Australians are sharing too much personal information with TikTok’s China-based staff and the only way to avoid that is to “delete the app”, privacy experts say.
The Chinese-owned social media platform made news recently after it admitted its staff in China are able to access Australian users’ private data.
It emerged after the Opposition's cyber security spokesman James Paterson wrote to TikTok, asking if Australian users' data was accessible in mainland China, and if it could refuse a request by the Chinese government to hand over data if one was made.
Brent Thomas, TikTok's director of public policy in Australia, said in his reply that only people who need the data "in order to do their jobs" have access.
He quoted Roland Cloutier, the platform's chief security officer who fronted the 2020 Senate Select Committee on Foreign Interference through Social Media and said: "We would never give Australian user data to the Chinese government."
Mr Thomas added that no such request had ever been made.
A TikTok spokesperson told SBS News in a statement that Australian user data is stored in the United States and Singapore.
"Access to that data is subject to a series of robust controls, safeguards like encryption for certain data, and authorisation approval protocols overseen by our US-based security team," the spokesperson said.
But privacy expert Katherine Mansted, director of cyber intelligence at CyberCX, told SBS News this is “hugely concerning” and “problematic”.
“It’s hugely concerning news and it’s also really problematic that it’s taken us so long to get to the bottom of this,” said Ms Mansted, who is also a senior fellow in the Practice of National Security at the Australian National University's (ANU) National Security College.
“TikTok’s been hiding [facts] and dodging questions and, really, Australians should have clarity about where their data is being held and about who can access it,” she said.
What data can TikTok’s China-based staff access?
TikTok does not share how many Australian users it has, but some estimates put the figure around 7.4 million — and that's just those who are over 18.
While that number is not as high as Facebook, which has more than 15 million Australian users, the Digital 2022 Australia report compiled by We Are Social and Hootsuite noted that local users "scroll through the app for 23.4 hours per month".
That's higher than the time Australians spend on Facebook (17.6 hours per month).
Vanessa Teague is a data encryption expert at the ANU.
She said that’s a lot of time Australians are spending on TikTok and expressed shock at the extent of personal information they could be sharing unknowingly with the social media platform.
Delete the app ... TikTok is less transparent ... than Facebook [and] tends to come under less scrutiny [as it’s] based in a less democratic country.Vanessa Teague, data encryption expert at the ANU
“Permission to access approximate location; personal information like name, email address, user IDs and addresses; financial information like payment information; messages, photos and videos; audio and sound recordings; [and] web browsing [history is the sort of data you could be sharing with TikTok],” she said.
“Even before you upload any explicit information, [TikTok] is gathering a whole lot of stuff about you and your files and your friends."
She said even when users block permissions they may be “giving away more than they think they are”.
“For example, you might think you’ve removed location permission from the app, but if you’ve uploaded videos that are tagged with the GPS location of where the video is taken, you’re conveying that information to the system,” she said.
Can the data be misused?
The TikTok spokesperson said there are many Australian companies that collect data in a similar way to TikTok and also share locals' user data with employees and third parties across the world, including those in China.
“The data collected by TikTok, an entertainment platform, is not as detailed or intrusive compared to the data collected by other Australian organisations, some of which gather comprehensive financial records, legal information, and much more.”
Fan Yang, a researcher and PhD student at Deakin University, was part of a team that reviewed more than 3,000 political advertisements and articles on Chinese social messaging app WeChat in the lead-up to the Australian federal election this year.
Conducted over several months, the research examined posts from more than 130 public accounts and established articles and advertisements on platforms such as WeChat can be used by political parties and the ruling government to influence the minds of voters.
Ms Yang said TikTok is not the only social media platform Australians share data with to this extent.
“It’s nothing new … Facebook, Google, Twitter, YouTube and Instagram – they’re [all] doing the same thing,” she said.
But Ms Mansted said the chances of TikTok misusing user data are far higher than a US-based social media platform.
“The reality is the Chinese government has a really different approach to procedural fairness, rule of law and human rights than democratic countries,” she said.
“The Chinese government – by law – can access any data for national security purposes [and] they have a really broad definition of what is the national security purpose.
“So anything the Chinese Communist Party deems to be of relevance and interest to it, it might be able to access and it potentially will access.”
Are Chinese-Australians at a higher risk of data exploitation?
Ms Mansted said at a macro level the Chinese government could use the data for espionage.
“[They] can use it for influence and propaganda,” she said.
“But at a micro level, [they] can target individuals for a range of reasons.
“Individuals that have fallen foul, potentially, of the Chinese Communist Party’s (CCP) favour.
“Individuals who are perceived to be dissidents or perceived of having views contrary to the CCP.”
Ms Mansted said even when people of the Chinese diaspora are Australian citizens and members of Australia’s democracy, the Chinese government views them “as something that’s in scope for them to have an interest in”.
The Chinese embassy in Australia has been contacted for comment by SBS News.
Data exploitation risk
Dr Teague said even if foreign governments don’t exploit the data, third-party platforms can.
She pointed to the Facebook-Cambridge Analytica data scandal, in which the personal information of millions of Facebook users was used without their permission in the 2010s for political advertising.
“We certainly have some very clear evidence that third parties have abused Facebook’s infrastructure for the purposes of political manipulation,” she said.
“It would be extremely naive to think that the Chinese apps that have effectively the same infrastructure built in could not be used for equivalent kinds of political manipulations."
So what’s the advice?
“Delete the app,” Dr Teague said.
“TikTok is less transparent ... than Facebook [and] tends to come under less scrutiny [as it’s] based in a less democratic country."
Ms Mansted warned Australians against being “passive users” of TikTok.
“If you don’t want to share all that information, delete the app … don’t just be a passive user,” she said.
“You’ve got to think about the risk to yourself and to your social network and your future self … [because] data hangs around for a long time.
“There might be new concerns or new risks or new threats that emerge in time and, once [your personal information is out], it has a long shelf life.”
Clarification: This article has been updated to include mention of Fan Yang's research and that the Chinese embassy has been contacted for comment.
