Chinese government’s pervasive yet secretive approach to surveillance means that those who do not trust them do not believe the lack of evidence is proof they are not using data from TikTok.”
He says considerable doubt is generated by China’s National Intelligence Law of 2017, which states that all organisations and citizens shall “support, assist and cooperate” with national intelligence efforts.
Woodward says: “I am sure that many companies, and individuals, feel strongly that they would never provide data from their customers to the Chinese state but how could they resist: the law is absolute and the government are not shy about punishing those who fail to comply.”
“It’s less about TikTok and more about the Chinese Communist party,” said James Lewis, a senior vice-president at the Center for Strategic and International Studies, a US thinktank. “The CCP is unscrupulous and opportunistic when it comes to spying, so distrust is more than justified.”
“Social media pages are a great source of personal detail” for spy agencies, Lewis says, adding that intelligence is now a “big data” game.
For others, data is less of a concern than the platform’s potential for manipulation of opinion. Matt Schrader, an adviser on China at the International Republican Institute, a nonprofit organisation, says the data issue is a “sideshow”.
He adds: “It is far less of a concern for me than the issue of political manipulation on the platform. It is difficult to spot and there is limited evidence of its presence but it is a concern to me because the potential for frontrunning, widespread manipulation of political discourse by the authorities in Beijing who have zero compunctions about using social media in that way.”
As TikTok’s influence grows, and geopolitical tensions between the US and China remain, concerns about data and privacy are likely to stay.
In our opinion, based on detailed analysis, TikTok harvests much more data than WeChat. Their aggressive way of continuously requesting access to contacts after a user has decided not to share contacts is unusual
David Robinson, co-chief executive of Internet 2.0