KSL Investigates privacy, security concerns with popular social media app

RIVERTON, Utah – It’s quite possibly the unofficial pastime of the pandemic: TikTok, the wildly popular social video app.

It’s been downloaded two billion times. That’s a quarter of the world’s population.

Primarily used by the younger generation, TikTok has a lot of appeal. Short video clips. Lip syncing. Dancing. It’s fun. It’s entertaining.

And as the KSL Investigators found out, it could be a privacy risk to you and your children.

Family Fun

For a lot of families, TikTok has been a lifesaver during this pandemic.

With kids now finishing the school year from home, and basically quarantined from friends and activities, it’s been a way to connect.

“I never really let them do it or anything until quarantine happened,” said Lindsay Thompson, a mother of three girls stuck at home in Riverton.

Posting videos on TikTok has become part of the daily COVID-crisis routine for the Thompson girls, Zoie, 12, Bonnie, 9, and Izzy, 3.

“I just kind of said OK, if you want this, there’s a few rules I need you to follow for me,” Thompson said.  “If there’s someone you want to follow, mom has to see what they post first, even if it’s a friend.”

In addition to making sure the content they see and post is mom-approved, the girls’ account is also private, only sharing the videos with close friends and family.

And so far, for the Thompsons, it’s been a great distraction. The girls love it.

“It’s fun to learn dances,” said Zoie. “You can text them and you can send videos to each other.”

And if you ask their pandemic mom, TikTok has offered a few moments of sanity.

“Mom needs a break,” joked Lindsay, “How about you go do a TikTok?”

The Concern

But here’s the concern: Along with the 15-second video clips, users are also sharing personal information with the Chinese company that created the app.

“That’s just a risk we have in anything we do online,” said Lindsay.

While the Thompson girls and millions of others don’t seem overly concerned, cybersecurity expert Earl Foote, founder and CEO of Nexus IT Consultants, said they should be concerned.

“Chinese-based applications are notorious for their lack of security,” said Foote. “They’re notorious for stealing data.”

Foote said there is no evidence TikTok is currently stealing or selling your data, but he pointed to their history of questionable activity.

Just last year, TikTok paid out $5.7 million to the Federal Trade Commission, to settle allegations of illegally collecting personal information from children under the age of 13.

They’ve been hit with a class-action lawsuit by a student in California, claiming the app grabbed her information without consent.

And U.S. lawmakers have accused TikTok of being a threat to national security, with the Department of Defense warning people months ago not to use it.

“The more data they have about you, the easier it is for them to compromise your identity,” said Foote. “They can use the information to extort you, your family and steal from you.”

Collecting Your Data

Like most apps, when you download TikTok you are agreeing to let them collect a lot of stuff.

Like, a lot of stuff.

Just check out the fine print in their terms of service agreement.

You’re also agreeing to let them share that information with third-party vendors, business partners, business transfers and corporate groups.

Your information can also be used for legal purposes and shared with advertisers.

Translation: They can sell your personal information.

Foote said TikTok officially makes revenue through in-app purchases and ads.

There was no direct evidence showing TikTok sells the data to other companies, Chinese companies or the Chinese government.

Even so, Foote said that is the norm with all of these social media platforms and tech giants, both Chinese and U.S. based alike.

Where Does The Information Go?

And unlike U.S. based social media platforms like Facebook, Instagram, LinkedIn and Snapchat, TikTok is not encrypted.

“The data transmission is not encrypted in any way, so it’s very easily hacked or hijacked,” said Foote.

And because TikTok is based out of China, U.S. lawmakers like Sen. Tom Cotton, R-Arkansas and Sen. Chuck Schumer, D-N.Y., have called the company a “potential counterintelligence threat we cannot ignore.”

So, with very real privacy concerns out there, the KSL Investigators reached out to TikTok last week.

We’re still waiting to hear back, but on the “privacy page” of their app, it reads, “We are committed to protecting and respecting your privacy.”

The chief information security officer adding TikTok will, “continue to advance the protection and privacy of your data” as they prepare to open a Transparency Center in California “allowing experts to examine and verify TikTok’s practices.”

On paper, it sounds like the company’s taken multiple steps in the right direction.

Foote said he still isn’t sold.

“Personally, I’m choosing not to engage with it,” he said.

As for the Thompson girls, well, they’re taking the same approach as millions of others.

Doing a little dance.

Recording a little TikTok.

Post and like all night.

“Yes, it is frightening that they could sell information about my child,” said Lindsay.

But for now, she will let her girls keep using the app, with supervision.

Tips For Parents

If your children use the app, here are some best practices recommended by cybersecurity expert Earl Foote:

• Change the setting to private. The default is public when you create an account. That way only friends and family you accept can view your content.
• The family pairing feature built into TikTok gives you some parental controls.
• TikTok now has a feature where you can set age-appropriate levels for the types of content your children view.
• Monitor your kid’s account by logging in, and make sure you have their password so you can check.
• Teach your kids about sharing and watching appropriate material and have frequent conversations about the risks and dangers of having a public account.

If you want to get off the TikTok platform, make sure you close the account, don’t just delete the app. Here are instructions on how to do that.