With the change in TikTok ownership, TikTok users in the US are collectively freaking out over the company’s updates privacy policy after you are notified of the changes via an in-app message. The revised document details the US consortium’s terms for using its service, including the specific location information it may collect. Many users are also post on social media about language found in the policy, which says TikTok could collect sensitive information about its users, including their “sex life or sexual orientation, transgender or non-transgender status, citizenship or immigration status.”
But despite the panic, this revelation isn’t new — and it doesn’t mean what many users fear. The same language appeared in TikTok’s privacy policy before the ownership agreement closesand there’s mostly compliance with state privacy laws, such as the California Consumer Privacy Act, which requires companies to agree to disclose to consumers what “sensitive information” is being collected. Similar disclosures appear in policies of other social media applications.
To understand why users are concerned — and why the policy is being read that way — it helps to look at both the current political climate and the legal requirements TikTok is navigating.
Specifically, the policy states that TikTok could process information from user content or what they may share through surveys, including information about “racial or ethnic origin, national origin, religious beliefs, mental or physical health diagnosis, sex life or sexual orientation, transgender or non-transgender status, citizenship or immigration status, or financial information.”
It’s no surprise that Americans would find this kind of language troubling, especially given the current political climate.
The escalation of immigration enforcement under the Trump administration has led to widespread protests across the country, which have now come to a head in Minnesota. on Friday, hundreds of businesses they closed their doors in financial blackout to protest the presence of Immigration and Customs Enforcement (ICE) in the state. The move follows weeks of clashes between Minnesota residents and ICE agents, which led to thousands of arrests and the death of an American citizen Renee Good.
But the language of the privacy policy precedes these concerns. On TikTok previous policy, updated on August 19, 2024, the company explained that some of the information it collects and uses may “constitute sensitive personal information” under state privacy laws.
Techcrunch event
San Francisco
|
13-15 October 2026
He then proceeded to list these same categories as examples. The legal reason is clear.
The specificity of the policy regarding the types of “sensitive information” relates to state privacy laws, such as the California Privacy Rights Act (CPRA) and the California Consumer Privacy Act of 2018 (CCPA). The latter, for example, requires businesses to notify consumers when they collect “sensitive information,” which the law defines as including things like:
- Consumer Social Security, driver’s license, government ID or passport number
- Your consumer account login number, financial account, debit or credit card number in combination with any required security or access code, password or credentials that allow access to an account
- A consumer’s exact geographic location
- A consumer’s racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or trade union membership
- The contents of a consumer’s mail, email and text messages, unless the business is the intended recipient of the communication
- Genetic data of a consumer
- A consumer’s neural data
- Biometric information for the purpose of uniquely identifying a consumer
- Personal information collected and analyzed about a consumer’s health
- Personal information collected and analyzed about a consumer’s sex life or sexual orientation
It’s worth noting that citizenship and immigration status were specifically added to the category of “sensitive personal information” when California Governor Gavin Newsom signed AB-947 into law on October 8, 2023.
Due to the in-app notification dated to close the deal (a requirement due to the new legal entity), many people are now reading TikTok’s terms for the first time. Seeing this language and fearing the worst, it is posting their concerns on social media and warning others; some even threaten delete their accounts.
But what TikTok’s policy actually says is that, as part of operating its app, it may process sensitive information — especially if it’s the subject of someone’s video — and that it agrees to process that sensitive information “in accordance with applicable law.”
The policy even refers to the CCPA by name, as an example of the applicable law that TikTok agrees to.
“TikTok is required under these laws to notify users in its privacy policy that sensitive personal information is collected, how it is used and with whom it is shared,” explains Jennifer Daniels, a partner at the law firm Blank Rome, where she advises on regulatory and general corporate law matters.
Her colleague Philip Yannella, co-chair of Blank Rome’s Privacy, Security and Data Protection Practice, points out that TikTok likely decided to include this language in its privacy policy due to litigation concerns. For example, he says that recently, he has seen several requests under the California Invasion of Privacy Act (CIPA) from plaintiffs’ attorneys alleging “the collection of racial, immigration and ethnic data.”
A similar type of disclosure to TikTok’s can be found on other social media apps, though some companies keep explanations more high-level, while others, like TikTok, will list the exact categories legally defined as “sensitive information” for clarity.
However, at least one lawyer TechCrunch consulted noted that the precise wording of these specific sensitive details can actually make things less clear to end users.
As a point of comparison, Meta Privacy Policy it gets pretty detailed, too, though it doesn’t specifically include “immigration status” as one of the examples of sensitive information:
Users on social media often share deeply personal issues, explains Ashlee Difuntorum, a partner at Kinsella Holley Iser Kump Steinsapir (KHIKS) and an entrepreneur with experience representing software and technology companies.
“TikTok is essentially saying that if you disclose something sensitive, that information becomes part of the content that the platform technically ‘collects,’” he tells TechCrunch. “Policies like this often seem troubling because they’re written for regulators and judges, not ordinary consumers. That said, the wording can be offensive to users when it’s so bluntly worded.”
TikTok did not respond to a request for comment.
Of course, sharing content on social media sites is not without risk, especially under authoritarian governments that target their citizens. These apps collect a lot of data and governments can legislate to gain access to it.
Ironically, the decision to move TikTok’s US operations to the US under new ownership was due to this very concern, but with China then seen as the potential threat.
Chinese laws require the companies to help with government intelligence and data security issues, including the National Intelligence Act of 2017 and the Data Security Act of 2021. The fear among US lawmakers was that TikTok’s ownership by a Chinese entity, ByteDance, could put US citizens at risk, either through surveillance or through subtle changes to the app’s algorithm designed to influence people. or promote Chinese propaganda.
Now, people in the US are more concerned about potential surveillance by their own government than China.
