TikTok users opened up the app on Friday, Jan. 23, ready to start another scroll session, only to be met with a pop-up: “Updates to our Terms of Service and Privacy Policy.” The pop-up featured three bullet points announcing an updated corporate entity, referring to the switch to majority U.S.-based management following U.S. government pressure, as well as the collection of new types of data like exact locations and user information being used to curate targeted ads outside of TikTok.
Now that user data is in the hands of U.S.-based software company Oracle, the new privacy policy shows some changes to how that data will be used and collected on the app. Specifically, TikTok will now collect precise location data where only approximate location was used before. Additionally, the app will now collect all data and metadata associated with interactions with AI tools on the app, and TikTok will use user data to influence ads seen outside the app, where it previously only targeted users in-app. Prior to these changes, TikTok’s privacy policy already allowed for all personal data given by the user through content or collected through interactions to be used to personalize the algorithm, which this broader data collection could potentially bolster.
The policy change came with little fanfare, but is a major development in the progression of the controversy over TikTok’s parent company, ByteDance Ltd., storing U.S. users’ data and managing TikTok’s algorithm in China. The controversy, based on concerns that the Chinese government could misuse U.S. user data or tamper with TikTok’s algorithm to spread propaganda and misinformation, led to President Joe Biden signing legislation into law in 2024 demanding that ByteDance either sell TikTok to a U.S.-based owner or be banned by January 2025. ByteDance filed a lawsuit, and President Donald Trump signed four executive orders extending negotiations until a deal was met. The result of this deal was the formation of TikTok USDS Joint Venture LLC, a group of investors including Oracle, Silver Lake and MGX made to manage TikTok in the U.S.
Considering the original TikTok controversy was about data handling and algorithm control, there has been wariness among users that the expanded data collection of the updated policy may allow further exploitation of U.S. users’ information. Sophomore Sofia Grigolia first downloaded TikTok in 2019 and recently uninstalled the app for mental health reasons. She says that, given the context leading to the management switch, there is a hypocrisy to the situation on the part of the U.S. government.
“If they’re worried about data, then wouldn’t the government be allowing the exact same thing that they were worried about?” Grigolia said. “For the U.S. to say China’s doing anything different than that, I feel like it’s kind of dumb.”
Timothy Edgar, a Harvard Law lecturer and cybersecurity expert, told Harvard Law Today that the switch in management avoids none of the security risks of foreign adversaries gaining access to U.S. user data and performing espionage, as there are many other ways to gain access. Additionally, Edgar emphasized that the U.S. doesn’t have uniform privacy regulations, so it may be easier to access that data now that TikTok isn’t under as much scrutiny for data protection.
Given this, Special Education and English teacher Doug Leresche agrees with Grigolia. He expresses dubiousness at the involvement of the U.S. government in facilitating the change.
“It seems like just McCarthyism,” Leresche said. “That all comes from this hegemonic idea that China is going to take over the world, when really, they just would like to be a developed nation. We don’t know that China was doing anything too serious with the data. So I think the U.S. is really just strong-arming them for controlling the money.”
Senior Candace Chiu also worries how sensitive user data like immigration status — which is listed in the privacy policy as OK to be collected from content users make on the app since before the update — may be used in the midst of ICE raids and surveillance efforts targeting illegal immigrants unfolding across the country. In the worst-case scenario, she fears such data could be used to track people. She says that this may compel users to censor themselves on TikTok for fear of being targeted, whether they are at risk or not, which feels unfair.
“TikTok users will probably have to be really careful with what they share online, and what kind of photos or videos they’re going to post,” Chiu said. “The only problem for me is that I’m very used to TikTok’s interface and how things work there — even if my For You page is very curated, because I mainly use it for niche content, like my interests, it still poses a risk that my data will be exposed.”
However, Leresche points out that TikTok isn’t the only entity that collects such data. Other social media platforms like Instagram collect the same data, and much of people’s sensitive information already exists online in various places. As an immigrant, he says that information like his face and fingerprints is already in government systems. Grigolia thinks that this fact will influence how TikTok users will react to the changes in the policy.
“I feel like the problem itself is alarming, but I feel like TikTok users don’t really care, considering data collection is done by every company,” Grigolia said. “It’s all just based on what you’re watching. If you’re that worried about protecting your data, then you shouldn’t be using social media at all.”
Leresche agrees, adding that undocumented immigrants would be more unlikely to be on social media — or at least wouldn’t post about it — if they’ve already avoided being documented in other systems. He says that, as technology and online spaces develop further, protecting all of one’s sensitive information online will become increasingly unrealistic.
“There’s not much you can do,” Leresche said. “I’m not happy about it, but I succumb to the reality that online sources know a lot more about me than I’d like — we can’t really avoid that. But I don’t think TikTok alone is the problem. It’s just adding on to a pile of other problems that are already in place.”
However, for users of TikTok who want to protect their privacy to the highest degree possible while still engaging with the app, an effective practice could be to read the privacy policy thoroughly for themselves so they understand the risks of using it, and to be mindful of those risks while using the app. There are also options to submit requests to delete collected data, and to customize ad settings which are linked in the privacy policy under “Your Rights and Choices.” While this still doesn’t constitute full protection of user data, it is a realistic step users can take.
Ultimately, TikTok’s change in management and updated privacy policy are but another disappointment in the fight for user data protection. Although the switch was framed by the U.S. government as a necessary move to increase national security, the expansion of TikTok’s data collection complicates the narrative. What can be surmised, though, is that regardless of who holds the data, a private online experience for users is unlikely to be prioritized.
