TikTok Ban Raises Data Security, Control Questions

Congress voted in favor of banning the popular social media app TikTok on Wednesday, following its passage last week by the House Energy Committee. The bill requires any company controlled by a "foreign adversary" to be divested within 180 days.

Pressure against the app, owned by Chinese parent company ByteDance, has been mounting for years. Security concerns have focused on the app's capacity to spread misinformation and ByteDance's data management practices.

The bill proposes divesting TikTok to a US-based company. If ByteDance refuses to sell, US-based app stores and Web hosting services would be barred from offering the app, with companies facing fines for non-compliance.

While the House overwhelmingly supported the bill, Senate consideration remains uncertain. If passed, it would mark the first legislative attempt to effectively ban a major social media platform like TikTok, which counts approximately 170 million American users.

Issues with TikTok concerning data privacy and data storage extend beyond the US, raising concerns in the UK — where TikTok had to pay a massive fine last year for disregarding data protection for children — and across the EU.

Use of the app is banned for employees of the European Commission, which based its ban on "cybersecurity threats and actions" that could be exploited for use in cyberattacks.

TikTok has already invested $1.5 billion in a restructuring plan, creating a US subsidiary with 1,500 employees amid mounting scrutiny of its Chinese ties.

TikTok a 'Heightened Threat'

Adam Marrè, CISO at Arctic Wolf, says TikTok represents a heightened threat operating beyond US regulatory safeguards.

"This lack of oversight means they can use all the data they collect and manipulate their algorithm, subtly shaping public opinion, particularly among the youth, with complete impunity," he explains.

He says the platform's capacity to covertly influence societal perceptions, coupled with its potential for exploiting the immense amount of detailed data they collect in ways detrimental to US interests, elevates the risk.

"It operates under a foreign jurisdiction known for leveraging information to its advantage, thus intensifying the concern over its unchecked power," Marrè says.

Narayana Pappu, CEO at Zendata, says TikTok has in the past confirmed that user data is stored in China.

"This ban and potential divestment might change where the US user data is stored," he says.

That could also mean better controls on who has access to user data and removal of potential backdoors, another common practice with services associated with China and the Chinese Communist Party.

From Pappu's perspective, federal governments' involvement and guidelines help protect users and create better guardrails with accountability to platforms.

"These services, as well as the data collection, targeting, sharing networks behind them, are extremely complex," he says.

While noting the app's widespread popularity and the logistical challenges of implementing a complete ban, Marrè says a more viable solution would be for ByteDance to avoid the ban as outlined in the current bill and divest its US operations to an American firm.

"Implementing a complete ban on TikTok presents substantial logistical challenges," Marrè adds.

He says Congressional failure to regulate domestic social media firms has paved the way for foreign entities to operate apps like TikTok without limits.

"Had Congress passed stringent, clear, and robust regulations safeguarding user privacy and offering user control over personal data collection, storage, and utilization, we would have more effective oversight of foreign-owned apps and a ban would likely be unnecessary," Marrè says.

TikTok Drives Billions in Small Biz Revenue

Oxford Economics reported last week that TikTok drove $14.7 billion in small business revenue in 2023, contributing $24.2 billion to US GDP along with 224,000 jobs, with significant impact in California, Texas, Florida, New York, and Illinois.

Small business use of TikTok generated $5.3 billion in tax revenue, with 39% considering it crucial to their existence and 69% citing increased sales.

Additionally, TikTok's US operations contributed $8.5 billion to GDP, generated $2 billion in taxes, and supported over 59,000 jobs.

Chris Olson, president at The Media Trust, says that even while the ban is not yet a sure thing, brands that depend on TikTok for most of their revenue should obviously rethink that dependency, noting uncertainty is a business risk.

"That being said — apart from ethical considerations — there's no real reason for them to stop their operations until the last possible second," he explains.

First, the bill as written does not forbid American companies from using TikTok's business or advertising services, and second, Olson notes it's not certain how well the bill would really work even if passed.

He explains that if ByteDance refused to divest TikTok, it would still be hosted on non-US servers, accessible through the Web and possibly through unofficial apps as well.

If it did divest TikTok, no ban would be enforced, and no change in business operations would be necessary.

At the same time, the app could still maintain its ties with Chinese partners (government or non-government) through other channels.

"This tends to demonstrate the permeability of our digital borders, the difficulty of actually shutting out foreign influence, and the need for greater control," Olson says.