TikTok, Data, and National Security: Why Governments Are Nervous and Getting More So

When you launch the app, it learns something about you in about 30 seconds. Quietly, algorithmically, with the soft precision of a system that has been optimized to hold your attention longer than you intended to give it—not in a dramatic, Hollywood-surveillance manner. The feed on TikTok picks things up quickly. quicker than any previous platform. And one of the more genuinely complex technological debates of the last few years revolves around that speed, that uncanny accuracy about what you want to watch next. The app’s data collection isn’t the only issue. In the end, it’s who can access that information and under what conditions.

By now, the fundamental outline has been established. Beijing-based ByteDance is the owner of TikTok. Organizations operating under its jurisdiction are required by China’s National Intelligence Law to assist state intelligence efforts upon request. Western governments have concluded that this legal framework presents a structural issue rather than a theoretical one. Regardless of what TikTok’s American executives say in congressional testimony, there is a legal way for the Chinese government to demand access to information that ByteDance possesses. The anxiety resides in the space between legal reality and corporate assurance.

It is worthwhile to consider the data that the app gathers. location information, browsing history, keystroke patterns, biometric identifiers (such as voice and face prints), and behavioral cues extracted from each user interaction with the feed. Much of this sounds similar to what most apps gather on their own. It creates a more detailed profile of a person’s habits, relationships, movements, and vulnerabilities after being aggregated, processed by advanced AI, and cross-referenced against other data sources. In 2022, Federal Communications Commission commissioner Brendan Carr described TikTok as operating like a surveillance tool in congressional testimony. Although the description was politically charged, it wasn’t technically incorrect. Simply put, the majority of social media apps work similarly. The parent company’s location and legal accountability are what set TikTok apart.

BuzzFeed released a report in June 2022 based on internal TikTok audio that was leaked, in which staff members admitted that Chinese engineers had accessed user data from Americans. The company’s sworn statements from the previous year’s Senate hearing were directly at odds with this. The fallout hastened the creation of what became known as Project Texas, an initiative to move all American user data to Oracle’s cloud infrastructure in the US with the intention of erecting a technical barrier between ByteDance engineers in China and the data of American users. TikTok’s credibility with regulators was severely damaged. Oracle started examining the algorithms used by TikTok. The business promised to use domestic servers to route all U.S. traffic. Depending on how much trust you’re willing to give, this arrangement may or may not actually solve the issue. For many government officials, the answer has been: not much.

In 2024, a law was passed by Congress requiring ByteDance to sell its American TikTok operations or risk being banned. The fact that the law was passed with bipartisan support—a true rarity in modern Washington—indicates that the underlying issue transcends party boundaries even though the rhetoric surrounding it doesn’t always. In January 2025, the law was upheld by the Supreme Court. The process then came to a standstill as the deadline drew near and the legal apparatus was in place. Citing a deal in progress with China, President Trump extended the divestment deadline four times. He posted updates on Truth Social about upcoming summits and cordial phone conversations but provided few structural details. National security experts were largely dissatisfied with the proposed arrangement, in which ByteDance retained 20% and American investors, including Oracle, Silver Lake, and Andreessen Horowitz, held 80%. A smaller ownership percentage does not eliminate the legal obligations that affect officials, and a minority stake is still a stake.

Here, too, there is a thread of sincere disagreement that should be acknowledged. The lack of a comprehensive national data privacy law in the US has been noted by some academics and cybersecurity researchers as the reason for the selective focus on TikTok. Facebook continued to function normally despite the Cambridge Analytica scandal, which involved the improper collection of information from more than 50 million profiles for political targeting during a U.S. election. The data collection methods used by American businesses, frequently with little regulatory oversight, are what raise concerns about TikTok. A targeted ban on high-risk individuals, such as government officials, military personnel, and those with security clearances, would be more proportionate than a general prohibition affecting 170 million users, according to Christopher McKnight Nichols, a national security historian at Ohio State. He has suggested that the lawmaker with a classified briefing on their phone who also has TikTok installed faces a different and significantly lower risk profile than the general public.

However, the issue’s algorithmic component goes beyond simple data. What the platform reveals and what it conceals is a question. In its Chinese domestic version, Douyin, ByteDance has been credibly accused of suppressing content regarding Tibet, Taiwan, and the treatment of Uyghurs. There is concern that control over content moderation may seep into the international version in subtle, gradual ways that would be hard to spot from the outside. One type of power that doesn’t require a single dramatic intervention is the ability to shape what hundreds of millions of people see and don’t see over time. All you need to do is be consistent.

There is a sense that no one has found a solution they genuinely support as this debate continues through several administrations and congressional sessions. The ban continued to be postponed. The agreement continued to be worked out. The deadline kept slipping. In the meantime, 170 million American phones still had the app installed, processing data and executing its algorithm as intended. Depending on how seriously you take the structural risks and how skeptical you are of the motivations behind the concern, that may or may not be an acceptable situation. There is merit to both positions. Neither has come up with a clear response.