Is TikTok Suddenly the Most Transparent App?
Is Admission of Invasive Surveillance a Matter of Ethics, or Something Else?
TikTok’s new overlords have been very open about turning the app into a spyware tool that overcollects information to drive AI predictive models and feed data brokers. But that kind of transparency isn’t virtue, and it certainly doesn’t translate into trust, and the current exodus seems to indicate that people aren’t exactly down with that.
Detailed Identification and Profiling
The company can’t be bothered to hide its practices, so let’s have a quick look at just three of the key changes from the new Terms of Service and Privacy Policy:
Partners share “mobile identifiers… hashed email addresses and phone numbers, and cookie identifiers” used to “match… actions outside… with your TikTok account.”
We call that off-platform matching. In other words, TikTok doesn’t need to guess who your kid is across the Web. It can simply match them by virtue of what they do elsewhere on the Internet, or even when using the same device.
For example, when a child watches videos about anxiety on TikTok and reads about anxiety elsewhere, TikTok can connect those dots into a stronger profile. Those profiles are then fed into a machine learning algorithm for scoring and monetizing purposes.
Precise Location and Tracking
TikTok’s policy language is is clear about the fact that it will use the phone’s precise location if it’s available. The app will still work if you turn that off, for now, but the clear argument is that we can’t say they didn’t tell us.
What does “Precise location” mean? Simply that the app will use the best location your device can compute, which can blend GPS + Wi-Fi networks + cell towers + Bluetooth to figure out where we are in the room, and likely what position we’re even holding the phone. That last part is thanks to sensors that use gyroscopes to figure out every detail of the device’s orientation. If they’re left on by default on a kid’s phone, why shouldn’t TikTok make use of it, right?
What does that mean for kids? Simply that they know where they are in their room, what routes they take to school and where they are at any given moment. Routine stops at friends’ houses, clinics and shelters is shared with a new ecosystem of data brokers for fun and profit, but that could just as easily be for mischief and stalking. Even if children don’t show their location in their posts, the device will do that for them, contributing to doxxing and victimization risks.
TikTok also admits it collects “information about interactions with websites when you use our in-app browser.”
That means if someone clicks links inside TikTok and reads them in TikTok’s built-in browser view, that activity can become part of the profile and targeting machinery, adding to the location, identification and hypertargeting signals being collected.
Neat, eh?
AI Training and Predictive Learning
The constant extraction, analysis and inference of uniquely identifiable data about TikTok users means that machine learning is being trained on everyone, all the time. The “Privacy” Policy puts it plainly:
We detect and collect characteristics and features about the videos, images, and audio recordings that are part of your User Content… identifying objects and scenery, and… the existence or location within an image of a face or other body parts <in conjunction with> the text of words spoken.
How do you like them apples?
That’s a lot of indicators of model training without actually uttering the phrase ‘artificial intelligence’. For example: “We infer your attributes (such as age-range and gender) and interests… to show you relevant information, and, where permitted, to serve you personalised ads.”
Being monetized on social media is nothing new, and it can easily be done without AI. So why all the model training?
The reason that matters for kids in particular is the profiling bit. Is this a young person who is likely to cause trouble in the future, repost content about human rights abuses or resist the suffocating effects of totalitarian authority?
And what about the risk of mis-classification? The precision of “age-range” inference can be wrong, but still acted on. Hypersensitizing kids using gravity wells of emotionally stimulating content because they once clicked on a post tagged with ‘anxiety’? That’s a good recipe for the wrong kinds of stimulation. Face/body location within the image? TikTok is clearly using automated analysis of bodies and faces at scale.
What could go wrong? Tiktok has arguably never been a neutral platform, but now it’s a prediction factory pointed at minors.
The Quiet Part Out Loud
Now that the quiet part is being yelled off the rooftops, TikTok doesn’t go so far as to advise users on protecting their privacy, because there isn’t any. So short of deleting the account [Settings > Delete your account] and uninstalling the app, here’s a couple of reminders for what to do next:
- Turn off Precise Location (for TikTok and literally everything else)
- Review ad settings and turn off add tracking (but really, you should just block all ads, everywhere)
- Assume that user content can be copied, remixed, reused and repurposed at scale, so remind students and kids never to post personal information. It won’t be enough, but it will sensitize them in general as well.
- Remember that Bytedance’s ownership wasn’t just about TikTok, but also CapCut, Lemon8, and related apps, so all related tools will be covered by the same invasive Terms of Service and (lack of) Privacy Policies.
Where can concerned teachers and school boards find more information?
- Canada’s Cybersafety Foundation: Look for Resources on mobile app use, kids’ privacy and don’t hesitate to reach out to request an AMA or event for your staff, students or administrators.[www.Knowledgeflow.org]
- Edtech Privacy Resources: a solution offered by Managed Privacy Canada (MPC), www.EdtechPrivacy.ca is a good starting point for learning about the importance of privacy assessments in public education and higher learning institutions. Reach out and ask questions.
- Edtech Cybersecurity: Should schools be outright banning surveillance tools, invasive apps and data broker technology? School boards and education professionals can the experts from Datarisk Canada: www.EdtechSecurity.ca.
