Examining TikTok’s Potential Engagement With Data Brokers
Alistair Simmons
November 14, 2022
TikTok’s Privacy Policy states: “We may collect information about you from third-party services, such as advertising partners, data providers, and analytics providers.”
This line suggests that not only does TikTok collect information about users through the application, it may also buy or acquire information about users from third parties, including data brokers. (“Data providers” appears to be a possible synonym for data brokers. The term at least appears to describe the act of brokering data.)
Another part of TikTok’s Privacy Policy states: “TikTok may transmit your data to its servers or data centers outside of the United States for storage and/or processing. Third parties with whom TikTok may share your data as described herein may be located outside of the United States.”
It also states that “while TikTok does not sell personal information to third parties, we want you to understand when and with whom we may share the information we collect for business purposes.” This, combined with the line from TikTok’s Privacy Policy above, appears to reflect a distinction TikTok is drawing between “selling” users’ “personal information” and “sharing” users’ “data.”
TikTok adds in its Privacy Policy that: “Please note that information collected by third parties may not have the same security protections as information you submit to us, and we are not responsible for protecting the security of such information.”
In response to finding this information, I contacted TikTok and asked the following questions:
- Does TikTok buy, license, or otherwise acquire data from data brokers pertaining to US persons?
- If TikTok acquires data from data brokers pertaining to US persons, how does it use the data?
- Which third-party services provide data pertaining to US persons to TikTok, and what kinds of data and/or data models do they provide?
- Does TikTok sell to, share with, or otherwise provide data pertaining to US persons to third parties, including data brokers?
I also invited TikTok to provide any additional information or evidence it would like to provide to validate its response.
For informational purposes, the entire set of questions and TikTok’s full responses are below, completely unedited—followed by a short discussion and analysis.
—
- Question: (1) Does TikTok buy, license, or otherwise acquire data from data brokers pertaining to US persons?
- Question: (2) If TikTok acquires data from data brokers pertaining to US persons, how does it use the data?
- Question: (3) Which third-party services provide data pertaining to US persons to TikTok, and what kinds of data and/or data models do they provide?
- [In response to Questions 1, 2, and 3] “Like with other platforms, advertisers may elect to share data with TikTok, either directly or through their data partners. TikTok does not purchase datasets of personal information pertaining to US users from these partners. We use the data advertisers elect to share as described in the Ads and your Data article in our help center and in our business product data terms.”
- Question: (4) Does TikTok sell to, share with, or otherwise provide data pertaining to US persons to third parties, including data brokers?
- “As described in the section of our privacy policy called ‘How we share your information,’ we may provide data to certain service providers and business partners for the stated purposes. For advertising on TikTok, we may share data with service providers to help our advertisers to measure the effectiveness of their ads. This is further described in the section entitled ‘Sharing data with measurement partners’ in the Ads and Your Data article in our help center.”
—
Although TikTok states that it does not directly purchase users’ personal data, it states that it receives information about users from advertisers or from advertisers’ “data partners.” This means that TikTok sources data from third parties, whether it receives that information (a) directly from advertisers or (b) directly from advertisers but sourced originally from their “data partners,” which, given the lack of clarity around that term, could include other social media platforms, data analytics providers, and data brokers. TikTok may not have to explicitly purchase data from data brokers because of its ability to indirectly access brokered data from other sources.
TikTok states that it shares data with “service providers to help our advertisers to measure the effectiveness of their ads.” Typically, third parties measure the effectiveness of ads in cost per lead, where advertisers pay a pre-established price for an already generated list of leads. Measuring the effectiveness of a list of leads often requires “service providers” to share personal and behavioral data with advertisers. To further investigate TikTok’s potential engagements with data brokers, I encourage fellow researchers to publicly inquire:
What data does TikTok supply to advertisers? Do advertisers use that data for other purposes once they have it? Where is the data stored when it is shared with “service providers”? How do advertisers “measure the effectiveness of their ads”? Does TikTok use its data to directly market to users? Does TikTok protect the privacy and security of user data when sharing it with “service providers”?