TikTok users are shocked by the app’s ‘immigration status’ collection — here’s what it means

with changes in TikTok ownershipTikTok users in the US were collectively shocked by the company’s update privacy policy after being alerted about the change via an in-app message. The redacted document details the conditions under which US joint ventures use its services, including the specific location information that may be collected. Many users as well as posting on social media about the language found in the policy, which says that TikTok may collect sensitive information about users, including “sexual life or sexual orientation, status as transgender or nonbinary, citizenship or immigration status.”

But despite the panic, this disclosure is not new – and it does not mean what many users fear. The same language appears in the TikTok’s privacy policy before the ownership deal closedand it is mainly there to comply with state privacy laws like California’s Consumer Privacy Act, which requires companies to agree to disclose to consumers what “sensitive information” is collected. Similar disclosures appear in the policies of other social media applications.

To understand why users are concerned – and why the policy is being read this way – it helps to look at the current political climate and the legal requirements that TikTok is under.

Specifically, the policy states that TikTok can process information from user content or what can be shared through surveys, including information about “racial or ethnic origin, national origin, religious beliefs, mental or physical health diagnosis, sex life or sexual orientation, status as transgender or nonbinary, citizenship or immigration status, or financial information.”

It is not surprising that Americans would find this type of language disturbing, especially given the current political climate.

The escalation of immigration enforcement under the Trump administration has led to widespread protests across the country, which have now reached Minnesota. on friday, hundreds of businesses close the door in an economic blackout to protest the presence of Immigration and Customs Enforcement (ICE) in the country. The move comes after weeks of clashes between Minnesota residents and ICE agents, which led to thousands of arrests and the death of American citizens Renée Bagus.

But the language of privacy privacy before these concerns. On TikTok previous policy, updated on August 19, 2024, the company explained that some of the information it collects and uses may “be sensitive personal information” under state privacy laws.

Then proceed to list the same categories as the example. The legal reasons are straightforward.

The specifics of the policy regarding the type of “sensitive information” are related to state privacy laws, such as California’s California Privacy Rights Act (CPRA) and the California Consumer Privacy Act of 2018 (CCPA). The latter, for example, requires businesses to inform consumers when they collect “sensitive information,” which the law defines as including things like:

• The consumer’s social security, driver’s license, state identification card, or passport number
• Log in to your consumer account, financial account, debit card, or credit card number with a combination of security or access codes, passwords, or credentials that allow access to your account
• The exact geolocation of the consumer
• The consumer’s racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or trade union membership
• Content of consumer emails, emails, and text messages, unless the business is the recipient of the communication
• Consumer genetic data
• Consumer neural data
• Biometric information for the purpose of uniquely identifying consumers
• Personal information collected and analyzed about consumer health
• Personal information collected and analyzed about the consumer’s sex life or sexual orientation
  

Of note, citizenship and immigration status were specifically added to the category of “sensitive personal information” when California Governor Gavin Newsom sign AB-947 into law on October 8, 2023.

Due to the in-app signs scheduled for the closing of the deal (a requirement due to the new legal entity), many people are now reading the terms of TikTok for the first time. See this language and fear the worst, the same post on social media about your concerns and warn others; some even threatened delete that account.

But what TikTok’s policy says is that, as part of the app’s operation, it may process sensitive information — especially if it’s the subject of someone else’s video — and agrees to process that sensitive information “in accordance with applicable laws.”

The policy even references the CCPA by name, as an example of the law that applies to TikTok.

“TikTok is required by law to notify users in its privacy policy that sensitive personal information is collected, how it is used, and with whom it is shared,” explained Jennifer Daniels, a partner at the Blank Roma law firm, where she advises on general corporate law and regulation.

His colleague, Philip Yannella, co-chair of Blank Rome’s Privacy, Security, and Data Protection Practice, indicated that TikTok may have decided to include this language in its privacy policy due to litigation concerns. For example, he said that lately, he has seen several requests under the California Invasion of Privacy Act (CIPA) from plaintiffs’ attorneys alleging “collection of racial, immigration, and ethnic data.”

The same type of disclosure with TikTok can be found in other social media applications, although some companies keep the explanation higher, while others, such as TikTok, will present the exact category that is legally defined as “sensitive information” for additional clarity.

Still, at least one attorney TechCrunch consulted noted that writing down those specific sensitive details could make things less clear to end users.

As a point of comparison, Meta’s privacy policy is also quite granular, although it does not include “immigration status” as one example of sensitive information:

Users on social media often share personal topics, explains Ashlee Difuntorum, an associate at Kinsella Holley Iser Kump Steinsapir (KHIKS) and a business litigator with experience representing software and technology companies.

“TikTok is basically saying that if you reveal something sensitive, that information becomes part of the content that is technically collected,” he told TechCrunch. “Policies like these often seem alarming because they are written for regulators and litigators, not for ordinary consumers. That said, the wording can be perceived by users as intrusive when worded bluntly.”

TikTok did not respond to a request for comment.

Of course, sharing content on social media sites is not without risk, especially in an authoritarian government that targets its own citizens. These apps collect a bunch of data, and governments can enforce laws to gain access to that data.

Ironically, the decision to move TikTok’s US operations to the US under new ownership was due to legitimate concerns, but China was then seen as a potential threat.

Chinese laws require companies to help with state intelligence and data security, including the 2017 National Intelligence Law and the 2021 Data Security Law. fear among US lawmakers is that the ownership of TikTok by the Chinese entity, ByteDance, could endanger US citizens, through surveillance or subtle changes in the application’s algorithm designed to influence people or promote Chinese propaganda.

Today, people in the US are more concerned about the potential surveillance of their own government than China.