US frets about TikTok feeding data to China; banning app won’t end the threat, experts say

The idea of the U.S. government banning TikTok, the popular video app with more than 100 million American users, might sound implausible. 

But federal legislation that would pave the way for such a ban has rare bipartisan support. And President Joe Biden signaled in early March that his administration would consider banning the app because of security concerns about TikTok’s China-based parent company, ByteDance. 

On March 15, TikTok confirmed that the Biden administration threatened to ban the app in the U.S. if ByteDance doesn’t divest from the platform. 

As the app has gained popularity in the U.S., TikTok’s potential vulnerability to the Chinese Communist Party has vexed U.S. officials. Most criticism centers on national security risks posed by the app’s data collection, which ranges from users’ email addresses to messages sent within the app and keystroke patterns.

Concerns about the app aren’t new. Former President Donald Trump tried in 2020 to ban TikTok in the U.S., but federal judges blocked his attempts. Over the past two years, TikTok has negotiated with the Committee on Foreign Investment in the United States, a U.S. multiagency group, to address officials’ concerns about national security and privacy.

TikTok’s CEO Shou Zi Chew is slated to testify March 23 before the U.S. House of Representatives’ Energy and Commerce Committee. 

Experts say a ban would not prevent the Chinese government from accessing sensitive data about U.S. social media users. Even if the TikTok app were banned, similar data from other apps would remain available for purchase from third-party brokers. 

TikTok did not respond to a request for comment. PolitiFact has a fact-checking partnership with TikTok; you can read more about it here.

TikTok collects data that users share outright with the app and data that’s created when using the app, according to its privacy policy. 

That includes:

• TikTok account information, such as names, ages, languages, email addresses, phone numbers and profile images;

• Content users create on the app, such as audio and video recordings, messages sent and comments on posts;

• Metadata associated with content created on the app, which can include when and where the content was created. 

TikTok also automatically collects information about users’ devices and networks, including internet protocol addresses (numeric addresses assigned to internet-connected computers), mobile carriers, keystroke patterns and rhythms. The app automatically collects approximate location data based on a device’s subscriber identity module card or IP address and will also collect precise location data if users choose to share it. 

A reporter for The News Movement, a social media news operation re-imagined for Gen-Z consumers, uses her phone to produce a TikTok video on March 1, 2023, in New York. (AP)

A 2022 analysis found that TikTok is more aggressive and more persistent in its data collection than other apps, repeatedly requesting access to user data, even after it has been denied. That analysis, conducted by Internet 2.0, an Australia-based cybersecurity company, also found that the app "can and will run successfully without any of this data being gathered," which suggests it is collected only for data harvesting. 

The collected data can be used to construct comprehensive profiles of individual users, experts said.

When combined, "it’s a lot more than, ‘How many cat videos did you watch?’" said Philip Napoli, director of Duke University’s Dewitt Wallace Center for Media and Democracy, where he researches social media regulation. 

By knowing a person’s precise location at specific times, for example, "you can infer somebody’s personal relationships, somebody’s religion, and a wide range of other factors," said Caitlin Chin, a fellow at the Center for Strategic and International Studies, a national-security think tank in Washington, D.C. 

Experts said U.S. officials’ concerns about TikTok’s data collection are based on two possible scenarios. 

First, the Chinese government could leverage China’s national intelligence and cybersecurity laws to demand access from ByteDance to U.S. TikTok user data. This is particularly concerning for certain categories of people, including government officials, journalists, Chinese nationals in the U.S. who might oppose the Chinese Communist Party and people with ties to individuals in any of those categories, experts told PolitiFact. (This concern appeared to drive the Biden administration’s late 2022 decision to ban TikTok on government-issued devices.)

Second, if given access to TikTok users’ data, the Chinese government could create comprehensive profiles of TikTok users to deploy tailored propaganda or disinformation campaigns. There’s understandable concern about what influence the Chinese government could wield over the content seen by and messages delivered to millions of Americans, said Robyn Caplan, a senior researcher at Data & Society Research Institute, a nonprofit think tank focused on data-centric technology.

National security is also of concern; lawmakers pushing a ban have argued that Chinese government officials could collect data on U.S. government employees and contractors with confidential or sensitive jobs. That data could reveal secure information or be used for blackmail or espionage. 

@politifact #siliconvalleybank collapsed last week. Did regulation changes under #Trump play a role in its downfall? #svb #bank #government #finance #bankfailure #economics #economy #business #LearnOnTikTok #FYP ♬ Chill Vibes - Tollan Kim

PolitiFact's TikTok account has about 150,000 followers.

Data access issues have already emerged, such as when ByteDance employees accessed data of U.S. journalists and used it to track their movements. There was no evidence that China’s government compelled ByteDance employees to access the data. It appeared to be a corporate-driven effort to discover who was leaking information to the press. The Justice Department is investigating this incident, according to news reports. 

To address concerns, TikTok has proposed a $1.5 billion restructuring plan that includes, among other measures, transferring U.S. user data to servers owned by the Texas-based tech company Oracle. 

Banning TikTok would not eliminate China’s access to U.S. social media user data, experts told PolitiFact. Similar data from other apps would still be available for purchase through third-party brokers.

For data collection practices, TikTok is "the norm, not the exception," Chin said. 

U.S.-based tech companies such as Google, YouTube, Twitter and Meta, the company behind Facebook and Instagram, collect much of the same user data. And U.S. law does not significantly restrict how Americans’ data can be collected or used, experts said. 

Duke University’s Napoli said data brokers amass all sorts of user data from social media apps:  "Would they have any qualms about selling that data to the Chinese government? Probably not."

Jen King, privacy and data policy fellow at the Stanford University Institute for Human-Centered Artificial Intelligence, said there are no federal laws to keep Americans’ consumer data from being sold to foreign companies or governments, though data purchased from brokers might be lower-quality than what the Chinese government could obtain directly from TikTok. 

Napoli said TikTok is unique because it has the potential to become a worst-case scenario: It could provide the Chinese government direct access to detailed user data and also could enable the dissemination of a targeted foreign influence campaign on behalf of that government.

TikTok is not the only app used in the U.S. with a connection to China. Other popular apps with China-based owners include WeChat, a messaging app, and Shein, a fashion app. As of September 2020, WeChat had been downloaded almost 22 million times in the U.S. Shein has an estimated 75 million active shoppers, about 13.7 million of whom are U.S.-based, Business of Apps reported.

In September 2022, TikTok Chief Operating Officer Vanessa Pappas told Congress that the company has employees in China, but also has "very strict access controls" for user data.

But TikTok likely has been in lawmakers’ crosshairs because of its large number of U.S. users, particularly younger ones, experts said. Also at play are increased geopolitical tensions between the U.S. and China and a heightened understanding of the impact social media has on people’s everyday lives.

Organizations including the American Civil Liberties Union and Fight for the Future, an advocacy group focused on digital privacy and censorship, oppose the TikTok ban, arguing it would constitute online censorship. Fight for the Future has called for stronger data privacy laws that would limit all companies' ability to collect sensitive data. 

Caplan said the United States has never banned an app and predicted such an action would be challenged on First Amendment grounds. She advocated for more discussion about a ban’s ramifications.

"If we are going to make this monumental decision, there needs to be evidence shown that kind of substantiates the concern." 

PolitiFact staff researcher Caryn Baird contributed to this report.