U.S. TikTok users are expressing widespread alarm over a recent update to the app's privacy policy, which explicitly mentions the collection of "immigration status" data. An in-app notification about changes following a shift in TikTok's U.S. ownership prompted many to review the terms, leading to a flurry of social media posts and concerns about potential surveillance or misuse of sensitive information. However, legal experts clarify that this disclosure is not new and is primarily a compliance measure for stringent state privacy laws.

Understanding the Policy Language

Despite the current panic, the language regarding "immigration status" and other sensitive data categories has been present in TikTok's privacy policy prior to the recent ownership deal. Its inclusion is largely driven by the need to adhere to U.S. state privacy legislation, such as California's Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA).

These laws mandate that companies explicitly disclose to consumers what "sensitive information" they may collect or process. The CCPA, for instance, provides a comprehensive list of data types considered sensitive, including:

  • A consumer’s social security, driver’s license, state identification card, or passport number
  • Account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account
  • Precise geolocation
  • Racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership
  • Contents of mail, email, and text messages, unless the business is the intended recipient
  • Genetic data
  • Neural data
  • Biometric information for the purpose of uniquely identifying a consumer
  • Personal information collected and analyzed concerning a consumer’s health
  • Personal information collected and analyzed concerning a consumer’s sex life or sexual orientation

Notably, "citizenship and immigration status" was specifically added to California's definition of "sensitive personal information" when Governor Gavin Newsom signed AB-947 into law on October 8, 2023.

Jennifer Daniels, a partner at the law firm Blank Rome, explains, "TikTok is required under those laws to notify users in the privacy policy that the sensitive personal information is being collected, how it is being used, and with whom it is being shared." Her colleague, Philip Yannella, co-chair of Blank Rome’s Privacy, Security, and Data Protection Practice, adds that such detailed disclosures also help mitigate litigation risks, citing recent demands under the California Invasion of Privacy Act (CIPA) concerning the collection of racial, immigration, and ethnic data.

Political Climate Fuels User Anxiety

The current political climate in the U.S., marked by heightened immigration enforcement and related protests, contributes significantly to user anxiety. Recent events, such as economic blackouts and clashes with Immigration and Customs Enforcement (ICE) agents in Minnesota, have made Americans particularly sensitive to any mention of immigration data collection by large platforms. While the policy language predates these specific incidents, the timing of the in-app notification, coinciding with the ownership change, amplified existing fears, leading many to post their concerns on social media and even threaten to delete their accounts.

Comparison with Other Social Media Platforms

Other social media platforms also include similar disclosures in their privacy policies, though the level of detail can vary. While some opt for more high-level explanations, TikTok's precise listing of legally defined "sensitive information" categories, while intended for clarity with regulators, can paradoxically make the policy seem more intrusive to everyday users. Meta's privacy policy, for example, is also granular but does not explicitly list "immigration status" among its examples of sensitive information.

Ashlee Difuntorum, a business litigator with experience representing software and technology companies, notes, "Policies like this often look alarming because they’re written for regulators and litigators, not for ordinary consumers. That said, the wording can understandably strike users as intrusive when it’s laid out so bluntly."

Broader Data Privacy Concerns

The broader context of data privacy and government access remains a valid concern. Social media apps inherently collect vast amounts of user data, and governments can enact laws to compel access. Ironically, the recent change in TikTok's U.S. operations and ownership was intended to address fears that China's government could access U.S. user data via ByteDance, TikTok's former Chinese parent company, due to Chinese national intelligence and data security laws. U.S. lawmakers had expressed concerns about potential surveillance or algorithmic influence. Now, the focus of user apprehension has shifted, with many users more concerned about potential surveillance by their own government.

In essence, TikTok's privacy policy states that it may process sensitive information—especially if users choose to share it within their content or through surveys—and that it commits to doing so "in accordance with applicable law." The explicit listing of categories like "immigration status" is a direct response to legal requirements for transparency, rather than an indication of new or targeted data collection efforts by the platform itself.