With the change in TikTok ownership, TikTok users in the U.S. are collectively freaking out over the company’s updated privacy policy after being alerted to the changes through an in-app message. The revised document details the U.S. joint venture’s conditions for using its service, including the specific location information it may collect. Many users are also posting to social media about language found in the policy, which says that TikTok could collect sensitive information about its users, including their “sexual life or sexual orientation, status as transgender or nonbinary, citizenship or immigration status.”
But despite the panic, this disclosure isn’t new — and it doesn’t mean what many users fear. The same language appeared in TikTok’s privacy policy before the ownership deal closed, and it’s primarily there to comply with state privacy laws like California’s Consumer Privacy Act, which requires companies to agree to disclose to consumers what “sensitive information” is collected. Similar disclosures appear in other social media apps’ policies.
To understand why users are concerned — and why the policy reads this way — it helps to look at both the current political climate and the legal requirements TikTok is navigating.
Specifically, the policy states that TikTok could process information from users’ content or what they may share through surveys, including information about their “racial or ethnic origin, national origin, religious beliefs, mental or physical health diagnosis, sexual life or sexual orientation, status as transgender or nonbinary, citizenship or immigration status, or financial information.”
It’s not surprising that Americans would find this type of language troubling, especially given the current political climate.
The escalation of immigration enforcement under the Trump administration has led to widespread protests across the country, which have now come to a head in Minnesota. On Friday, hundreds of businesses closed their doors in an economic blackout to protest the presence of Immigration and Customs Enforcement (ICE) in the state. The move follows weeks of clashes between Minnesota residents and ICE agents, which have led to thousands of arrests and the death of American citizen Renée Good.
But the privacy policy language predates these concerns. In TikTok’s earlier policy, updated on August 19, 2024, the company explained that some of the information it collects and uses may “constitute sensitive personal information” under state privacy laws.
It then proceeded to list those same categories as examples. The legal reason is straightforward.
The policy’s specificity around types of “sensitive information” has to do with state privacy laws, like California’s California Privacy Rights Act (CPRA) and the California Consumer Privacy Act of 2018 (CCPA). The latter, for instance, requires businesses to inform consumers when they collect “sensitive information,” which the law defines as including things like:
- A consumer’s social security, driver’s license, state identification card, or passport number
- A consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account
- A consumer’s precise geolocation
- A consumer’s racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership
- The contents of a consumer’s mail, email, and text messages, unless the business is the intended recipient of the communication
- A consumer’s genetic data
- A consumer’s neural data
- Biometric information for the purpose of uniquely identifying a consumer
- Personal information collected and analyzed concerning a consumer’s health
- Personal information collected and analyzed concerning a consumer’s sex life or sexual orientation
Of note, citizenship and immigration status were specifically added to the category of “sensitive personal information” when California Governor Gavin Newsom signed AB-947 into law on October 8, 2023.
Because of the in-app alert timed to the deal’s closure (a requirement because of the new legal entity), many people are now reading through TikTok’s terms for the first time. Seeing this language and fearing the worst, they are posting to social media about their concerns and warning others; some are even threatening to delete their accounts.
But what TikTok’s policy is actually saying is that, as part of operating its app, it may process sensitive information — especially if it’s the subject of someone’s video — and that it’s agreeing to process that sensitive information “in accordance with applicable law.”
The policy even references the CCPA by name, as an example of the applicable laws TikTok is agreeing to.
“TikTok is required under those laws to notify users in the privacy policy that the sensitive personal information is being collected, how it is being used, and with whom it is being shared,” explains Jennifer Daniels, a partner at the law firm Blank Rome, where she provides counsel on regulatory and general corporate law matters.
Her colleague, Philip Yannella, co-chair of Blank Rome’s Privacy, Security, and Data Protection Practice, points out that TikTok likely decided to include this language in its privacy policy because of litigation concerns. For instance, he says that lately, he has seen several demands under the California Invasion of Privacy Act (CIPA) from plaintiffs’ lawyers who alleged “the collection of racial, immigration, and ethnic data.”
A similar type of disclosure to TikTok’s can be found in other social media apps, though some companies keep the explanations more high-level, while others, like TikTok, will list out the precise categories that are legally defined as “sensitive information” for additional clarity.
Still, at least one lawyer consulted by TechCrunch noted that spelling out these specific sensitive details so precisely can actually make things less clear to the end users.
As a point of comparison, Meta’s privacy policy gets fairly granular, too, though it doesn’t specifically include “immigration status” as one of its examples of sensitive information:
Users on social media often share deeply personal topics, explains Ashlee Difuntorum, an associate at Kinsella Holley Iser Kump Steinsapir (KHIKS) and a business litigator with experience representing software and technology companies.
“TikTok is essentially saying that if you disclose something sensitive, that information becomes part of the content the platform technically ‘collects,’” she tells TechCrunch. “Policies like this often look alarming because they’re written for regulators and litigators, not for ordinary consumers. That said, the wording can understandably strike users as intrusive when it’s laid out so bluntly.”
TikTok did not respond to a request for comment.
Of course, sharing content on social media sites isn’t without risk, particularly under authoritarian governments that target their own citizens. These apps collect gobs of data, and governments can enact laws to gain access to it.
Ironically, the decision to move TikTok’s U.S. operations to the U.S. under new ownership was due to this exact concern, but with China then seen as the potential threat.
Chinese laws require companies to assist with state intelligence and data security, including its 2017 National Intelligence Law and its 2021 Data Security Law. The fear among U.S. lawmakers was that TikTok’s ownership by a Chinese entity, ByteDance, could put U.S. citizens at risk, either via surveillance or subtle changes to the app’s algorithm designed to influence people or promote Chinese propaganda.
Now, people in the U.S. are more worried about their own government’s potential surveillance rather than China’s.
