This past October, the Committee on Foreign Investment in the United States (“CFIUS”) opened a national security review of TikTok and its Chinese parent company, ByteDance, over concerns about potential misuse of users' personal data. This investigation comes after petitions made by three Senators asking CFIUS to “conduct an assessment of the national security risks posed by TikTok and to brief Congress on these findings."
In 2017, ByteDance bought the U.S. app Musical.ly and merged it into its preexisting TikTok service. It has since been operating with great success in the U.S., with more than 122 million downloads in the country. At the time of the merger, neither of the involved companies asked for clearance from CFIUS, the interagency committee authorized to review some transactions involving foreign investment in order to determine the effect of the transactions on national security.
The senators’ worry is that, given its outsize presence in the U.S. market, TikTok’s collection of users’ personal information poses a threat to national security. Their concern is amplified by allegations that TikTok censors and removes content that is unfavorable to China., This, argue the senators, is evidence that TikTok collaborates with the Chinese government, and that there is thus a risk that users’ sensitive data could be shared with Beijing. TikTok disputes the allegations of censorship, stating: “We store all TikTok US user data in the United States, with backup redundancy in Singapore...and none of our data is subject to Chinese law...We are not influenced by any foreign government, including the Chinese government.”
TikTok collects: (i) information provided by users (age, email, name, image uploads, payment information, etc.); (ii) information obtained from other sources (social networks and other publicly available sources); and (iii) information collected automatically (IP address, location, browsing history, cookies, metadata, etc.). According to TikTok’s privacy policy, the data can be shared for legal purposes like responding to subpoenas, court orders, law enforcement requests or government inquiries). CFIUS is analyzing whether this creates a risk that sensitive user data will be gathered by the Chinese government, and whether that risk is big enough to take action against the company.
If CFIUS concludes that ByteDance’s ownership of TikTok poses national security risks, it could order mitigation measures directed to securing the personal data and precluding censorship or it could order ByteDance to sell TikTok.
The investigation comes at a time when the U.S. government has been engaged in a trade war with China: President Trump has imposed more than $360 billions worth in tariffs, and companies such as Huawei have been barred from investing in the U.S. Hence, this is not the first time CFIUS has taken action to block Chinese entities which allegedly could have provided sensitive user information to the Chinese government: in the last two years, CFIUS has blocked Chinese company Ant Financial’s purchase of MoneyGram, and has reversed Beijing Kunlun Tech Co.’s purchase of Grindr.
Some commentators are skeptical of the value of the investigation. Jonathan Hillman, argues that rushing to push Chinese companies out of American markets creates a risk “not merely that the United States becomes less competitive, but that it also becomes less American.” CFIUS’ expanding jurisdiction is already chilling foreign investment in Silicon Valley. Jennifer Daskal and Samm Sacks argue that the U.S. should instead work on “legislation and the development of standards to better protect privacy, secure data, and manage online content.” However, others, such as Robert Williams, are more optimistic. Williams argues that relatively tailored investigations into individual companies, in combination with broader policy changes, can address threats without playing into general paranoia about Chinese tech investment.
CFIUS’s investigation has only just begun, but if it decides to take action against ByteDance, TikTok’s time might be up.