TikTok owner ByteDance’s data practices under fire, raising concerns among advertisers

The review, completed late last year by ByteDance’s audit and risk control team, was based on some 90 interviews with ByteDance and TikTok employees across various divisions. A report summarizing the audit’s findings suggests that the tech company has an institutional issue with embezzlement.

“Unless ByteDance makes substantial, sustained and rapid investments in its anti-fraud programs, it will likely be too late to prevent immense future fraud-related losses and liabilities – potentially including multi-billion dollar fines, being forced to submit to the control of an external monitor, loss of the ability to operate in the US and other major markets, and criminal indictments of ByteDance executives and managers (even if they did not actively participate in misconduct),” read one part of the executive summary, which was reviewed by Forbes.

The assessment also uncovered systemic issues with data management. The report said that one employee familiar with ByteDance’s data practices alleges that for the tech company, it’s “impossible” to keep “sensitive” data from being stored “improperly” on Chinese servers.

Auditors also wrote that issues of data validation and governance are rampant, saying that “it is frequently difficult or impossible to verify the correctness of information the company reports to government agencies.”

The news comes just two weeks after the FBI warned that TikTok could pose national security threats to the US. The agency’s director, Christopher Wray, said on November 15 that the FBI harbors “a number of concerns” about the app after Republican policymakers proposed a bill that would ban TikTok nationwide.

Concerns, Wray specified, “include the possibility that the Chinese government could use it to control data collection on millions of users or control the recommendation algorithm, which could be used for influence operations if they so chose, or to control software on millions of devices, which gives it an opportunity to potentially technically compromise personal devices.”

The political power of gen Z’s TikTok obsession

If ByteDance is indeed handling user data inappropriately, users face the risk of seeing their security compromised. However, experts are skeptical that users will stop using the app, which hit 1 billion monthly active users in September 2021.

TikTok’s most engaged users are young people – by the end of last year, kids and teenagers were spending an average of 91 minutes per day on TikTok, according to recent data from Qustodio.

As such, many experts believe it will be difficult to staunch TikTok’s growth among young people in particular – even in light of damning revelations concerning the company’s use of consumer data. “I don’t think the company needs to worry about losing the trust of its user – it seems really popular with its current demographic, and a campaign from outside groups urging users to delete it is more likely than not to draw more attention to it and lead to more downloads than deletions,” says Andrew Graham, founder and head of strategy at Bread & Law, a public relations agency in New York City.

But TikTok’s popularity among young consumers creates new political considerations beyond the argument of national security. While Republican lawmakers push for new restrictions on the app, Graham doubts Democrats will sign on to such a project – in large part due to the sway that TikTok could have in furthering the party’s interests.

“Gen Z just turned out in droves for the midterms, and I imagine that the Biden administration sees a pretty significant political risk in anything that limits US users’ access to TikTok,” says Graham. “I imagine they want to get some kind of deal done that avoids that scenario, while also guarding against the very genuine threat that TikTok becomes a platform to spread targeted election-related disinformation and propaganda ahead of the 2024 presidential election.”

It’s a complicated balancing act, and one that may not have a clear-cut answer right now, says Graham.

The call for new data privacy legislation grows

Other experts believe that the fuss around ByteDance’s data practices only serves as a distraction from the larger issue of regulating consumer data collection, storage, use and sale in the US.

“While the audit findings are certainly concerning, it is important that hyperfocus on ByteDance does not become a convenient alternative to addressing the more central issue – the need for congress to enact federal privacy law and to regulate big tech to address broader national security risks related to data misuse and its susceptibility to exploitation for counterintelligence, by bad actors or for unlawful domestic surveillance,” says Arielle Garcia, chief privacy officer at advertising agency UM Worldwide.

Garcia points to a recent breach as a reason for the need for stricter regulations: reports by Reuters this month found that software operated by a Russian firm parading as a US company was found within the US Army and the US Centers for Disease Control and Prevention, and was used to expose sensitive information.

Progress toward the goal of stricter regulation is being made: the sweeping American Data Privacy and Protection Act, which is awaiting a vote in the house, represents the furthest lawmakers have come in decades to passing a comprehensive consumer data protection framework. Its prospects of being passed, however – especially in light of a new congressional balance post-midterms – remain uncertain.

Advertisers on alert

ByteDance’s improper use of consumer data holds implications not only for users but also for brands advertising on TikTok.

“​​What this means in the short-term for advertisers is pretty straightforward: they should reassess the platform as a viable ad medium and look to reallocate budget elsewhere,” says Graham.

Graham contrasts the threats revealed by TikTok’s internal audit to the troubles facing Twitter currently, much of which concern advertiser caution in light of increasingly lax content moderation policies under Elon Musk’s new leadership. “This isn’t the same situation as with Twitter, where the risks to brands boil down to that platform’s open embrace of disinformation and hate speech. This situation ... involves accusations [that could be tied to] espionage,” he says. But for advertisers, he suggests, the urgency to pause ad spend on TikTok is likely to be lower than the case with Twitter, where brand risks are more immediately obvious.

Still, the issues of fraud and data mishandling at ByteDance remain crucial for advertisers to consider. As Graham puts it: “It’s just a different flavor of controversy for an audience of brand marketers whose job is to avoid controversies of all flavors.”

Other industry leaders agree that TikTok poses a unique risk for brands. “TikTok’s userbase seemingly doesn’t mind trading privacy and data security for an unrivaled personalized experience. But as advertisers, we can only follow an audience so far,” says Daniel Morosi, group director of media and connections at IPG-owned ad agency R/GA. “We are trading more than data – we’re trading dollars. The recent issues of fraud and data mismanagement at ByteDance raise questions about how much you can trust such a media partner.”

TikTok’s ad business – though relatively new – already dwarfs many of its competitors. TikTok is on track to make $11.64bn in advertising sales in 2022 – more than the totals of Twitter and Snapchat combined, according to data from Insider Intelligence’s eMarketer.

The focus on data security and consumer privacy is only growing among advertisers – who, in light of privacy-focused changes at Google and Apple and increasing legal and enforcement action, are being forced to rejig their own practices. The risks of advertising on platforms with data security issues are greater than ever.

“Advertisers need to be vigilant with all platforms, not just TikTok,” says Zack Wenthe, senior technical product marketing manager at customer data platform Treasure Data.

Wenthe suggests that it’s high time for brands to build out their own privacy-safe first-party data practices now to avoid platform-induced headaches. “Advertisers should start considering how to build their own audiences and communities off platforms,” he says, “so they can navigate platform changes a lot easier than brands that solely rely on buying data from walled gardens.”

For more, sign up for The Drum’s daily US newsletter here.