Is TikTok a Chinese Cambridge Analytica data bomb waiting to explode?

Between 2013 and 2016, 87 million people had their data harvested by Cambridge

Analytica. The psychometric profiles gleaned from the personality quiz they

created were used without their owners’ consents for political purposes and likely

influenced the results of the 2016 US presidential election—and potentially many

more. If the cataclysmic scandal taught us anything, it was that some of the secrets

of the data trade wars are buried in the fine print no one reads.

In preparation for when my kids begin asking about the hugely popular lip-sync

app TikTok, I dug into its privacy policy and its recent revisions. If you joined

TikTok before 2019, what I found should worry you.

I’m getting used to grilling companies about their data practices. In 2017, I sued

Cambridge Analytica. I was trying to get answers about arguably the most

controversial data company in the history of big data, and prove that Donald

Trump’s digital campaign broke UK law in the US election by politically profiling

users in a territory that prohibits this. I mounted a private-action legal effort under
the UK Data Protection Act—and won several key battles along the way before

ultimately being defeated. I still don’t have control over all my data, and the

companies refuse to answer any questions about it.

The quirk of US data being processed in the UK meant that it fell under the

jurisdiction of the Information Commissioner’s Office (theICO, no relation to

cryptocurrency’s “initial coin offerings”),the UK’s data-abuse watchdog agency.

Cambridge Analytica servers were seized under criminal warrant a short time after

the scandal headlines started rocking the world. After more than two years of legal

wrangling in the UK, in January 2019 the firm administrating the Cambridge

Analytica companies pled guilty on behalf of the zombie company. If I hadn’t

asked questions in 2017 and filed a complaint with the ICO, this criminal

conviction of the administrators of Cambridge Analytica wouldn’t have happened.

In the weirdest possible way, we should be glad American data leaked to England.

The UK’s two-decade-old data-protection regime is currently still devoting

immense resources to solving a big mystery about the 2016 US presidential

election. None of this would have happened if our data had remained in the United

States.

But how would you feel if your data had leaked somewhere else? What if that

place were China?

That might have happened with TikTok. It’s hard to tell.

What is TikTok?

TikTok is one of this past year’s trendiest apps, obsessing the youngs and

befuddling the olds. You create your own mini video clips on it, often lip-syncing

along to music; it’s kind of like selfie karaoke. As of last month, it has

been downloaded 800 million times, and has half a billion active monthly users.

(Turns out most of the world dreams of becoming a pop star.)

Unlike the rest of the social-media pack—Instagram, Snapchat, Facebook—TikTok

is not a product of California. Beijing-based company ByteDance launched the

Chinese original, Douyin (meaning “vibrating sound”), to the market in 2016. A

year later they acquired another Chinese-owned app Musical.ly for $800 million

and launched TikTok beyond the Great Firewall. Its incredible success dovetailed

with the demise of Vine, the short video platform acquired and then shuttered by

Twitter.

How could something so frivolous also be so dangerous? “We Should Worry About

How China Uses Apps Like TikTok” exclaimed the headline in a recent New York

Times op-ed. Nick Frisch, a fellow at Yale Law School’s Information Society

Project, warned of China’s newest growth export: the surveillance state. He said

we should be concerned by these “illiberal innovations,” and included the lip-sync

social media sensation in his inventory of reasons to be more skeptical of the Made

in China tech movement.

Having learned the crucial lesson of data sovereignty through my experiences with

Facebook’s favorite democracy-destabilizing personality quiz, I’m now hyper-

sensitized to the question of where our personal data ends up. When I sued

Cambridge Analytica, I was simply demanding answers to the questions that

everyone had about the company: Where did they get our data? What did they do

with it? And with whom did they share it?

I had similar questions of TikTok. If the cataclysmic Cambridge Analytica scandal

taught us anything, it was that some of the secrets of the data trade wars are buried

in the fine print that no one reads. Being a privacy nerd and a parent of kids that

will probably soon be on the Chinese-owned app (as soon as I let them), I did the

thing that almost no one does: I read their privacy policy. I was alarmed to see this

section, which in late 2018 stated that TikTok user data may be transferred to

China.

There’s an underlying geopolitical reason why conscientious parents should go that

extra mile to inspect the international jurisdictions of their kids’ apps. Recently,

Facebook CEO Mark Zuckerberg warned against data localization laws in

authoritarian states like China and Russia, which require companies to store data in
their territories. This grants these governments unrestrained access to user data for

political oppression, algorithmic surveillance, social control, and, who knows,

election interference. As an example of this, Apple was criticized when it acceded

to the Chinese government’s demands that it set up iCloud in state-controlled data

centers. The tech company knew this would mean it could not promise privacy and

security to its customers in China.

In the People’s Republic of China, the Communist Party apparatus is embedded in

the state university system, where R&D labs devised the Great Firewall, innovate

new surveillance tech, and swallow up oceans of big data in the AI arms race.

China has not only successfully isolated its billions of citizens from the rest of the

internet behind the Great Firewall—it has also built its own parallel tech industry.

It has its own Google (Baidu), its own Twitter (Weibo), its own Amazon (Alibaba),

and its own Facebook (Tencent).