Background

TikTok is a popular video-sharing smartphone application (app) owned by ByteDance Ltd., a privately held company headquartered in Beijing, China. The app has been under intense U.S. government scrutiny for the past few years as a potential privacy and security risk to U.S. users. A major concern is that ByteDance is subject to Chinese laws that require companies operating in China to turn over user data when asked to by the Chinese national government. Researchers differ over how TikTok's collection of user data compares with other social media apps and whether TikTok poses a unique threat to the privacy and security of its U.S. users, who include many minors.

This report describes the underlying technology and programming of the TikTok app and recommendation engine, as well as how TikTok collects, stores, and shares user data.

Additional information about restricting the use of TikTok, including the legal history, current legislative proposals, considerations for Congress, and a discussion of recent data privacy and national security concerns, can be found in the following CRS products:

• CRS Legal Sidebar LSB10940, Restricting TikTok (Part I): Legal History and Background, by Stephen P. Mulligan;
• CRS Legal Sidebar LSB10942, Restricting TikTok (Part II): Legislative Proposals and Considerations for Congress, by Stephen P. Mulligan and Valerie C. Brannon;
• CRS Insight IN12131, TikTok: Recent Data Privacy and National Security Concerns, by Kristen E. Busch; and
• CRS Legal Sidebar LSB10972, Montana's TikTok Ban and Pending Legal Actions, by Sanchitha Jayaram and Madeline W. Donley.

What Is TikTok?

On August 2, 2018, U.S. users of the Musical.ly app, a short-video service headquartered in Shanghai, China, with a U.S. office in Santa Monica, CA, found that their accounts had been merged into TikTok. Musical.ly had been acquired by ByteDance, the owner of TikTok, in November 2017 for $1 billion as a means for ByteDance to enter the U.S. market. The TikTok app is available in about 150 countries in 75 languages, and has approximately 1 billion monthly active users.¹ In the United States, TikTok has approximately 150 million monthly active users,² and the company maintains offices in Los Angeles and New York. When ByteDance first released the TikTok app in September 2016, videos could be no longer than 15 seconds, but now users are allowed to create videos up to 10 minutes.³ ByteDance is currently estimated to be worth $220 billion.⁴

TikTok's Recommendation Engine

TikTok's appeal relies on what has been called its "addictive" video feed, For You.⁵ For You is filled with endless curated content selected using TikTok's recommendation algorithm. It is similar to Instagram's Explore page and other recommendation-based app designs. However, while both apps consider the videos that a user has interacted with in the past, the accounts and hashtags they have followed, their location and language preferences, and the content the users themselves create, the apps have different methods to prioritize what users see when they open the app. On Instagram, the main feed contains content shared by the people that users follow; the Explore page is a secondary tab, and to see it, users must click away from their main feed. On TikTok, that is reversed: For You is populated with videos selected by TikTok's algorithm, mostly from creators the user doesn't know.

The app builds this feed through a "recommendation engine" using artificial intelligence (AI) technologies and data mining practices. How each user's feed is constructed had been a tightly held secret until June 2020, when TikTok published a blog post, "How TikTok Recommends Videos #ForYou."⁶

The company says its algorithm relies on a complex set of weighted factors to recommend content based on user preferences, including hashtags and videos watched; videos "liked," shared, and commented on; as well as the kind of device a person is using. Each user's feed is unique to the individual. Table 1 lists the specific factors used for recommendations, according to TikTok.

According to TikTok,

[a]ll these factors are processed by our recommendation system and weighted based on their value to a user. A strong indicator of interest, such as whether a user finishes watching a longer video from beginning to end, would receive greater weight than a weak indicator, such as whether the video's viewer and creator are both in the same country. Videos are then ranked to determine the likelihood of a user's interest in a piece of content, and delivered to each unique For You feed.

The blog post was seen by stakeholders as an effort to provide more transparency to the public as the U.S. government was increasing its scrutiny of the company's practices.⁷

Data Collection, Storage, and Sharing by TikTok

Critics, including some Members of Congress, cite as problematic the amount of data that TikTok collects from and about its users, how that data is stored, and how it could potentially be shared with the Chinese government and used in influence campaigns⁸ or against U.S. citizens.⁹ Because of these concerns, the federal government and more than half of U.S. states have banned the app on devices issued to certain government employees.¹⁰ Some private firms, such as Wells Fargo Inc., have banned or discouraged the use of the TikTok app.¹¹

Data Collection

According to its privacy policy,¹² TikTok collects a range of user information, including location data and internet address, keystroke patterns, and the type of device being used to access the app. The app also collects and stores a user's browsing and search history within the app, as well as the content of any messages exchanged using the app. Additional information can be collected based on user permission: phone number, phone book, and social-network contacts; GPS data; user age; user-generated content (e.g., photos and videos); store payment information; and the videos "liked," shared, watched all the way through, and re-watched.

TikTok continues to state that the app does not collect more user data than other social media apps¹³ and online platforms, such as Facebook and Google (both of those companies track user activity across devices, while TikTok claims that it does not).¹⁴ According to some scholars, the data that TikTok collects from users appears to be comparable to what other social media companies gather and use.¹⁵ However, some critics have described TikTok's approach to data mining as aggressive¹⁶ and argued that its ability to track user behavior while using the app, as well as its access to a user's photos, videos, and phone book and geolocation tracking (based on user permissions), means that it can build extremely detailed behavioral profiles of its users that could potentially be shared with the Chinese government.¹⁷ On February 14, 2022, TheWrap reported

TikTok can circumvent security protections on Apple and Google app stores and uses device tracking that gives TikTok's Beijing-based parent company ByteDance full access to user data, according to the summaries of two major studies obtained by TheWrap that appear to confirm longstanding concerns raised by privacy experts about the popular video-sharing app.¹⁸

Data Storage

TikTok claims to store all content created by U.S. users—as well as data about those users—only on servers located within the United States and in Singapore. Those servers are owned or controlled by TikTok, but the company denies that it shares or would share this data with the Chinese government,¹⁹ stating

The key personnel responsible for TikTok … are all Americans based in the United States—and therefore are not subject to Chinese law. U.S. content moderation is likewise led by a U.S.-based team and operates independently from China, and, as noted above, the TikTok application stores U.S. user data on servers located in the United States and Singapore.²⁰

Data Sharing

TikTok has asserted that all user data is stored in servers located within the United States and Singapore; however, in testimony to the House Committee on Energy and Commerce on March 23, 2023, TikTok's Chief Executive Officer, Shou Zi Chew, stated that ByteDance may still have access to U.S. data. Further, a lawsuit filed in federal court²¹ in December 2019 asserted that user data was harvested and sent to servers in China.²²

White House TikTok Executive Orders

Then-President Trump issued two executive orders affecting the future of TikTok in the United States, one on August 6, 2020 (E.O. 13942),²³ and another on August 14, 2020 (no number assigned).²⁴ In 2021, the Biden Administration rescinded E.O 13942;²⁵ it has chosen thus far not to enforce the order of August 14, 2020. For details on the two executive orders and legal challenges, see CRS Legal Sidebar LSB10940, Restricting TikTok (Part I): Legal History and Background, by Stephen P. Mulligan, and CRS Legal Sidebar LSB10942, Restricting TikTok (Part II): Legislative Proposals and Considerations for Congress, by Stephen P. Mulligan and Valerie C. Brannon.

China's Cybersecurity Law and Export Rules

The Cybersecurity Law of the People's Republic of China was passed in November 2016 and went into effect in June 2017. It was updated in November 2018 by the Regulations on Internet Security Supervision and Inspection by Public Security Organs, and again in September 2022.²⁶ The law

• strictly controls online activities;
• mandates the local storage of user data and the registration of certain network assets; and
• allows the government to conduct onsite and remote inspection of computer networks.²⁷

The law requires Chinese companies to cooperate with government intelligence operations if so requested²⁸ and may allow the Chinese government access to user data collected by any company doing business in China. One analyst notes that "by demanding access to any data collected and stored in China, the updated regulations force [domestic and] foreign companies based in China to comply with its investigative measures, leaving intellectual property and private information vulnerable to government abuse."²⁹

On August 31, 2020, China took specific action that could prohibit the sale of TikTok's underlying technology and processes. The new export regulations cover such technologies as "text analysis, content recommendation, speech modeling, and voice recognition."³⁰ Since the recommendation engine is considered one of the key elements of TikTok's success, a ban on transferring the technology and processes used to create it could make it more difficult to sell the app or prevent a sale altogether.³¹

Status of Potential Oracle Partnership with TikTok

On September 14, 2020, Oracle announced that it had reached an agreement with ByteDance to "serve as [the company's] trusted technology provider" in the United States. From the terminology used in the proposal, it appeared that the deal involved a partnership rather than a sale, with TikTok using Oracle's cloud hosting services.³² This arrangement would keep the source code of the For You feed and algorithmic recommendation engine in the hands of ByteDance. As of June 2023, the Committee on Foreign Investment in the United States (CFIUS)—which was charged with reviewing the national security implications of the agreement—had not reached a decision regarding TikTok's possible forced divestiture or other requirements.

On September 19, 2020, Oracle announced that Walmart would join its bid for TikTok, with the two companies acquiring 20% of a newly formed company, TikTok Global,³³ and the remaining 80% owned by ByteDance. According to announcements made by the companies, 40% of ByteDance is owned by U.S. investors, so that the new company would be under majority U.S. ownership.³⁴ However, this arrangement, along with TikTok keeping the For You recommendation engine algorithm,³⁵ would not appear to satisfy the conditions of E.O. 13942.

On September 23, 2020, TikTok filed for, and was granted, an injunction in federal court to stop the ban on the app that was set to take effect on September 27, 2020. TikTok was granted an extension until November 27, 2020, to persuade the U.S. government to approve the deal with Oracle and Walmart. The extension date passed, but the Biden Administration did not enforce the ban that had been set to take effect.

Due to the ongoing CFIUS examination, as well as legislative and executive efforts to ban the app in the United States, in March 2023, TikTok was reported to be reconsidering a partnership with Oracle and Walmart.³⁶

Discussion

Some believe TikTok and other apps developed and owned by Chinese companies pose a serious security risk to the United States because Chinese companies are governed by China's Cybersecurity Law. Others believe that TikTok is caught up in increasing trade tensions between China and the United States.³⁷

Threat to Security

Although TikTok forcefully states that it does not share U.S. user data with the Chinese government, many security and privacy advocates are skeptical. TikTok did admit that employees in China had accessed the data of a few U.S. journalists in 2022. That incident is being investigated by Justice Department.³⁸

Other countries have acted against TikTok on the grounds of security. India banned TikTok and 50 other Chinese apps in June 2020, calling them a "threat to sovereignty and integrity."³⁹ Also in June 2020, the European Union opened an investigation into TikTok to examine possible violations of its General Data Protection Regulation (GDPR).⁴⁰ Australia had threatened to ban the app, but on August 4, 2020, the country's Prime Minister indicated that TikTok would not be banned;⁴¹ however, in March 2023, 68 federal agencies in that country banned the app on work-related phones. At least 15 other countries have partially or completely banned the app in 2022 and 2023.⁴²

Technology Trade Protectionism

Other observers argue that TikTok is caught in "the crosshairs of a global technology battle,"⁴³ and that a unilateral U.S. ban on any app may be comparable to China's "Great Firewall."⁴⁴ One way to potentially understand U.S. and Chinese government actions in this dispute may be through the concept of techno-nationalism,⁴⁵ which refers to a country's refusal or reluctance to import other countries' advanced technology, as well as to export, or to allow other nations to benefit from, its own advanced technology. Within this framework, technology is considered a central pillar of a country's well-being:

Techno-nationalism … links technological innovation and capabilities directly to a nation's national security, economic prosperity, and social stability.… [It] seeks to attain competitive advantage for its stakeholders, both locally and globally, and leverage these advantages for geopolitical gain.⁴⁶

One policy mechanism that nations use to protect what they view as important or sensitive technologies is export controls, rules that limit to which foreign entities and under what circumstances or conditions specific technologies may be sold or licensed.⁴⁷ For example, in August 2020, the Bureau of Industry and Security at the Department of Commerce announced sanctions that restrict foreign semiconductor companies from selling chips developed or produced using U.S. software or technology to Huawei, another Chinese company, without first obtaining a license to do so.⁴⁸ This restriction has been called a "lethal blow"⁴⁹ to the company.

Another mechanism is the use of protectionist practices that privilege domestic entities' access to domestic markets. For example, China requires U.S. telecommunications companies to enter a partnership with a Chinese company to provide services in that country. In June 2020, the Senate Committee on Homeland Security and Governmental Affairs Permanent Subcommittee on Investigations issued a report, "Threats to US Networks: Oversight of Chinese Government Owned Carriers." The report notes that while China has access to the U.S. telecommunications market, U.S. companies do not have that same level of access in China:

China does not provide US telecommunications companies reciprocal access to the Chinese market and requires foreign carriers seeking to operate in China to enter into joint ventures with Chinese companies. These joint ventures often require U.S. companies to give their technology, proprietary know-how, and intellectual property to their Chinese partners.

Since China was allowed to join the World Trade Organization in 2001, the report notes that "not a single foreign firm has succeeded in establishing a new joint venture" to provide basic telecommunications services in China.

Congressional Action in the 118^th Congress

Controversy followed TikTok from the 117^th Congress into the 118^th Congress. Some Members have introduced various bills that would affect TikTok's ability to continue operating in the United States, and the House Committee on Energy and Commerce has held a hearing on TikTok.

Legislation

Representative Michael McCaul introduced the Deterring America's Technological Adversaries (DATA) Act (H.R. 1153, H.Rept. 118-63) on February 24, 2023. Among other provisions, the bill would require federal actions to protect the sensitive personal data of U.S. persons, with a particular focus on prohibiting the transfer of such data to foreign persons influenced by China. It would also require the Department of the Treasury to issue a directive prohibiting U.S. persons from engaging in any transaction with any person who knowingly provides or may transfer sensitive personal data subject to U.S. jurisdiction to any foreign person subject to Chinese influence. The bill was reported by the Committee on Foreign Affairs on May 16, 2023, and placed on the Union Calendar, Calendar No. 43, the same day.

Representative Kat Cammack introduced the Chinese-owned Applications Using the Information of Our Nation (CAUTION) Act of 2023 (H.R. 750) on February 2, 2023. The bill would require any person who sells or distributes the social media application TikTok (or any service developed or provided by ByteDance Ltd.) to disclose, prior to download, that the use of the application is prohibited on government-owned devices. The bill was ordered to be reported, amended, on March 9, 2023, by the House Committee on Energy and Commerce.

Representative Ken Buck introduced the No TikTok on United States Devices Act (H.R. 503) on January 25, 2023. Among other provisions, the bill would impose sanctions on the parent company of the TikTok social media service, ByteDance Ltd., as long as it is involved with TikTok. Specifically, the President would be required to impose property-blocking sanctions on ByteDance or any successor entity or subsidiary if it is involved in matters relating to (1) TikTok or any successor service; or (2) information, video, or data associated with such a service. Additionally, the bill would require the Office of the Director of National Intelligence (ODNI) to report to Congress on any national security threats posed by TikTok, including the ability of China's government to access or use the data of U.S. users of TikTok. Within 180 days of the bill's enactment, ODNI would be required to brief Congress on the implementation of the bill. On February 27, 2023, the bill was referred to the Subcommittee on the National Intelligence Enterprise.

Senator Josh Hawley introduced the No TikTok on United States Devices Act (S. 85) on January 25, 2023. The bill is substantially similar to H.R. 503. On January 25, 2023, the bill was referred to the Committee on Banking, Housing, and Urban Affairs.

Representative Brian Babin introduced the Terminate TikTok on Campus Act of 2023 (H.R. 231) on January 10, 2023. The bill would prohibit federal funds from being provided to an institution of higher education unless the institution has banned use of TikTok on electronic devices. The bill was referred to the House Committee on Education and the Workforce the same day it was introduced.

Representative Jack Bergman introduced the Protecting Personal Data from Foreign Adversaries Act (H.R. 57) on January 9, 2023. Among other provisions, the bill would authorize sanctions and other prohibitions relating to software that engages in user data theft on behalf of certain foreign countries or entities, and allow the President to regulate or prohibit transactions using software that engages in the theft or unauthorized transmission of user data and provides access to such data to a communist country, the Chinese Communist Party, a foreign adversary, or a state sponsor of terrorism. Additionally, the bill would allow the President to impose visa- and property-blocking sanctions on developers and owners of software that makes unauthorized transmissions of user data to servers located in China that are accessible by China's government or the Chinese Communist Party. It would also require the Department of State to determine and report to Congress whether WeChat or TikTok fall within certain regulations and prohibitions.

Other bills introduced in the 118^th Congress would likely impact TikTok without explicitly naming the company. For example, the RESTRICT Act (S. 686) would create new authorities for the Secretary of Commerce to review and prohibit certain information and communications technology (ICT)-related transactions with foreign entities. These authorities could impact foreign entities such as TikTok. On January 9, 2023, the bill was referred to the Committee on Foreign Affairs and the Committee on the Judiciary for consideration of such provisions that fall within the jurisdiction of those committees.

Hearing

On March 23, 2023, the House Committee on Energy and Commerce held a full committee hearing, "TikTok: How Congress Can Safeguard American Data Privacy and Protect Children from Online Harms." During that hearing, Members questioned the TikTok Chief Executive Officer (CEO) Shou Zi Chew for approximately five hours about the safety and security of the app, including his company's relationship with China, possible teen addiction to the app, and misinformation being spread on the app. In particular, some Members expressed concern that TikTok's parent company, ByteDance, might be sharing U.S. users' data with the Chinese government.⁵⁰

After the hearing, a TikTok spokesperson, Brooke Oberwetter, stated that the day had been "dominated by political grandstanding" that didn't acknowledge TikTok's current attempts to address the issues raised by the lawmakers. Oberwetter also noted

not mentioned today by members of the committee: the livelihoods of the 5 million businesses on TikTok or the First Amendment implications of banning a platform loved by 150 million Americans.⁵¹

The hearing does not appear to have settled the underlying dispute between the U.S. government and TikTok. There is no publicly available evidence that the Chinese government has accessed the information of U.S. users, but national security experts say it is a possibility. TikTok says that the Chinese government has never been shown to have influenced the app's recommendation algorithm, though experts say it is hypothetically possible.⁵² TikTok has admitted that company employees in China accessed the data of a few U.S. journalists, an incident that is being investigated by Justice Department.⁵³

Conclusion

The variety of apps available to U.S. users is enormous. Situations similar to the case of TikTok may arise in the future with other apps created by foreign companies. Congress may wish to consider various options to address such situations, including (1) developing an overarching legal and regulatory framework to protect the security and privacy of U.S. citizens' data and communications, and (2) establishing a uniform, transparent process to assess the risks posed by foreign apps and establish mechanisms to mediate those risks.

Appendix. Related Congressional Activity—117^th Congress

During the 117^th Congress, 10 bills were introduced that would have affected the operation of TikTok in the United States; one became law. Four hearings were held that focused on TikTok's operation in the United States.

Laws

One TikTok-related bill became law in the 117^th Congress.

• H.R. 2617 (P.L. 117-328), Consolidated Appropriations Act, 2023
  Introduced by Gerald E. Connolly on April 16, 2021, and became law on December 29, 2022.
  The law, which adopted the provisions of S. 1143, prohibits the installation and use of the TikTok app on devices owned by the federal government.

Legislation

Ten TikTok-related bills that did not become law were introduced in the 117^th Congress.

• H.R. 8772, Block the Tok Act
  Introduced by Representative Dusty Johnson and referred to the House Committee on Energy and Commerce Subcommittee on Consumer Protection and Commerce on September 6, 2022.
  This bill would have prohibited TikTok from accessing user data of U.S. citizens from within China and required the Federal Trade Commission to investigate whether TikTok engaged in unfair or deceptive practices. The bill also would have prohibited the download or use of TikTok at U.S. military installations, at certain federal agencies, and on federal government devices.
• H.R. 6837, No TikTok on Department of Homeland Security Devices Act
  Introduced by Representative Michael Guest and referred to the House Committee on Homeland Security Subcommittee on Oversight, Management, and Accountability on February 25, 2022.
  This bill would have prohibited Department of Homeland Security (DHS) employees and contractors from using TikTok on DHS computers or other information technology equipment. It also would have required DHS to remove the application from DHS equipment. The bill included exceptions for law enforcement activities, national security interests and activities, and security researchers.
• H.R. 4793, Protecting Personal Data from Foreign Adversaries Act
  Introduced by Representative Jack Bergman on July 29, 2021, and referred to the House Committee on the Judiciary Subcommittee Immigration and Citizenship and Subcommittee on Courts, Intellectual Property, and the Internet on November 1, 2022.
  This bill would have authorized sanctions and other prohibitions relating to software that engage in user data theft on behalf of certain foreign countries or entities. It also would have allowed the President to regulate or prohibit transactions using software that engages in the theft or unauthorized transmission of user data and provides access to such data to (1) a communist country, (2) the Chinese Communist Party, (3) a foreign adversary, or (4) a state sponsor of terrorism.
• H.R. 4521, United States Innovation and Competition Act of 2021
  Introduced by Representative Eddie Bernice Johnson on July 29, 2021, and reported (amended) by the Committee on Science, Space, and Technology; passed/agreed to in the Senate on March 28, 2022.
  The bill would have required, with certain exceptions, that executive agencies requiring the remove TikTok and similar apps from their information technology.
• H.R. 3057, ACES Act of 2021
  Introduced by Representative Lisa C. McClain on May 7, 2021, and referred to the House Committee Energy and Commerce Subcommittee on Consumer Protection and Commerce on May 10, 2021.
  This bill would have required certain actions related to ByteDance Ltd., the Chinese parent company of TikTok, including requiring ByteDance to divest itself of assets or property used to enable or support ByteDance's operation of TikTok in the United States.
• S. 1260, United States Innovation and Competition Act of 2021
  Introduced by Senator Charles E. Schumer on April 20, 2021, and passed the Senate on June 8, 2021.
  The bill would have required, with certain exceptions, that executive agencies remove TikTok and similar apps from their information technology.
• H.R. 2566, No TikTok on Government Devices Act
  Introduced by Representative Ken Buck and referred to the House Committee on Oversight and Reform on April 15, 2021.
  This bill would have required, with certain exceptions, that TikTok be removed from the information technology of federal agencies.
• S. 1143, No TikTok on Government Devices Act
  Introduced by Senator Josh Hawley on April 15, 2021, and received and held at the desk in the House on December 15, 2022.
  This bill was included as section 102 of Division R of the Consolidated Appropriations Act, 2023 (P.L. 117-328) and requires TikTok to be removed from the information technology of federal agencies.
• S. 47, APP Act
  Introduced by Senator Marco Rubio and referred to the Senate Committee on Commerce, Science, and Transportation on January 26, 2021.
  This bill would have established requirements for owners and operators of certain software (e.g., TikTok) from specified countries who make their software available to consumers in the United States. For example, before making such software available for download, the software would have been required to provide users with a warning to include the name of the owner and the owner's country of principal operation.

Hearings

Three hearings were held in the Senate and one joint hearing was held that focused on issues related to TikTok.

• U.S.-China Relations: Improving U.S. Competitiveness Through Trade (S. Hrg. 117-351)⁵⁴
  Senate Committee on Finance
  April 22, 2021.
• Congressional-Executive Commission on China (Annual Report 2022)⁵⁵
  Joint Hearing
  November 3, 2022.
• Emerging Technologies and Their Impact on National Security (S. Hrg. 117-148)⁵⁶
  Senate Committee on Armed Services
  February 23, 2021.
• Nominations of the 117^th Congress, Second Session, Part II (S. Hrg. 117-642)⁵⁷
  Senate Committee on Foreign Relations
  June 23, 2022, through November 30, 2022.