TikTok's own privacy policy discloses broad collection of user-provided, automatically-collected, and third-party-sourced data — including sensitive categories such as race, ethnicity, and religious belief — and permits sharing with service providers, business partners, and advertising networks, with tracking technologies such as the TikTok Pixel embedded across the wider web. The platform, now operated through a newly formed U.S. joint venture majority-owned by Oracle, Silver Lake, MGX and other non-Chinese investors with ByteDance retaining a 19.9% stake, has a documented regulatory track record including a 2019 U.S. FTC children's-privacy settlement, a 2023 UK ICO fine, a 2023 Irish DPC fine over children's data, and a 2025 Irish DPC fine over EEA-to-China data transfers. As assessed from these public sources, TikTok's privacy posture reflects broad data collection and sharing practices alongside a recurring history of regulatory enforcement across multiple jurisdictions.
TRACK RECORD
2 ENFORCEMENT ACTIONS
[2023-04-04]
On 4 April 2023, the UK Information Commissioner's Office fined TikTok Information Technologies UK Limited and TikTok Inc £12.7 million for breaches of UK data protection law, including failing to use children's personal data lawfully.
In 2019, the FTC and U.S. Department of Justice settled allegations that Musical.ly, now known as TikTok, violated the Children's Online Privacy Protection Act (COPPA) by collecting children's personal information without parental consent; the company agreed to pay $5.7 million, described by the FTC as the largest civil penalty it had obtained in a children's privacy case at that time.
TikTok's Privacy Policy states that it collects user information through three channels: information the user provides, information collected automatically, and information obtained from other sources.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service collect personal data from third parties? — Yes.
TikTok's privacy policy discloses that, under both its prior and updated versions, it may collect information about users' racial or ethnic origin, national origin, and religious beliefs.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — Somewhat.
An internal memo from TikTok's CEO, reported by ABC News, disclosed that under the new U.S. joint venture structure Oracle, Silver Lake and MGX would each hold 15% of the entity while ByteDance would retain a 19.9% stake, with the remainder held by other named investors.
The January 2026 restructuring created a new entity, TikTok USDS Joint Venture LLC, publicly described as structured to address U.S. lawmakers' concerns about data privacy, potential Chinese government influence, and algorithmic manipulation, with a majority-American board.
TikTok's privacy policy states that collected information is shared with service providers and business partners for business purposes including research, technology services, and advertising and marketing services.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — Yes.
In 2019, the FTC and U.S. Department of Justice settled allegations that Musical.ly, now known as TikTok, violated the Children's Online Privacy Protection Act (COPPA) by collecting children's personal information without parental consent; the company agreed to pay $5.7 million, described by the FTC as the largest civil penalty it had obtained in a children's privacy case at that time.
On 4 April 2023, the UK Information Commissioner's Office fined TikTok Information Technologies UK Limited and TikTok Inc £12.7 million for breaches of UK data protection law, including failing to use children's personal data lawfully.
A 2023 analysis by cybersecurity firm Feroot Security found TikTok tracking pixels present on roughly 30 U.S. state government websites across 27 states, among the third-party trackers identified in a scan of over 3,500 organizational and government sites.
Cookies placed via the TikTok Pixel, a tracking tool TikTok offers to businesses for measuring ad performance, remain active for 13 months from when they are first placed or most recently used.