TikTok and a federal digital privacy bill of rights

Invoking powers granted by Congress to respond to emergencies, Trump issued orders Aug. 6 that will bar U.S. companies and consumers from doing business with TikTok and WeChat, a messaging service owned by China’s Tencent Holdings, starting in mid-September. The bans seem less like defenses against extraordinary new threats than punches thrown in the larger trade battle between Trump and China. TikTok, after all, is wildly popular here (WeChat far less so; it has roughly one-tenth of TikTok’s active U.S. users), and Trump’s order could make it hard to impossible for the company to reach new users or send updates to existing users.

The president’s ability to threaten the livelihood of a U.S.-based and U.S.-managed company without anything approaching due process is chilling. Yet there are real concerns about TikTok’s data collection practices and its current owner — concerns strong enough to have prompted both houses of Congress to call for the app to be banned on government-issued phones.

TikTok seems innocuous enough: Its users tend to be young people, and the videos (which last from 15 seconds to one minute) mainly feature dancing, storytelling or people mocking something. But the app collects an enormous amount of data about its users — not just what they watch while they’re on TikTok, but about such things as the phone they’re using, other apps that have been installed and the online address of the network they’re using.

The implication is that through TikTok, China could assemble a detailed profile of its users and their movements. Do they have sensitive health or dating apps on their phone? That information might be used as blackmail fodder. Do they connect to networks on military bases, or have pictures of military sites? That’s a potential national security risk.

Granted, plenty of app makers vacuum data off their users’ phones. And it’s standard operating practice for social networks to use personal data to power algorithms that tailor their news feeds — the “For You” streams in TikTok’s case — to their users’ preferences. And unlike, say, Facebook, TikTok doesn’t really need to know who your friends are or what they’re up to.

But here is where the China angle comes in. Although TikTok is based in Culver City and it users’ data is stored primarily in the United States, its owner is in China, as are the developers of some of its technology.

TikTok insists that it’s never turned over data to China, but its owners can’t just say “no” if Chinese authorities demand the information for national security reasons — or if they insist that ByteDance engineer a “back door” into the app to let them surveil its users. The only way to solve that perceived problem is to cut the connection to China entirely, which is what Trump is trying to make happen.

TikTok users shouldn’t kid themselves about the privacy consequences of a change to U.S. ownership, however. There is no federal law protecting the privacy of user data, other than a broad requirement that companies not mislead the public about their data practices. Hence the transformation of the internet into a rapacious collector of personal information, which is then used as currency by third parties. And when device and app makers have sought to protect personal data through encryption, a series of administrations has accused them of abetting terrorists.

Meanwhile, governments at all levels in the United States have long exploited the gray areas in the law to obtain revealing information about phone users without a warrant. So, too, can foreign governments tap into the river of personal data that flows virtually unimpeded online.

One state offering its residents at least some rights regarding the data collected online is the one where TikTok is headquartered, California. The Legislature enacted a pioneering consumer data privacy law in 2018 that should have inspired Congress to give all Americans a say over the personal data that websites collect and share. The lawmakers who worry about TikTok ought to look closer to home and see how vulnerable smartphone users are to the bad data practices that have become the norm among apps. It’s past time for them to enact a federal digital privacy bill of rights.