With the change of ownership of TikTokTikTok users in the United States are collectively freaking out over the company’s update. Privacy Policy after being alerted to changes via an in-app message. The revised document details the terms of the US joint venture’s use of its service, including the specific location information it may collect. Many users are also post on social media about language found in the policy, which says TikTok could collect sensitive information about its users, including their “sex life or sexual orientation, transgender or nonbinary status, citizenship, or immigration status.”
But despite the panic, this revelation is not new – and it does not mean what many users fear. The same language appeared in TikTok Privacy Policy Before Closing Ownership Dealand it’s primarily there to comply with state privacy laws, like California’s Consumer Privacy Act, which requires companies to agree to disclose collected “sensitive information” to consumers. Similar information appears in the policies of other social media apps.
To understand why users are concerned — and why the policy reads this way — it’s helpful to look at both the current political climate and the legal requirements TikTok faces.
Specifically, the policy states that TikTok might process information from users’ content or what they may share through surveys, including information about their “racial or ethnic origin, national origin, religious beliefs, mental or physical health diagnosis, sex life or sexual orientation, transgender or non-binary status, citizenship or immigration status, or financial information.”
It’s no surprise that Americans find this type of language troubling, especially given the current political climate.
Intensified immigration enforcement under the Trump administration has led to widespread protests across the country, which have now reached a fever pitch in Minnesota. Friday, hundreds of companies closed their doors in an economic breakdown to protest the presence of Immigration and Customs Enforcement (ICE) in the state. The move follows weeks of clashes between Minnesota residents and ICE agents, which led to thousands of arrests and the death of an American citizen Renee Bon.
But the privacy policy language predates these concerns. In TikTok previous policy, updated August 19, 2024, the company explained that some of the information it collects and uses may “constitute sensitive personal information” under state privacy laws.
Techcrunch event
San Francisco
|
October 13-15, 2026
He then listed these same categories as examples. The legal reason is simple.
The specificity of the policy regarding types of “sensitive information” is related to state privacy laws, such as California’s California Privacy Rights Act (CPRA) and the California Consumer Privacy Act of 2018 (CCPA). The latter, for example, requires companies to notify consumers when they collect “sensitive information,” which the law defines as including things like:
- A consumer’s Social Security, driver’s license, state ID card, or passport number
- A consumer’s account login number, financial account, debit card, or credit card number, in combination with any required security or access code, password, or credentials allowing access to an account.
- The precise geolocation of a consumer
- A consumer’s racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership
- The content of a consumer’s mail, emails, and text messages, unless the business is the intended recipient of the communication
- Genetic data of a consumer
- A consumer’s neural data
- Biometric information for the purpose of uniquely identifying a consumer
- Personal information collected and analyzed regarding a consumer’s health
- Personal information collected and analyzed regarding a consumer’s sex life or sexual orientation
It should be noted that citizenship and immigration status were specifically added to the “sensitive personal information” category when California Governor Gavin Newsom. signed AB-947 on October 8, 2023.
Due to the scheduled in-app alert for transaction completion (a requirement due to the new legal entity), many people are now reading TikTok’s terms for the first time. Seeing this language and fearing the worst, they are post their concerns on social media and warn others; some even threaten to DELETE their accounts.
But what TikTok’s policy actually says is that, in operating its app, it may process sensitive information — particularly if it’s the subject of someone’s video — and that it agrees to process that sensitive information “in accordance with applicable law.”
The policy even refers to the CCPA by name, as an example of the applicable laws that TikTok agrees to.
“Under these laws, TikTok is required to inform users in the privacy policy that sensitive personal information is collected, how it is used, and with whom it is shared,” says Jennifer Daniels, a partner at law firm Blank Rome, where she advises on regulatory and general corporate law issues.
His colleague, Philip Yannella, co-president of Blank Rome’s privacy, security and data protection department, points out that TikTok likely decided to include this language in its privacy policy due to litigation concerns. For example, he says that lately he’s seen several requests under the California Invasion of Privacy Act (CIPA) from plaintiffs’ attorneys that alleged “collection of racial, immigration, and ethnic data.”
A similar type of disclosure to TikTok can be found in other social media apps, although some companies hold the explanations to a higher standard, while others, like TikTok, will list the precise categories that are legally defined as “sensitive information” for clarity.
Yet at least one attorney consulted by TechCrunch noted that spelling out these sensitive details so precisely may actually make things less clear to end users.
For comparison, Meta Privacy Policy also gets quite granular, although it doesn’t specifically include “immigration status” as one of its examples of sensitive information:
Social media users often share deeply personal topics, says Ashlee Difuntorum, a partner at Kinsella Holley Iser Kump Steinsapir (KHIKS) and a business litigator with experience representing software and technology companies.
“TikTok is basically saying that if you disclose something sensitive, that information becomes part of the content that the platform technically ‘collects,'” she told TechCrunch. “Policies like this often seem alarming because they are written for regulators and litigants, not ordinary consumers. That said, the wording can understandably seem intrusive to users when presented so bluntly.”
TikTok did not respond to a request for comment.
Of course, sharing content on social media is not without risk, especially under authoritarian governments that target their own citizens. These apps collect reams of data and governments can enact laws to access it.
Ironically, the decision to move TikTok’s US operations to the United States under new ownership was due to precisely this concern, but China was seen as a potential threat at the time.
Chinese laws require companies to contribute to state intelligence and data security, including the 2017 National Intelligence Law and the 2021 Data Security Law. fear among US lawmakers was that ownership of TikTok by a Chinese entity, ByteDance, could put U.S. citizens at risk, either through surveillance or subtle changes to the app’s algorithm designed to influence people or promote Chinese propaganda.
Today, Americans are more worried about potential surveillance from their own government than from China.
