Translation Service
What They Say
TikTok describes a platform built for creativity, expression, and community. Their privacy policy explains data collection as necessary to provide personalised content, improve safety, and fight fraud. They emphasise that users are in control of their data and provide tools to request deletion. The policy includes a section on data security that uses the word "robust" twice and "industry-standard" three times, both phrases that the Bureau has flagged as requiring independent verification.
What They Mean
TikTok's algorithm is a surveillance instrument that happens to also show you videos. The platform collects biometric identifiers — faceprints and voiceprints — from your videos, along with everything you type (including things you deleted before sending), your precise GPS coordinates, and the WiFi networks near you. The recommendation algorithm uses this to build a psychological profile so accurate that researchers have documented it identifying depression, anxiety, and political orientation from scroll patterns alone. This data is accessible to ByteDance, TikTok's parent company, which operates under Chinese law.
Worst Clause — Exhibit A
"We may collect biometric identifiers and biometric information as defined under US laws, such as faceprints and voiceprints, from your User Content. Where required by law, we will seek any required permissions from you prior to any such collection."
Bureau Translation:
"Where required by law" is doing all the work in this sentence. In most US states, there is no law requiring them to ask. This clause establishes that TikTok collects your biometric data by default in all jurisdictions that have not specifically passed legislation saying they cannot. The word "may" in the first sentence means "do," with legal optionality retained for jurisdictions where courts are paying attention.
Evidence Tags — Data Collected
Bureau Verdict
"TikTok's privacy policy is the Bureau's Grade F recipient for a reason: it collects biometric data, retains content you never published, and operates under a legal structure that gives its parent company access to the full dataset. The policy is technically compliant with the jurisdictions it operates in, which says less about TikTok and more about how behind those jurisdictions are."
Overall Grade
Dense (Strategic)
Frequently Asked Questions
Dark Patterns Documented
See the full Dark Pattern Encyclopedia for documentation of each technique.
Audited: 2026-03-15