AP warns users: TikTok continues to send personal data to China

The AP calls on users and organizations to carefully consider whether they want to continue using TikTok and other services that transfer personal data to countries outside the EU. The AP recognizes that this international transfer is a broader social issue and is also investigating the risks associated with other online services.

What does the TikTok notification mean?

TikTok has challenged the decision of the European regulators, and the transfer of personal data will continue in the meantime. Users will receive a notification about what TikTok does with their personal data, which states:

• TikTok continues to transfer personal data of European users to countries outside the EU, including China.
• The Irish Data Protection Commissioner (DPC) has previously ruled—in the context of the EDPB—that this transfer violates the General Data Protection Regulation (GDPR).
• The Irish judge has temporarily suspended the measures imposed, but the ruling of the supervisory authorities remains in force.

"It is good that the Irish court is requiring TikTok to better inform users," says AP Vice President Monique Verdier. "TikTok collects and uses a lot of personal data, such as click behavior, location data, contact information, and sometimes financial data. Young people in particular are often insufficiently aware of this data collection and the risks involved. In Europe, there are clear rules that give people control over their data; outside the EU, such as in China, those rules do not apply in the same way. Users often have little control over what happens to their data. We believe that people and organizations should seriously consider whether they want to accept this."

Call to TikTok users

The AP gives the following advice to anyone who uses TikTok:

• Please read TikTok's notification and privacy statement carefully.
• Check your privacy settings: what access does TikTok have to your camera, microphone, contacts, or location?
• Decide whether you want to continue using TikTok under these circumstances. If not, you can (temporarily) delete the app or deactivate your account.
• Be cautious about what you share via the app. Do not share sensitive information.

In addition, the AP provides specific advice to organizations that use TikTok:

• Identify the risks, for example through a data protection impact assessment (DPIA). Take into account that regulators have deemed the transfer by TikTok to be unlawful.
• Determine whether it is responsible to continue using TikTok. (Semi-)public organizations have a role model function in this regard. Governments that use the platform give the impression that this can be done without any problems.
• Will you continue to use TikTok? Be clear and transparent about this with your target groups. Also about the risks it entails for them.