Cellphone apps are vulnerable

Even before President Trump signed an executive order that could soon smother social network TikTok, Microsoft emerged as a potential savior for the U.S.-based but Chineseowned video service. Now, Twitter and several investment companies are also reportedly talking to TikTok’s owner, ByteDance, about possibly taking over the social network and keeping it going.

While new, non-Chinese ownership would remove some privacy and security concerns, it would also highlight the weaknesses in U.S. law and the ongoing vulnerability of smartphone app users.

Invoking powers granted by Congress to respond to emergencies, Trump issued orders Aug. 6 that will bar U.S. companies and consumers from doing business with TikTok and WeChat, a messaging service owned by China’s Tencent Holdings, starting in mid-September. Trump’s order could make it hard to impossible for the company to reach new users or send updates to existing users.

The president’s ability to threaten the livelihood of a U.S.-based and U.S.-managed company without anything approaching due process is chilling. Yet there are real concerns about TikTok’s data collection practices and its current owner — concerns strong enough to have prompted both houses of Congress to call for the app to be banned on government-issued phones.

TikTok collects an enormous amount of data about its users — not just what they watch while they’re on TikTok, but about such things as the phone they’re using, other apps that have been installed and the online address of the network they’re using.

The implication is that through TikTok, China could assemble a detailed profile of its users and their movements.

Granted, plenty of app makers vacuum data off their users’ phones. And it’s standard operating practice for social networks to use personal data to power algorithms that tailor their news feeds.

But here is where the China angle comes in. Although TikTok is based in Culver City and its users’ data is stored primarily in the United States, its owner is in China, as are the developers of some of its technology.

TikTok insists that it’s never turned over data to China, but its owners can’t just say “no” if Chinese authorities demand the information for national security reasons — or if they insist that ByteDance engineer a “back door” into the app to let them surveil its users. The only way to solve that perceived problem is to cut the connection to China entirely, which is what Trump is trying to make happen.

TikTok users shouldn’t kid themselves about the privacy consequences of a change to U.S. ownership, however. There is no federal law protecting the privacy of user data, other than a broad requirement that companies not mislead the public about their data practices.