TikTok Quietly Updated Its Privacy Policy to Collect Users’ Biometric Data

Popular short-form video-sharing service TikTok quietly revised
its privacy policy in the U.S., allowing it to automatically
collect biometric information such as faceprints and voiceprints
from the content its users post on the platform.

The policy change, first spotted by TechCrunch^[1], went into effect on
June 2. TikTok users who reside in the European Economic Area
(EEA), the U.K., Switzerland, and other geographies (excluding
India) where the service operates are exempted from the
changes.

“We may collect biometric identifiers and biometric information
as defined under U.S. laws, such as faceprints and voiceprints,
from your User Content. Where required by law, we will seek any
required permissions from you prior to any such collection,” the
ByteDance-owned company said^[2]
in a newly introduced section called “Image and Audio
Information.”

On top of this, the company’s privacy policy also notes that it
may collect information about “the nature of the audio, and the
text of the words spoken in your User Content” so as to “enable
special video effects, for content moderation, for demographic
classification, for content and ad recommendations, and for other
non-personally-identifying operations.”

Besides not clearly defining the exact nature of biometrics
being collected or offering a convincing reason as to why this data
gathering is necessary in the first place, the vaguely worded
language could allow TikTok to amass such sensitive data without
users’ explicit consent.

Given that only a handful of states in the U.S. — California,
Illinois, New York, Texas, and Washington — have laws restricting
companies from collecting such data, the move could mean that
TikTok doesn’t have to ask permission from its users in other
states, as noted by TechCrunch. In other words, users are agreeing
to have their biometric data collected simply by agreeing to its
terms of service.

The revisions to its privacy policy come months after TikTok agreed to pay $92 million^[3] to settle a class-action
lawsuit that alleged the app violated the Illinois’ Biometric
Information Privacy Act (BIPA) by clandestinely capturing biometric
and personal data from users in the U.S. to targets ads without
meeting the informed consent requirements of the state law.

As part of the settlement, TikTok complied to avoid collecting
or storing biometric information, biometric identifiers,
geolocation, or GPS data unless expressly disclosed in its privacy
policy. Viewed in this light, it’s possible that the changes are a
result of this agreement.