Headlines have said that TikTok is facing a privacy “investigation” in Canada. It faces an enormous uphill battle.
If you live in the US or a number of other countries, the headlines will sound very familiar to you. The headlines suggest that TikTok is under investigation for privacy concerns surrounding it’s handling of people’s personal information. There are questions if TikTok is handing all that information over to the Chinese government. For many of you who live outside of Canada, the reaction might be, “Oh no. Not this sh*t again.” For Canadian’s who don’t pay close attention to international headlines, though, this may seem like a novel news story.
For context, the story made a splash in the media late last week. One example comes from the CBC which says the following:
Canada is launching a joint federal and provincial investigation into short-video app TikTok over concerns about the Chinese-owned platform’s collection, use and disclosure of personal information, the Office of the Privacy Commissioner of Canada said on Thursday.
The joint investigation involves the federal privacy regulator, as well as provincial counterparts in Alberta, British Columbia and Quebec, according to a news release issued Thursday.
The news release says the regulators “will examine whether [TikTok’s] practices are in compliance with Canadian privacy legislation and in particular, whether valid and meaningful consent is being obtained for the collection, use and disclosure of personal information.”
It also says the regulators will be looking at whether TikTok “is meeting its transparency obligations, particularly when collecting personal information from its users.”
The probe will “have a particular focus” on how TikTok’s privacy practices affect younger people using the app, the news release says.
Similarily, a news story on Global News had this to say:
Ottawa is weighing recent moves by allies that banned the controversial social media application TikTok from government devices, but there’s no word yet if a similar ban could happen here.
The Treasury Board Secretariat, the nerve centre of federal government processes and functioning, said in a statement sent to Global News on Friday that it is working with other departments to “ensure government information systems and networks remain secure and protected.”
“The Government of Canada is assessing the situation, including the legislative announcement by our U.S. allies, and recently the European Commission, and will determine next steps as necessary,” a spokesperson for TBS said in a statement.
Global News had asked whether the agency was considering banning the app on government devices.
The CBC also published a separate story which included the following excerpt:
But cybersecurity experts such as Brian Haugli, CEO of the U.S. firm SideChannel, who see danger in the information that TikTok users may be unknowingly sharing, after downloading an app that can “see and store” an individual’s location, the networks they access and any incoming messages.
“When you really kind of dig in to all the permissions that are in there, I don’t think it’s something that most users are either aware of, or willing to really hand over, to a company that’s owned and housed inside of China,” Haugli told CBC’s The National in December.
While such concerns have prompted some TikTok bans on EU and U.S. government devices, it’s not immediately clear whether such a step will be taken here.
Asked whether Canada would follow suit, Treasury Board spokesperson Martin Potvin told The Canadian Press by email that Ottawa “is assessing the situation, including the legislative announcement by our U.S. allies, and recently the European Commission, and will determine next steps as necessary.”
All three stories were published within three days of each other, from February 23rd to February 26th. While the announcement of an investigation was only just made, you are almost under the impression from these stories that it’s widely known that TikTok is doing something wrong and the investigation is only there just to confirm what everyone already knows. A more logical flow would be that the investigation is announced and, a month later, the government would say that they are looking into this, then several months later, the government saying that they are considering banning the app after what they have learned so far (disclosure may not be that necessary at that stage). The three day timeline alone doesn’t really make much sense in and of itself.
Naturally, we started digging into the facts of this to see if the media hype is warranted. What we found really puts into question the validity of people assuming TikTok is plain guilty of any wrongdoing or whether the investigations would even really go anywhere.
The Privacy Commissioners Angle
It always sounds like a big salacious headline whenever Canadian Privacy Commissioners are investigating something. It’s not to say that it is wrong to cover the announcement of the investigations. After all, based on what I’ve seen in the past, those commissioners actually do good work. The problems start to arise when you start asking what would become of such an investigation.
The simple answer is that Canada’s privacy laws are a very sorry joke and have been for years. Whenever any company is busted actually doing something wrong, the best possible outcome is that the commissioners send a strongly worded letter. They have no actual regulatory teeth to, say, levy fines or sanction companies in any way.
Indeed, there is a push to reform Canadian privacy laws so Canada can finally begin to catch up to the rest of the developed world. Unfortunately, even with broad party support, Canada continues to not only lag behind other countries in the developed world, but also is not even out of the starting gate even after all of these years. Coincidentally enough, I did a writeup on the sorry state of the current privacy reform bill (C-27). Long story short, the bill remains largely abandoned and neglected. So, if you are one of those who sees TikTok as pure evil on the privacy front and hoping that massive fines would be slapped on the network, then the real scandal is why Canada is so ill-equipped to carry something like that out.
Put this another way, let’s say TikTok CEO’s have been seen on video footage walking around on The Great Hall of the People in China, handing officials external hard drives clearly labelled “Personal Information of Canadian Teenagers”, then walking out with large bags with a dollar sign printed on the side, what power does the Canadian Privacy Commissioners have? Sending out a strongly worded letter and telling TikTok, “Don’t do that again.” Even if those commissioners were contacting them and TikTok responded by sending a picture of one of their employees butt and text that says “kiss my ***” to every inquiry, then the end result is still a strongly worded letter. That obviously would never actually happen, but if TikTok did that, the repercussions are still strongly worded letters and messages of “don’t do that again.”
The Lack of Evidence of Wrongdoing
A number of reports point out that there have been multiple investigations and probes elsewhere in the world regarding TikTok. What those reports don’t typically mention is the fact that there hasn’t been any known evidence of TikTok even doing anything wrong. The accusations are generally that TikTok is taking personal information and using it for marketing purposes. The problem with that assertion is that this has been standard practice for platforms for years. Facebook does this. Twitter does this. YouTube does this. Other platforms do this. It bolsters their ability to target advertising. Yet, at the same time, you don’t really see that same level of scrutiny on those platforms. Why should TikTok be any different in that regard?
TechDirt has been able to dive deep into the US perspective on this story – something I was only able to sporadically cover, but lack of resources means I had to carefully choose what topics to cover (shameless plug, consider supporting Freezenet or volunteering to change that, the door is still open and has been since 2020). What they were able to uncover really paints a very different picture about the whole situation. Take, for instance, this article by Karl Bode from last year. It notes how strange it has been seeing privacy issues centre around TikTok:
U.S. consumers face a parade of major privacy and security problems. Poorly secured routers, Internet things devices with zero privacy and security safeguards, major telecom network vulnerabilities, a massive unaccountable adtech and telecom hyper-surveillance apparatus (often unaccountably linked to government), all operating in a country that can’t seem to pass a privacy law for the Internet era because Congress is too corrupt.
Yet for whatever reason, the press and broader discourse remains singularly focused on…TikTok. For example, Buzzfeed released a report recently noting that “engineers in China” (read: at Beijing-based TikTok owner ByteDance) had repeated access to U.S. user TikTok data, contrary to a lot of ByteDance and TikTok promises that U.S. user data is stored in the U.S.
To be clear, this is dumb and bad. TikTok officials had testified before Congress that a “world-renowned, US-based security team” employed by the company strictly decided who got access to said data. It generally blows up a lot of the superficial promises the company has made as it tries to untangle itself from ByteDance and fears of Chinese intelligence agencies exploiting the app’s popularity.
Criticizing a company for being full of shit is fine. Countless companies all over the world are immensely full of shit when it comes to largely performative privacy practices. But for whatever reason we seem singularly obsessed with TikTok, and the singular threat the company poses to planet Earth. In a way that drowns out the broader issues and context.
But these stories always operate in a weird, contextual vacuum. One where the entirety of global technology markets aren’t a privacy shit show and user datasets of all kinds aren’t bouncing around the ether.
It’s almost spooky the similarities we have here in Canada now. Canada has no real privacy laws and the focus is weirdly on TikTok specifically. Our calls for privacy reform get ignored and the broader issues about the state of privacy in Canada get left unfixed. Exact same story in the US where there are numerous privacy law issues. There’s plenty of privacy issues floating around in this space, but they get left unaddressed more often then not. A lot of context does seem to get swept under the rug or ignored.
Indeed, the US’s failure to properly address the state of privacy would also be noted in this story by Mike Masnick:
Given the near non-stop moral panics about TikTok from the past few years, I’m am absolutely sure that this will be used (yet again) to argue that TikTok is somehow uniquely problematic, when the reality (yet again) is that what it’s doing is really no different than what a ton of American internet companies already do and have done in the past.
So, rather than making this a big thing about “oh no TikTok/China bad,” this should be a recognition that Congress should stop bickering about stupid stuff, and that includes pushing silly performative legislation, and come up with an actual federal privacy law that gives the public greater ability to protect their own privacy from all sorts of companies.
But, of course, that would take competence, and probably wouldn’t be useful for grandstanding or headlines… so it’ll never happen.
Of course, there are questions about what this means regarding TikTok’s widely discussed plans to separate US user data from ByteDance’s peeking eyes. I thought Oracle was supposed to protect us from all this, right? Right?
In addition to that, the bans on TikTok have ended up being purely performance and not actually solving any problems at all:
For decades, U.S. politicians leaders utterly refused to support most meaningful privacy protections for consumers. They opposed any nationwide privacy law, however straightforward. They opposed privacy rules for broadband ISPs. They also fought tooth and nail to ensure the nation’s top privacy enforcement agency, the FTC, lacked the authority, staff, funds, or resources to actually do its job.
This greed-centric apathy created a wild west data monetization industry across telecom, app makers, hardware vendors, and data brokers that sees little real accountability, in turn resulting in just an endless parade of scams, hacks, breaches, and other privacy and security violations.
Those same policymakers are now freaking out because one app and one app only, TikTok, has taken full advantage of the lax privacy and security environment these policymakers directly created.
Hyperventilating about TikTok has become one of the GOP’s policies du jour, gifting a rotating crop of performative GOP politicians (like the FCC’s Brendan Carr) repeated TV appearances.
At the same time, numerous states have announced they’ll be banning the use of TikTok on all government devices. South Dakota Governor Kristi proudly announced such a ban last week. Maryland Governor Larry Hogan joined her shortly thereafter. Georgia lawmakers are planning a similar ban.
Here’s the thing these grandstanding politicians either don’t understand or are ignoring: nearly every app, service, and device in your home is hoovering up just an endless trove of information on your every waking moment, from when you wake up in the morning, to which path you took to work, then selling that poorly protected data to absolutely any nitwit (including governments) for a nickel.
In this reality, fixating exclusively on TikTok is both dumb and performative. Yeah, TikTok probably shouldn’t be on government employee phones. That said, neither should dozens if not hundreds of other apps and services repeatedly found to be over-collecting and poorly securing user data. The delusion that you’re safe simply if the app isn’t Chinese is just toddler thinking.
This eventually led to the ANTI-SOCIAL PPC Act which I did cover a while ago. It was a weird development that didn’t seem to solve anything.
Making sure no stone was left unturned, I spoke to Mike Masnick and asked if he was aware of anything TikTok was doing that was particularly egregious that he was able to see. Masnick replied, “still no public evidence of literally anything. it’s always possible, but I’d prefer to see some sort of actual evidence.”
The response was particularly striking. Here, you have highly motivated individuals in the US trying to find evidence of wrongdoing on the part of TikTok, yet, there hasn’t been anything that was publicly released. If you are making a public push to name and shame TikTok over supposed egregious privacy concerns, you would think that there would be evidence that is publicly available by now that would back these claims.
As a result, the lack of evidence really doesn’t speak well to any potential investigation in question. For anyone in Canada trying to investigate TikTok properly, finding anything particularly egregious on TikTok would be an accomplishment their American counterparts failed to achieve.
Would a TikTok Ban Solve Anything?
Then there is the angle of government officials banning TikTok. Rather than just approach this issue of TikTok should be banned from government devices, the more proper approach is to audit all apps and programs and ask if they pose any kind of risk at all. It is widely documented that many apps do handle and mishandle people’s personal information – frequently without the users knowledge. It’s hard to see TikTok being among the worst apps out there for that sort of thing and there has been scant little evidence of a conclusion other than that.
What’s more, in the grand scheme of things, trying to dissuade a specific apps use from the general population for privacy concerns solves nothing in the end. If there was a real concern about TikTok’s use of privacy concerns, then a more valid approach is to look at apps more generally and ask how those apps handle people’s personal information. Educating the public on how to be aware of your personal information and how apps track and store that personal information would be infinitely more useful than screaming, “TikTok bad! China! Ban now!”
Where’s the Evidence?
For those saying that there is something specifically wrong with TikTok, starting with an accusation is always a terrible place to start. Actually build a case. Show the public evidence. Point out why TikTok is specifically bad. Until then, such attacks are going to come off as a weak defamation campaign. As of now, there hasn’t been any evidence the public can work with that will bolster your case.
What is particularly disappointing in all of this is the fact that this story comes after the media flew off the handle when they were full of s*** about the Google block Bill C-18 story. This is the second time in a row that the media has largely screwed up a story, though, to be fair, not in the same degree. I would call this a wakeup call that the media needs to get their act together if they plan on covering tech related stories. Journalists at big media companies like to call themselves credible and professional. Could those journalists please act like that for a change?
Drew Wilson on Twitter: @icecube85 and Facebook.
