TikTok users across the United States are sounding the alarm after receiving an in-app notification regarding the platform’s updated privacy policy. The surge in concern, fueled by viral social media discussions, centers on language detailing the collection of “sensitive information,” including sexual orientation, transgender or nonbinary status, and citizenship or immigration status.
Understanding the Legal Context
Despite the widespread panic, this disclosure is not a new development, nor is it a sign of illicit surveillance. The specific terminology originates from state-level compliance requirements, most notably the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). These laws mandate that companies explicitly inform users when they process “sensitive information.”
The policy language specifically lists categories that are legally classified as sensitive, such as:
- Social Security, passport, or driver’s license numbers.
- Precise geolocation data.
- Racial, ethnic, religious, or philosophical beliefs.
- Citizenship and immigration status.
- Biometric, genetic, or neural data.
- Contents of private communications (email, text).
Notably, the inclusion of “citizenship and immigration status” became a legal requirement under California law following the enactment of AB-947 on October 8, 2023.
Why the Current Climate Amplifies Fear
The timing of this notification—coinciding with a change in TikTok’s U.S. ownership—has prompted many users to read the terms for the first time. This heightened scrutiny occurs against a volatile political backdrop. The U.S. has seen an escalation in immigration enforcement, exemplified by recent economic blackouts in Minnesota where businesses closed in protest of Immigration and Customs Enforcement (ICE) operations, following a series of high-profile arrests and the death of American citizen Renée Good.
Expert Analysis: Privacy vs. Transparency
Legal experts clarify that the policy does not imply TikTok is actively tracking these specific traits for malicious purposes. Instead, it acknowledges that if a user voluntarily shares such information within their content, the platform processes it as data.
“Policies like this often look alarming because they’re written for regulators and litigators, not for ordinary consumers,” says Ashlee Difuntorum, a business litigator. “TikTok is essentially stating that if you disclose something sensitive, that information becomes part of the content the platform collects.”
Philip Yannella, co-chair of Blank Rome’s Privacy, Security, and Data Protection Practice, suggests that the granular detail is a defensive move against litigation. “Lately, I have seen several demands under the California Invasion of Privacy Act from plaintiffs’ lawyers alleging the collection of racial, immigration, and ethnic data,” he notes.
A Broader Industry Standard
TikTok is not an outlier. Other major platforms, including Meta, maintain similarly granular disclosures to satisfy regulatory demands. While some companies utilize higher-level summaries, others choose to list precise categories to maintain legal clarity.
The irony of the current situation is not lost on observers. The push to move TikTok’s U.S. operations under new ownership was originally driven by fears regarding Chinese data laws, such as the 2017 National Intelligence Law. Now, the discourse has shifted, with U.S. users expressing profound anxiety about potential surveillance by their own government.
