TikTok’s US Venture Enters New Phase of Privacy Scrutiny

TikTok’s establishment of an investor-controlled US entity may finally resolve the social media giant’s battle to allay US national security concerns over Chinese data sharing, but concerns over its US privacy protections are just ramping up.

The new US entity emerges as state and federal regulators are putting a spotlight on kids’ online safety and reining in how companies use sensitive data—two areas where TikTok has already drawn scrutiny.

“Consumer protection, privacy and safety, and the impact of the platform on children and teens, and data scrutiny are the questions that become more in the forefront now with this sale,” said Amy Mushahwar, chair of the data privacy, security, safety and risk management practice at Lowenstein Sandler LLP.

Enforcers have signaled that TikTok USDS Joint Venture LLC will be under just as much scrutiny as its predecessor when it comes to complying with US laws, with more than a dozen state attorneys general still pursuing active kids’ safety lawsuits against the company.

Moreover, TikTok announced it would soon start to collect precise geolocation data, another area of increased concern for lawmakers carving out protections for sensitive information. TikTok’s new ownership, which includes firms with strong ties to the US government such as software and analytics firm Oracle Corp., could cast further concerns on how TikTok’s data is being used not by China, but by the US government.

TikTok committed to winning user trust in its security in the Jan. 22 deal announcement, specifically pledging to run “a comprehensive data privacy and cybersecurity program that is audited and certified by third party cybersecurity experts.”

“From a compliance perspective, it seems like they’re doing okay. The transparency piece is yet to be seen,” said John Howard, senior attorney at Clark Hill.

Kids First

TikTok’s US entity launches while scrutiny of kids’ privacy and safety online is at an all-time high. Tech giants Meta Platforms Inc., TikTok, Snap, and Roblox all face kids safety lawsuits from state attorneys general. More than a dozen states, including New York and Texas, have passed or are looking to pass legislation that would require companies to verify the ages of online users.

TikTok has rolled out strict forms of age verification required by UK and Australia laws, but has not globally introduced age verification technology. Compliance in the US raises its own set of challenges, with a patchwork of states putting forth different age verification laws and a general lack of technical specifics.

Compliance failures could led to even more hot water for the company, which is facing more than a dozen state lawsuits. Some cited its Chinese ties, but the bulk of the states’ complaints focused on the app’s addictive features and harm to children’s mental health. How the US operation’s retraining of TikTok’s algorithm will weigh into attorney general investigations is unclear.

“It’s obvious that TikTok is already aware that they’re going to have to, not necessarily switch gears away from national security concerns, but make sure minors’ data is protected,” said David Oberly, partner at Baker Donelson.

Before the sale was finalized, TikTok ran a safety campaign around parental tools and guardrails. The app’s Guardian’s Guide offers information about TikTok’s rules, family pairing options, setting screen limits, and restrictions on who can send messages to teens. The page was last updated on Dec. 8.

GPS Tracking

TikTok’s new geolocation data collection practices—which enable precise, GPS-derived location data tracking in the US—bring it under additional compliance obligations.

California’s privacy law requires that companies provide users the ability to opt-out of precise geolocation data collection and prohibit the collection of location data near reproductive health clinics and medical facilities. Last year, California’s attorney general launched an investigative sweep into the location data industry for violations of the California Consumer Privacy Act.

Other states have also proposed protections for immigration-related data, a growing concern in light of Immigration and Customs Enforcement’s pressure on both state governments and private companies to share such information.

TikTok released an updated privacy policy last week confirming it already collects data related to citizenship.

Even without specific legislation curbing location data collection, companies like TikTok must be vigilant about potential claims of unfair and deceptive practices, according to Oberly.

For example, the Federal Trade Commission brought multiple enforcement actions over the collection and sharing of sensitive location data under the Biden administration citing general consumer protection laws.

“Certainly collecting location data is an issue platforms are struggling with, but its not unique to TikTok and as long as they’re following the rules they should be able to do it,” said Boris Segalis, partner at Morrison Foerster.

“TikTok woke up and got the same issues as every other US company.”