TikTok updated its privacy policy to collect biometric data including ‘faceprints and voiceprints’ of 66 million U.S. users

Four months ago, TikTok was caught harvesting and selling personal data of minor children without parents’ permission. The ByteDance-owned company later agreed to pay $92 million to settle the class-action lawsuits.

The settlement, which lawyers in the case have called among the largest privacy-related payouts in history, applies to 89 million TikTok users in the U.S. whose personal data was allegedly tracked and sold to advertisers in violation of state and federal law.

Now TikTok is at it again. But this time, the Chinese popular video-sharing app has secretly updated its privacy policy to collect biometric data including ‘faceprints and voiceprints’ of 66 million U.S. users. The change, which was first spotted by TechCrunch, will allow the Chinese company to automatically “collect biometric identifiers and biometric information” including ‘faceprints and voiceprints’ from all its U.S. users.

The revised TikTok’s U.S. privacy policy introduces a new section called “Image and Audio Information” that says the social video app “may collect biometric identifiers and biometric information” from its users’ content.

The section reads:

“We may collect information about the images and audio that are a part of your User Content, such as identifying the objects and scenery that appear, the existence and location within an image of face and body features and attributes, the nature of the audio, and the text of the words spoken in your User Content. We may collect this information to enable special video effects, for content moderation, for demographic classification, for content and ad recommendations, and for other non-personally-identifying operations. We may collect biometric identifiers and biometric information as defined under US laws, such as faceprints and voiceprints, from your User Content. Where required by law, we will seek any required permissions from you prior to any such collection.”

In addition to collecting users’ biometric information, TikTok also collects “your approximate location, including location information based on your SIM card and/or IP address. With your permission, we may also collect precise location data (such as GPS).”

Below are excerpts from the TikTok PrivacyPolicy page.

Privacy Policy

(If you are a user having your usual residence in the US)

Last updated: June 2, 2021. We have updated our Privacy Policy. Among other clarifying changes, we have added more details about the information we collect and how it’s used, including clarifications related to, for example, collection of user content information, use of data for verification, ad related choices, data sharing with third party services, and data storage/processing practices.

Welcome to TikTok (the “Platform”). The Platform is provided and controlled by TikTok Inc. (“TikTok”, “we” or “us”). We are committed to protecting and respecting your privacy. This Privacy Policy covers the experience we provide for users age 13 and over on our Platform. For information about our under-13 experience (“Children’s Platform”) and our practices in the United States regarding children’s privacy, please refer to our Privacy Policy for Younger Users.

Capitalized terms that are not defined in this policy have the meaning given to them in the Terms of Service.

What information do we collect?

We collect information when you create an account or use the Platform. We also collect information you share with us from third-party social network providers, and technical and behavioral information about your use of the Platform. We also collect information contained in the messages you send through our Platform and, if you grant us access, information from your phone book on your mobile device. More information about the categories and sources of information is provided below.

Information you choose to provide

For certain activities, such as when you register, upload content to the Platform, or contact us directly, you may provide some or all of the following information:

• Registration information, such as age, username and password, language, and email or phone number
• Profile information, such as name, social media account information, and profile image
• User-generated content, including comments, photographs, livestreams, audio recordings, videos, and virtual item videos that you choose to create with or upload to the Platform (“User Content”). We collect User Content through pre-loading at the time of creation, import, or upload, regardless of whether you choose to save or upload that User Content, in order to recommend audio options and provide other personalized recommendations. If you apply an effect to your User Content, we may collect a version of your User Content that does not include the effect.
• Content, including text, images, and video, found in your device’s clipboard, with your permission. For example, if you choose to initiate content sharing with a third-party platform, or choose to paste content from the clipboard into the TikTok App, we access this information stored in your clipboard in order to fulfill your request.
• Payment information, including payment card numbers or other third-party payment information (such as PayPal) where required for the purpose of payment
• Your phone and social network contacts, with your permission. If you choose to find other users through your phone contacts, we will access and collect the names and phone numbers and match that information against existing users of the Platform. If you choose to find other users through your social network contacts, we will collect your public profile information as well as names and profiles of your social network contacts
• Your opt-in choices and communication preferences
• Information to verify an account such as proof of identity or age 
• Information in correspondence you send to us
• Information you share through surveys or your participation in challenges, sweepstakes, or contests such as your gender, age, likeness, and preferences.

Information we obtain from other sources

We may receive the information described in this Privacy Policy from other sources, such as:

Social Media and Login Services. If you choose to link or sign up using  a third-party social network or login service (such as Facebook, Twitter, Instagram, or Google), we may collect information from these services, including your contact lists for these services and information relating to your use of the Platform in relation to these services. If you link your TikTok account to another service, we may receive information about your use of that service.

Third-Party Services. We may collect information about you from third-party services, such as advertising partners, data providers, and analytics providers.

Other Users of the Platform. Sometimes other users of the Platform may provide us information about you, including through customer service inquiries.

Other Sources. We may collect information about you from other publicly available sources.

Information we collect automatically

We automatically collect certain information from you when you use the Platform, including internet or other network activity information such as your IP address, geolocation-related data (as described below), unique device identifiers, browsing and search history (including content you have viewed in the Platform), and Cookies (as defined below).

Usage Information

We collect information regarding your use of the Platform and any other User Content that you generate through or upload to our Platform. 

Device Information

We collect certain information about the device you use to access the Platform, such as your IP address, user agent, mobile carrier, time zone settings, identifiers for advertising purposes, model of your device, the device system, network type, device IDs, your screen resolution and operating system, app and file names and types, keystroke patterns or rhythms,  battery state, audio settings and connected audio devices. Where you log-in from multiple devices, we will be able to use your profile information to identify your activity across devices. We may also associate you with information collected from devices other than those you use to log-in to the Platform. 

Location data

We collect information about your approximate location, including location information based on your SIM card and/or IP address. With your permission, we may also collect precise location data (such as GPS).