The federal government and 25 states have now banned the video sharing app TikTok from government devices. One of the main concerns is that the Chinese government could get ahold of the personal data of Americans.

Kentucky, North Carolina and Wisconsin are the latest state governments to make the move. The executive order from Democratic North Carolina Governor Roy Cooper included the app WeChat in the ban. 

“TikTok and WeChat’s software and data collection policies combined with Chinese national security law create a significant risk that the Chinese government will obtain information … or enable malicious activity that threatens North Carolina’s cybersecurity,” it said.

In September, TikTok’s chief operating officer Vanessa Pappas spoke to a U.S. Senate Committee on Homeland Security and Governmental Affairs. She said that with more than one billion users, the company is minimizing data access across regions, so that employees in China would have minimal access to user data from the U.S.

So yes, Chinese employees can get access to user data. But Pappas told the Committee that the Chinese Communist Party has never asked TikTok for user data.

“We have not been asked for US user data by the Chinese government. We have not provided such data to the Chinese government, nor would we if asked,” she said.

But in November, director of the Federal Bureau of Investigations Chris Wray had some words of warning during a November House Homeland Security Committee meeting.

“We do have national security concerns, at least from the FBI’s end, about TikTok. They include the possibility that the Chinese government could use it to control data collection on millions of users ... or to control software on millions of devices,” he said.

Using what he called “shorthand,” Wray said that under Chinese law, Chinese companies are required to do whatever the government wants. He had concerns over ByteDance (which owns TikTok) in terms of sharing information or serving as a tool for the Chinese government.

But in 2019, TikTok posted on its website that none of its data centers are located in China and so none of its data is subject to Chinese law. “We are not influenced by any foreign government, including the Chinese government.”

Who to believe?

Either way, TikTok (like most social media apps) is collecting information about its users. On its website, Johns Hopkins University cybersecurity expert Anton Dahbura explained how TikTok could use the data. 

“For instance, basic information such as the locations of users of the app can be used by foreign actors to determine whether someone works in a facility that may be of interest, such as a military or other government facility,” he said.

He also mentioned that tech, educational institutions and manufacturing facilities could also be of interest. Dahbura noted that the Chinese government can quickly sort through millions of records to find people of interest to them. So, they may not necessarily just be looking at the people who work at key facilities, but also those people’s friends and neighbors.

“Many people don’t realize that they … are likely to have something that the Chinese government wants and that can compromise or damage the United States,” he cautioned.

Regarding the claim such as the one from Wray about the Chinese government taking control of Americans’ devices, Dahbura said it’s a possibility, but not the main concern.

“In the case of the Chinese government, their primary motive is the acquisition of information,” he said.

TikTok says in its own privacy policy that it collects names, ages, usernames, passwords, emails, phone numbers, social media account information and profile images. It also collects all comments, photos, audio and video recordings and anything else users upload to the platform as well as when, where and by whom the content was created. It collects all messages sent through the app’s chat and all content on the device’s clipboard.

So if a user copies something to paste it somewhere else, TikTok has access to that copied content. It collects credit card numbers used for payment, including billing and shipping addresses.

There are a few ways to stop TikTok from gathering some data, although no way to block all information gathering.

First, do not allow the app to have access to contacts or location; neither are required and users must give permission to share that data. Set the TikTok account to private and turn off “Suggest Your Account to Others” in privacy settings. And finally, sign up for the app with the username/phone/email option instead of linking it with another account such as Google, Apple or Facebook.

But to be completely safe from sharing a lot of personal information with TikTok, the only option is to delete the app altogether.