The TikTok startup page is displayed on an iPhone in Ottawa on Feb. 27.Sean Kilpatrick/The Canadian Press
TikTok has been in the spotlight this week after the federal government announced it was banning the social media app from its devices days after Canadian privacy commissioners began investigating the company.
The developments stem from renewed interest in ByteDance, the app’s parent company, being based in China, where laws allow the country to demand access to user data.
Canada bans TikTok on all government devices. Here’s what you need to know
The clampdown on TikTok has left many Canadians wondering what happens to the data the company collects on them and whether it’s time to ditch the app.
Brett Caraway, a professor of media economics at the University of Toronto, answers some of their questions.
Should Canadians be concerned about TikTok?
“When we’re talking about online social media platforms, you should always be concerned,” he said.
“Doesn’t matter whether we’re talking about Facebook, Instagram, Twitter or TikTok.”
The concerns stem from these apps’ business models, which are largely focused on generating revenues through targeted ads that necessitate data collection.
Caraway calls TikTok “a particularly pernicious app” because it is “engaging in indiscriminate data harvesting.”
What data is TikTok harvesting?
“TikTok has been found to just scoop up any and all information that it has access to, so that can be almost everything on your phone,” Caraway warned.
Its privacy policy outlines a myriad of data points the company collects including usernames, passwords, dates of birth, email addresses, telephone number, information disclosed in user profiles, photographs and videos.
It processes and collects preferences you set, content you upload, comments you make, websites you’ve visited, apps you’ve downloaded and purchases you have made.
Screen resolution, keystroke patterns, battery levels, audio settings and “your approximate location, including location information based on your SIM card and/or IP address” are also grabbed by the app.
What does TikTok do with the data?
TikTok’s privacy policy details how the company uses data to serve users content and ads catered to their interests and habits, but says the information collected can also be used to enable app features, provide users with support, inform algorithms and help detect and combat abuse, harmful activity, fraud, spam, and illegal activity.
Does TikTok share my data with other parties?
Business, advertising and payment partners might all get access to portions of user data, TikTok says in its privacy policy.
The company will also “share your information with law enforcement agencies, public authorities or other organizations if legally required to do so.”
Where does TikTok store its data?
“The personal data we collect from you may be stored on a server located in Singapore or the U.S., outside of the country where you live,” TikTok’s privacy policy said.
How long does TikTok keep the data?
Under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), when a private entity starts collecting information on you, it has to tell you why and how they’re using it, Caraway said.
If the app is no longer using that data for the specific purposes it outlines in its privacy policy, it has to delete the information, but Caraway said TikTok’s data agreement is so “expansive” that “when would they actually never have a use for that again?”
“I think it’s highly unlikely that TikTok would relinquish any of the information given how broad its stated purposes are,” Caraway said.
Can I ask TikTok to delete my data?
Users can request TikTok delete their data, but Canadian provisions for such an ask are “narrow,” said Caraway.
“You can request access to data and have them edit or delete it, if you can make the case that it’s incorrect somehow or it’s false, but there’s not an across the board right of erasure.”
Some of the lack of erasure rights come from jurisdiction over the app. ByteDance is based in Beijing, but TikTok has offices in several countries, including Canada, where it has staff in Toronto.
PIPEDA states that if an app involves Canadians in a substantial way, then they are obligated to comply with Canada’s privacy standards, said Caraway.
“Those criteria would say that ByteDance, the parent company, should fall under the jurisdiction of that particular act, but whether or not they’re actually going to comply with Canada’s privacy provisions is another story.”
Can a lawyer get my data deleted?
“You can as an individual, go hire a lawyer and make your best attempt to find out what sort of data is collected on you and what’s sitting somewhere, but it’s a David and Goliath situation,” said Caraway
“You are up against one of the largest multinational digital intermediary platform companies in the world, so I don’t have a lot of faith in that sort of approach.”
Knowing all of this now, should I delete the app?
That’s a personal choice, Caraway said.
Whether you delete the app or not, he advises people think more deeply about their social media usage and consider reading the terms of the policies they agree to, when they download apps.
Most people, he said, are ill-equipped to understand all of the legal terms in the agreements and they are prone to adaptations.
“Just because you’ve clicked ‘I agree’ to some user license agreement, they might change it 30 minutes later, or 30 seconds later,” he said.
“They are dynamic. They are changing all the time.”