TikTok users are freaking out over the app’s “immigration status” collection, here’s what it means

With the change in ownership of TikTok, TikTok users in the US are collectively panicking over the company’s updated privacy policy after being alerted to the changes through an in-app message. The revised document details the US joint venture’s terms for using its service, including the specific location information it may collect. Many users are also posting on social media about the language in the policy, which states that TikTok can collect sensitive information about its users, including “their sex life or sexual orientation, their transgender or non-binary status, or their citizenship or immigration status.”

But despite the panic, this revelation is not new, nor does it mean what many users fear. The same language appeared in TikTok’s privacy policy before the ownership deal closed, and is there primarily to comply with state privacy laws like the California Consumer Privacy Act, which requires companies to agree to disclose to consumers what “sensitive information” is collected. Similar disclosures appear in the policies of other social media apps.

To understand why users are concerned — and why the policy reads this way — it’s helpful to look at both the current political climate and the legal requirements that TikTok is navigating.

Specifically, the policy states that TikTok can process information from users’ content or what they may share through surveys, including information about their “racial or ethnic origin, national origin, religious beliefs, mental or physical health diagnosis, sex life or sexual orientation, transgender or non-binary status, citizenship or immigration status, or financial information.”

It is not surprising that Americans find this kind of language troubling, especially in light of the current political climate.

The escalation of immigration enforcement under the Trump administration has led to widespread protests across the country, which have now reached their peak in Minnesota. Hundreds of businesses closed their doors on Friday amid an economic blackout to protest the presence of Immigration and Customs Enforcement (ICE) in the state. The move comes after weeks of clashes between Minnesota residents and Immigration and Customs Enforcement agents, which led to the arrest of thousands and the death of American citizen Rene Judd.

But the language of the privacy policy predates these concerns. In TikTok’s previous policy, which was updated on August 19, 2024, the company explained that some of the information it collects and uses may “constitute sensitive personal information” under state privacy laws.

Then go on to list those same categories as examples. The legal reason is clear.

Policy privacy around types of “sensitive information” relates to state privacy laws, such as the California Privacy Rights Act (CPRA) and the California Consumer Privacy Act of 2018 (CCPA). For example, a recent law requires businesses to inform consumers when they collect “sensitive information,” which the law defines as including things like:

• Consumer Social Security, driver’s license, state ID card, or passport number
• Log in to your consumer account, financial account, debit card, or credit card number with any required security code, access token, password, or credentials that allow access to the account
• Determine the exact geographical location of the consumer
• The consumer’s racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership
• The contents of consumer mail, e-mail, and text messages, unless the company is the intended recipient of the communication
• Consumer genetic data
• Consumer neural data
• Biometric information for the purpose of uniquely identifying the consumer
• Personal information collected and analyzed in relation to consumer health
• Personal information collected and analyzed regarding a consumer’s sex life or sexual orientation
  

It should be noted that citizenship and immigration status was specifically added to the “Sensitive Personal Information” category when California Governor Gavin Newsom signed AB-947 into law on October 8, 2023.

Because of the specific in-app alert that a deal has been closed (a requirement due to the new legal entity), many people are now reading TikTok’s terms for the first time. After seeing this language and fearing the worst, they post on social media about their concerns and warn others; Some even threaten to delete their accounts.

But what TikTok’s policy actually says is that, as part of the operation of its app, it may process sensitive information — especially if it’s the subject of someone’s video — and that it agrees to process that sensitive information “in accordance with applicable law.”

The policy even mentions the CCPA by name, as an example of applicable laws that TikTok agrees to.

“TikTok is required under those laws to notify users in the privacy policy that sensitive personal information is being collected, how it is being used and with whom it is being shared,” explains Jennifer Daniels, a partner at the law firm Blank Rome, where she advises on regulatory issues and general corporate law.

Her colleague, Philip Yanella, co-lead of Blank Rome’s privacy, security and data protection practice, notes that TikTok likely decided to include this language in its privacy policy because of litigation concerns. For example, he says he recently witnessed several demands under the California Invasion of Privacy Act (CIPA) from plaintiffs’ attorneys who alleged “racial, immigration, and ethnic data collection.”

A similar type of TikTok disclosure can be found on other social media apps, though some companies keep explanations at a higher level, while others, like TikTok, list the exact categories legally defined as “sensitive information” for greater clarity.

However, at least one lawyer consulted by TechCrunch noted that spelling out these sensitive, specific details could make things less clear for end users.

By comparison, Meta’s privacy policy gets fairly specific as well, although it does not specifically include “immigration status” as one example of sensitive information:

Users on social media often share deeply personal topics, explains Ashley Devontorum, an associate at Kinsella Holley Iser Kump Steinsapir (KHIKS) and a commercial litigator with experience representing software and technology companies.

“TikTok is basically saying that if you disclose something sensitive, that information becomes part of the content that the platform technically collects,” she told TechCrunch. “Policies like these often seem troubling because they are written for regulators and litigants, not ordinary consumers. However, the wording can understandably strike users as intrusive when put forth frankly.”

TikTok did not respond to a request for comment.

Of course, sharing content on social media is not without risks, especially in light of authoritarian governments that target their citizens. These apps collect large amounts of data, and governments can pass laws to access them.

Ironically, the decision to move TikTok’s US operations to the US under new ownership was due to precisely this concern, but with China then viewed as the potential threat.

Chinese laws require companies to assist with state intelligence and data security, including the National Intelligence Act of 2017 and the Data Security Act of 2021. The fear among US lawmakers was that TikTok’s ownership by a Chinese entity, ByteDance, could put US citizens at risk, either through surveillance or subtle changes to the app’s algorithm designed to influence people or promote Chinese propaganda.

Now people in the United States are more concerned about potential surveillance by their own government rather than by China.