What could China actually do with our TikTok data?

We're leaving our digital fingerprints everywhere but don't seem to care.

We're leaving our digital fingerprints everywhere but don't seem to care.

The 7 million Australians who have TikTok should be concerned about the secretive Chinese company having access to their data, experts say.

With our data from TikTok alone, the Chinese Communist Party, which has "an insatiable appetite for personal information of Australian citizens," could manipulate public opinion or map out the Australian sentiment on a given topic, Director of Cyber Intelligence at CyberCX Katherine Mansted said.

It comes as TikTok's chief executive confirmed last week that employees in mainland China could access US user data (under strict conditions) in a letter to Republican senators - a first for the opaque company.

Those nine senators had put questions to Beijing-based company ByteDance, TikTok's parent company, after Buzzfeed News got its hands on leaked audio from 80 internal TikTok meetings, revealing employees had accessed the nonpublic data as late as January 2022.

This led Australian Liberal Senator James Paterson to write to TikTok Australia demanding that "Australian TikTok users deserve to know whether their private information is equally exposed".

I’ve written to @tiktokaustralia following revelations in the US that user data is accessible in mainland China, putting it within reach of the Chinese government. Australian TikTok users deserve to know whether their private information is equally exposed pic.twitter.com/6Wn4fEZGXF

— James Paterson (@SenPaterson) July 3, 2022

Access to individual user data may not be our biggest concern. Rather it's access to "social mapping information at scale", National Security expert Mansted said.

This is all while "TikTok policies and the technological possibilities are really quite murky, so we don't know the situation yet for the 7 million Australian TikTok users".

What kind of data does TikTok have access to?

Social media companies like TikTok could collect everything from your basic personal information (name, DOB, mobile number or email), through to your spending habits, through your your political preferences, perhaps through to even just the kind of audiovisual cues that make you more likely to be persuaded or influenced by something, experts say.

"You're sharing more data in one TikTok interaction potentially then you've been able to share with anyone outside of an intimate partner in human history. Like, that's really profound," Mansted said.

TikTok's algorithm is fed huge amounts of information, which could be used to understand the habits of a particular group, say Australians or a subset of Australians. This, like with Facebook and other advertising platforms, is used to serve us personalised content and advertisements, which isn't necessarily a bad thing on its own.

A man walks past a restaurant with a TikTok logo displayed in the window in Beijing. Picture: GREG BAKER / AFP

But what could China actually do with our data?

Mansted said the CCP "has an insatiable appetite for personal information of Australian citizens".

"We know the Chinese government is behind a lot of hacks against Australian organisations in the public and the private sector. And a lot of the time they're after personal information. And that could be for espionage purposes, it could be again to crack down on dissidents, and to violate, frankly, their human rights or it could be to support influence and manipulation campaigns that the Chinese Communist Party undertakes in order to advance China's interests," Mansted said.

China could also use social media data to potentially "influence" people.

"If you've got an authoritarian country, with the ability potentially to access that data, or even in TikTok's case - and again, this is where we don't know because of the secrecy - but potentially influence the algorithms that choose how and on which terms information is shared. That's an incredibly powerful tool and an incredibly dangerous one if misused," Mansted said.

She added modern warfare always has an information component.

Should we be worried about China having our data?

Mansted said "absolutely".

"With access to that social mapping information at scale ... comes the ability to manipulate public opinion, to censor, to influence, potentially at scale on TikTok or elsewhere ... And that's one of the reasons why governments like the Chinese Communist Party have this appetite for personal information because they want to take the temperature of a population," she said.

"The chief concern for me would be the fact that social media companies - be that TikTok or Facebook - seem to act with habitual secrecy."

ANU Associate Professor of Computing Alex Potanin agreed that China could potentially use data in "nefarious" ways such as manipulating public opinion, telling The Oz you should probably be most concerned if you're planning on travelling to China.

"With TikTok, obviously anytime that you will record a video and you identify yourself in any way, that's it, you've connected your mobile number, your full name, your date of birth, with their idea of how you look like you," Dr Potanin said.

This means if you visit China and were legally recorded by their well-developed and speedy facial recognition system, then they could link your image to your TikTok data, based on facial data from TikTok.

How is TikTok different to other social media platforms?

TikTok probably doesn't collect hugely different data to say Facebook or Snapchat, Dr Potanin said.

The main difference is that TikTok is owned by a Chinese company, and even though the company claims it stores Australia's user data in Singapore (and US data in the US), they are not very transparent about who can access it.

ByteDance last week said employees could access US TikTok data only if they were "subject to a series of robust cybersecurity controls and authorisation approval protocols overseen by our US-based security team" but Dr Potanin said it's not clear who is making these access decisions, which all appear to be centralised in TikTok HQ in China.

"So you have to still trust them, and that the headquarters in China will somehow not be penetrable by somebody (in government) who will maybe put some sort of pressure (on employees)," he said.

This may be complicated by the fact that Chinese Communist Party (CCP) has a 1% stake in ByteDance.

Also, we don't have confidence about where our data is being held and how it's being used, due to transparency issues, Mansted said.

Data stored in mainland China and held by Chinese companies can, by law, be accessed by the Chinese government for national security purposes.