With TikTok’s ownership change, TikTok users in the U.S., who were informed of the change through an in-app message, are collectively upset by the company’s privacy policy update. The revised document details the terms and conditions for your use of the service, including certain location information that may be collected by the U.S. joint venture. Many users have also posted on social media about the policy’s language, which says TikTok may collect sensitive information about users, including their “sex lives and sexual orientation, transgender or non-binary status, citizenship or immigration status.”
However, despite the panic, this disclosure is not new and does not mean what many users fear. The same language was included in TikTok’s privacy policy before the ownership agreement was signed, primarily to comply with state privacy laws such as the California Consumer Privacy Act. The law requires companies to agree to disclose to consumers what “sensitive information” they collect. Similar disclosures can be found in the policies of other social media apps.
To understand why users are concerned and why the policy is being interpreted this way, it is helpful to consider both the current political climate and the legal requirements that TikTok is responding to.
Specifically, the policy states that TikTok may process information obtained from your content or shared by you through surveys, including information about your “racial or ethnic origin, national origin, religious beliefs, mental or physical health diagnosis, sex life or sexual orientation, transgender or non-binary status, citizenship or immigration status, or financial information.”
It’s no surprise that Americans find this type of language problematic, especially given the current political climate.
Escalating immigration enforcement under the Trump administration has sparked widespread protests across the country, currently reaching a climax in Minnesota. On Friday, hundreds of businesses shut down in an economic blackout to protest the presence of Immigration and Customs Enforcement (ICE) in the state. The move follows weeks of clashes between Minnesotans and ICE agents that resulted in thousands of arrests and the death of American citizen Renee Good.
But privacy policy language predates these concerns. TikTok’s previous policy, updated on August 19, 2024, explained that some of the information the company collects and uses may “constitute sensitive personal information” under state privacy laws.
tech crunch event
san francisco
|
October 13-15, 2026
Next, I will list the same category as an example. The legal reason is straightforward.
The specificity of this policy regarding the types of “sensitive information” relates to state privacy laws, such as California’s California Privacy Rights Act (CPRA) and the California Consumer Privacy Act of 2018 (CCPA). For example, the latter requires companies to notify consumers when they collect “sensitive information,” which the law defines as including:
A consumer’s Social Security, driver’s license, state ID, or passport number A consumer’s account login, financial account, debit, or credit card number in combination with any required security or access code, password, or credentials that permit access to the account A consumer’s precise geographic location A consumer’s racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership The content of a consumer’s mail, emails, and text messages. The business is the intended recipient of the communication: Genetic data of the consumer Neurological data of the consumer Biometric information intended to uniquely identify the consumer Personal information collected and analyzed regarding the consumer’s health Personal information collected and analyzed regarding the consumer’s sex life or sexual orientation
Notably, when California Governor Gavin Newsom signed AB-947 into law on October 8, 2023, citizenship and immigration status were specifically added to the category of “sensitive personal information.”
Many people are reading TikTok’s terms for the first time, as in-app alerts appear upon completion of a transaction (a new legal requirement). Fearing the worst, they have taken to social media to share their concerns and warn others. Some people threaten to delete their accounts.
But what TikTok’s policy actually says is that as part of operating the app, it may process sensitive information, especially if it’s the subject of someone’s video, and it agrees to process that sensitive information “in accordance with applicable law.”
The policy even mentions the CCPA by name as an example of applicable law to which TikTok agrees.
“Under these laws, TikTok is required to inform users in its privacy policy that sensitive personal information is collected, how it will be used, and with whom it will be shared,” said Jennifer Daniels, a partner at the law firm Blank Rome who advises on regulatory law and general corporate law.
Her colleague Philip Yanella, co-chair of Blank Rome’s privacy, security and data protection practice, notes that TikTok likely decided to include this language in its privacy policy due to concerns about litigation. For example, he says he has recently seen several requests from plaintiffs’ attorneys under the California Invasion of Privacy Act (CIPA) alleging “the collection of racial, immigration, and ethnic data.”
Similar types of disclosures to TikTok can be found on other social media apps, but some companies go on to provide higher-level explanations, while others, like TikTok, list the exact categories that are legally defined as “sensitive information” for greater clarity.
Still, at least one lawyer TechCrunch consulted pointed out that spelling out exactly what these specific sensitive pieces of information could actually make things confusing for end users.
As a comparison, Meta’s privacy policy is also quite detailed, although it specifically doesn’t include “immigration status” as an example of sensitive information.
Ashley DiFantrum, an associate at Kinsella Hawley Iser Kumpf Steinsapir (KHIKS) and a business litigator with experience representing software and technology companies, explains that social media users often share very personal topics.
“TikTok is essentially saying that if you disclose sensitive information, that information becomes part of the content that the platform technically ‘collects,'” she told TechCrunch. “Such policies often seem alarming because they are written for regulators and litigators rather than ordinary consumers. However, it is understandable that users may feel intrusive when the language is too blunt.”
TikTok did not respond to a request for comment.
Of course, sharing content on social media sites is not without risks. This is especially dangerous under authoritarian governments that target their own citizens. These apps collect large amounts of data, and governments can legislate to access it.
Ironically, TikTok’s decision to move its U.S. operations to the U.S. under new ownership was driven by this very concern, even though at the time China was seen as a potential threat.
Chinese laws require companies to support national information and data security, including the National Intelligence Law of 2017 and the Data Security Law of 2021. Concerns among U.S. lawmakers were that TikTok’s ownership by the Chinese company ByteDance could put Americans at risk from surveillance and subtle changes to the app’s algorithms designed to influence people or promote Chinese propaganda.
People in the United States are now more concerned about potential surveillance by their own government than by the Chinese government.
