In August 2018, Chinese company ByteDance bought video startup Musical.ly and fused it with another app. The result was TikTok, the wildly popular short video app that’s now one of the most downloaded apps in the world.
Today, the social network has more than one billion users, double that of Snapchat and Twitter combined, with TikTok stars making up to $5 million a year on the platform. Yet TikTok’s rapid rise has also led to regulatory and competitive scrutiny. The app has come under fire for moderation and content issues, as well as its ability to influence through a powerful recommendations algorithm.
Nearly half of all people on TikTok are aged between 16 and 24, and some are even younger. In 2019, the US Federal Trade Commission fined ByteDance $5.7 million for collecting information from under 13s in violation of the Children's Online Privacy Protection Act, leading to a similar investigation in the UK. TikTok now has a kids-only mode and under 16 profiles are private by default.
TikTok has also faced criticism based on ByteDance’s Chinese origins. In 2020, TikTok was banned by the Indian government, while former US president Donald Trump also moved to outlaw the app – a decision later reversed by president Joe Biden. TikTok denies the Chinese government can access people’s data.
Like Facebook and Instagram, TikTok’s money is made through advertising, which combined with its recommendations algorithm, requires hefty data collection. So what does TikTok know about you, what tracking does it do, and how can this be stopped?
What TikTok knows about you
TikTok can gather information when you arrive on the site even if you aren’t signed up, via cookies and other trackers. Once you’ve created an account, the social network collects data about your activities and preferences based on the videos you watch.
TikTok knows the device you are using, your location, IP address, search history, the content of your messages, what you’re viewing and for how long. It also collects device identifiers to track your interactions with advertisers. TikTok “infers” factors such as your age range, gender and interests based on the information it has about you. In the US, TikTok can collect biometric information including face and voiceprints.
This data is “extremely valuable” for TikTok and its advertisers, says Morgan Wright, chief security advisor at security company SentinelOne. “If someone watches a video until the end and gives it a like, TikTok can serve up tailored ads based on that. Capturing sentiment with this level of accuracy is harder on other platforms.”
How TikTok tracks you
On the one hand, TikTok’s privacy policy is quite clear. When you sign up, TikTok asks for your email address or phone number and date of birth. It also collects the content you create even if you don’t end up uploading or saving it, and the associated metadata – the when, where and who. If you sign in with Facebook, information can be shared with the social network too.
TikTok says it collects text, images and video from your device's clipboard if you copy and paste content to or from the app, or share it with a third-party platform.
TikTok’s privacy policy contains a lot of details about its vast data collection, says Rowenna Fielding, founder of data protection consultancy Miss IG Geek. “They explain more about tracking and data collection than most other social media companies, but the app employs a lot of techniques to conceal how it is functioning, which makes it difficult to work out which data is going where.”
For example, she says: “The privacy policy says TikTok Ireland and UK are the joint controllers but later it also says data may be shared with the rest of the corporate group. It doesn’t really go into detail about what data and why.”
Because TikTok is not being specific about which data is going where, Fielding says you “have to assume it could be anything”. This could potentially include your profile information and content you create even if you don’t share it with TikTok, contents of the clipboard, and typing patterns. “The reason given is to help develop filters and recommendations, but there are much darker uses, including behavioural profiling and targeting,” Fielding says. “It would be extremely unusual for a for-profit business to not make for-profit uses of these things.”
TikTok also requests a number of permissions on your device, says Sherrod DeGrippo, vice president of threat research and detection at security company Proofpoint. While it’s normal for a video app to request camera and microphone access, “the privacy permissions also allow TikTok to secure detailed information about your location using GPS and other apps you’re running.” These privacy permissions can be accepted or rejected, but turning them off may limit the functionality of TikTok.
How TikTok’s algorithm works
TikTok’s algorithm fuels the app’s recommendation system that determines which videos will appear on the For You page. Each person's feed is unique: TikTok says factors taken into account include videos you have liked or shared and comments you’ve made; video data such as hashtags and captions; and your device and account settings.
TikTok uses machine learning based techniques to understand what you view and why. The goal is to keep you on the platform for as long as possible and collect more data about what you’ve watched. “Every time you use the platform, the algorithm is updated with new data so it can understand you more precisely,” says Jake Moore, cybersecurity specialist at security company ESET.
TikTok can tell if you find a video funny and why, if you’re interested in sports or music, whether you’re religious, into politics or concerned about specific causes. It also knows if you’ve been feeling down lately. The Wall Street Journal’s recent investigation found the app’s algorithm is heavily focused on how long you linger over content. The algorithm can lead you into rabbit holes and towards potentially harmful content not vetted properly by moderators, according to the Wall Street Journal.
Privacy settings to stop TikTok data being collected
Much of the data collection is necessary if you want to enjoy TikTok’s full functionality, but there are settings that allow you to lock it down and turn personalised ads off. To turn Personalised ads on or off, go to Me and select ... to open your settings. Then go to Privacy, Safety, Personalise and data and turn the feature to Off.
To request your data and see what TikTok knows about you, go to Profile and tap ... to open your settings. Go to Privacy, Personalise and Data, Download TikTok Data.
TikTok allows you to set your account as private, so only people you approve can follow you and watch your videos. Yet this impacts functionality, TikTok warns: “With a private account, other users won't be able to Duet, Stitch, or download your videos.” You can limit the audience for your videos in TikTok’s Privacy settings. Or, to set your account as private, go to Me, tap …, Privacy, Turn Private Account On.
Setting your account to private is an “essential first step”, although this will simply guard you from information being shared with others, rather than with TikTok itself, says Will Richmond-Coggan, technology and privacy specialist at law firm Freeths.
It’s good practice to avoid linking your account to other social profiles such as Facebook and Google. “Beyond that, most protection will come from careful configuration of the permissions settings on your device but these will only ever limit, rather than eliminate how much data is shared with TikTok,” says Richmond-Coggan. If you own an iPhone, you can also use Apple’s App Tracking Transparency feature to limit TikTok’s ability to track your activity.
More generally, Moore advises using a burner email address with a different name when you sign up, along with a VPN to help hide your location. “However, platforms such as TikTok are heavy handed about capturing as much data as possible so if you are worried about your privacy, you might want to question how much you really need an account.”
- 💼 Sign-up to WIRED’s business briefing: Get Work Smarter
- Glaciers are melting. One ski resort is fighting back
- The race to grab all the UK’s lithium before it’s too late
- Spotify is breaking podcasts – is it for better or worse?
- Elon Musk flew to Berlin to woo the locals. He failed
- Squid Game is the weird future of local-global TV
- All the ways Netflix tracks you and what you watch
- 🔊 Subscribe to the WIRED Podcast. New episodes every Friday
This article was originally published by WIRED UK
