TikTok is one of the world’s most popular social media apps, boasting over a billion monthly active users globally.
Yet, despite its fun viral videos and massive following, the app has been at the centre of security and privacy controversies.
Policymakers and cybersecurity experts have questioned whether TikTok’s Chinese ownership and data practices pose a risk to users or even national security.
This article will explore what TikTok is, the potential security risks of using it, real-world examples of related concerns, the data it collects, and how users can stay safe on the platform.
TikTok is a social media platform for sharing short-form videos.
Launched by the Beijing-based tech company ByteDance in the late 2010s, it rapidly gained worldwide popularity, especially among young users.
On TikTok, people create and watch clips that are usually 15 to 60 seconds long, often featuring music, dance, comedy skits, or tutorials.
An advanced recommendation algorithm quickly learns users’ preferences and serves up an endless feed of videos on the ‘For You’ page.
This makes the app highly engaging.
TikTok’s ease of use and creative tools have fuelled viral trends and an active creator community across more than 150 countries.
Despite its entertainment value, TikTok’s ownership and data practices have raised flags.
ByteDance operates TikTok outside of China (where a sister app called Douyin is used), but concerns persist because ByteDance is a Chinese company.
The app’s tremendous growth, reaching over a billion users in a few years, has also put it under greater scrutiny by governments and regulators worldwide.
Whether TikTok is a security risk is a subject of active debate.
For the average user, TikTok may not seem more dangerous than other social media apps.
It does not openly infect your phone with malware or steal financial information by itself.
In fact, TikTok’s safety features and app store policies aim to keep the platform itself free of malicious code.
However, government officials and IT security experts have voiced serious concerns about how TikTok handles data and who can access it.
The core issue is that TikTok might pose a privacy and national security risk rather than an immediate technical threat like a virus.
The biggest worry is TikTok’s ties to China.
ByteDance is subject to Chinese laws that could compel it to share user data with the Chinese government if asked.
This raises fears that sensitive information on millions of users could end up in the hands of a foreign government.
Additionally, some worry that TikTok’s powerful content algorithm could be tweaked for propaganda or influence operations.
For example, by promoting or suppressing certain political content to subtly shape public opinion.
These possibilities have led countries like the United States to label TikTok a potential national security threat and even consider banning it outright.
On the other hand, there is no public evidence so far that TikTok has been used for espionage or wide-scale data abuse by any government.
TikTok executives insist that the company operates independently and has never shared U.S. user data with the Chinese government.
Many tech analysts point out that TikTok collects data in ways similar to Facebook, Instagram and other apps.
This means it’s not uniquely invasive, aside from its ownership.
In fact, experts note that TikTok is about as secure and private as any other social media platform in terms of routine data storage and harvesting.
The difference is largely geopolitical: data from TikTok could theoretically be accessed by Chinese authorities, which makes some governments uneasy.
To understand the debate, it helps to look at concrete examples of security concerns related to TikTok.
Over the past few years, there have been several incidents and actions that highlight potential risks:
In response to security fears, a number of governments have taken steps to restrict TikTok.
For instance, the United States, Canada, the United Kingdom, and the European Union have all banned TikTok on government-issued devices.
This is out of fear that sensitive data on those devices could be accessed by TikTok and ultimately the Chinese state.
Several other countries, including India, have gone even further.
India banned TikTok nationwide in 2020, citing national security and privacy concerns amid geopolitical tensions.
More recently, U.S. lawmakers have pursued legislation to force TikTok’s sale to an American company or ban the app entirely in the U.S. if ByteDance refuses to divest it.
These government actions show that authorities across the political spectrum view TikTok’s data practices as a potential risk.
While such bans are often precautionary, they underscore how seriously the security issue is taken at the state level.
Some of the most striking examples of risk come from TikTok’s own employees misusing data.
In December 2022, TikTok disclosed that employees of ByteDance had improperly accessed TikTok user data to spy on several journalists who were covering the company.
The staff members looked at the reporters’ IP addresses and other data to see if those journalists had been in proximity to ByteDance employees, in an attempt to identify leaks to the press.
This incident (which led to the firing of four employees), confirmed fears that TikTok’s data could be misused internally and contradicted the company’s earlier assurances that such spying was not possible.
It was an alarming revelation that insiders abused their access to track individuals, highlighting a serious privacy breach.
Earlier that same year, another report raised red flags about data access across borders.
In June 2022, it was revealed that TikTok’s Chinese staff had repeatedly accessed private data on American users, despite the company’s claims that U.S. user information was walled off. I
In internal meetings, one TikTok engineer in China was quoted as saying “Everything is seen in China”, suggesting that engineers in China could view U.S. user data freely.
This report fuelled concerns that no matter where TikTok stores data physically, ByteDance employees in China might still retrieve it.
TikTok responded by touting ‘Project Texas’ in an effort to store U.S. data on American soil with oversight by U.S. companies.
However, access control was the key issue.
These examples show that unauthorised data access is not a mere hypothetical.
It has happened on some level, eroding confidence in TikTok’s data security promises.
TikTok’s data practices have also led to legal penalties and investigations, which illustrate the app’s security and privacy pitfalls.
Notably, in April 2023 the United Kingdom’s Information Commissioner’s Office fined TikTok £12.7 million for mishandling user data.
The investigation found that TikTok had violated children’s privacy by allowing under 13s on the platform without proper parental consent and by failing to clearly inform users about how their data is used.
This case shows TikTok falling short of data protection standards, at least in the context of protecting minors’ information.
In the United States, TikTok faced a class-action lawsuit alleging it collected personal and biometric data (like facial recognition) from users, including children, without proper consent.
This was settled in 2021 for $92 million.
TikTok did not admit wrongdoing in the settlement, but the suit’s claims added to public wariness about how TikTok gathers and shares sensitive data.
One reason TikTok draws privacy concerns is the extensive range of data it collects from its users.
According to TikTok’s privacy disclosures, the app gathers nearly as much (or even more) information as other social networks.
Here are some key categories of data TikTok collects:
When you sign up, TikTok collects basic personal details you provide.
This includes things such as your name, username, age or date of birth, email address, and phone number.
It also stores your account password and your profile photo.
This means TikTok immediately knows who you are (or at least who you claim to be) and how to contact you.
If you choose to link your phone contacts or social media friends with TikTok, the app can collect your address book information.
This may include your contacts’ names, phone numbers and emails, which TikTok uses to help you find friends or invite others.
It will match these contacts with existing TikTok accounts.
TikTok can also glean data from third-party accounts you connect to, for example your public Facebook profile if you use it to log in.
TikTok obviously collects the videos you upload or create on the app, including any audio in them and any hashtags or captions you add.
It keeps all content you post and also the content you view on the platform.
For instance, TikTok records which videos you watch, comment on, or like, and for how long.
It also saves the messages you send and receive through the app.
The app gathers detailed information about the device and network you use to access TikTok.
This includes your smartphone’s model, operating system, and device identifiers, your IP address, mobile carrier, browser type, language setting, and even time zone.
TikTok can identify your device and link your account to your device’s unique ID and IP location.
If you allow location permissions, TikTok may also collect precise GPS location data from your phone.
TikTok, like many apps, uses cookies and trackers to follow your behaviour within the app and even on some outside websites.
It monitors your in-app browsing and search history, the videos you’ve viewed or liked, and how you interact with ads.
Uniquely, TikTok’s app has been noted to record keystroke patterns and rhythms when you type, which could be used for things like behaviour profiling or detecting bots.
The app also may scan the contents of your clipboard if you copy-paste text or images.
Additionally, TikTok’s analytics can identify objects and scenery in the videos you post.
For example, it might recognise a famous landmark or brand logo in the background of a video.
All these details help TikTok’s algorithm learn your preferences and personalise your feed, but it means a lot of personal habits and even device interactions are being logged.
TikTok’s privacy policy in some regions discloses that it may collect biometric information from user content.
This can include faceprints and voiceprints extracted from your videos.
In practice, this might happen when TikTok applies filters or effects to your face, or for verifying your identity.
TikTok says it would ask permission where required, but this aspect has raised red flags among critics, since facial recognition data is highly sensitive.
Voice and face data could, in theory, be used to identify or track individuals across videos or for surveillance purposes if mishandled.
If you engage in e-commerce on TikTok or buy virtual gifts, the app will collect payment information.
For example, TikTok may store your credit card or payment card details when you make a purchase through the app.
It also logs your purchase history of what you bought, when, and how much you spent.
Even for in-app purchases made via Apple or Google stores, TikTok receives confirmation of the transaction and details of the purchase.
This financial data is yet another category the platform can associate with your profile.
So, is using TikTok a security risk?
The answer is nuanced.
TikTok does collect a vast amount of personal data, and its ties to a Chinese parent company have created a perception of risk in the eyes of many governments and users.
There are legitimate concerns that TikTok could be compelled to share data with Chinese authorities or be leveraged to subtly influence its audience.
This has prompted government bans on the app in certain contexts and increased scrutiny of TikTok’s operations.
Additionally, a few incidents have shown that misuses of data have occurred, underscoring that the app is not without problems.
As with any digital app, stay informed and vigilant.
TikTok is not ‘spyware’ in a strict sense, but it does monitor a lot about you, and that alone means users should treat it with the same caution they would any large social media platform that thrives on personal data.
