TikTok users across the U.S. are sounding alarms over the app's updated privacy policy, which mentions collecting "immigration status" among other sensitive data categories. The disclosure, tied to the company's recent ownership transition, has sparked widespread panic on social media - but privacy lawyers say the language isn't new and has more to do with California's Consumer Privacy Act than government surveillance. The timing couldn't be worse, coming as ICE enforcement escalates and hundreds of Minnesota businesses shut down Friday in protest.
TikTok users just got a crash course in privacy law, and they're not happy about it. The app's newly updated privacy policy - pushed to users via in-app notifications following the company's ownership transition - has triggered a wave of concern across social media, with thousands posting screenshots and warnings about language mentioning "immigration status" data collection.
But here's the thing: this isn't actually new. The same language appeared in TikTok's previous privacy policy, updated back in August 2024. What changed is that people are actually reading it now, thanks to mandatory alerts about the new legal entity operating the service.
The policy states TikTok may process "racial or ethnic origin, national origin, religious beliefs, mental or physical health diagnosis, sexual life or sexual orientation, status as transgender or nonbinary, citizenship or immigration status, or financial information." That's a lot to unpack, especially in today's political climate.
The timing is brutal. On Friday, hundreds of Minnesota businesses closed their doors in an economic blackout protesting Immigration and Customs Enforcement operations in the state. According to reports from The New York Times, weeks of clashes between Minnesota residents and ICE agents have led to thousands of arrests and the death of American citizen Renée Good. When users see "immigration status" in their social media app's terms of service, the implications feel very real.
"TikTok is required under those laws to notify users in the privacy policy that the sensitive personal information is being collected, how it is being used, and with whom it is being shared," Jennifer Daniels, a partner at law firm Blank Rome, told TechCrunch. The disclosure has everything to do with California's regulatory framework and nothing to do with new data collection practices.
California's Consumer Privacy Act and the California Privacy Rights Act define "sensitive information" in exhaustive detail - everything from Social Security numbers to precise geolocation to union membership. The list includes citizenship and immigration status, a category specifically added when Governor Gavin Newsom signed AB-947 into law in October 2023.
Companies operating in California have to disclose when they collect these categories of sensitive data. For a social media platform where users post videos about literally everything in their lives, that means TikTok could theoretically encounter all of it. Someone posts a video about their immigration journey? That's sensitive information being processed. A creator shares their transition story? Same thing.
"TikTok is essentially saying that if you disclose something sensitive, that information becomes part of the content the platform technically 'collects,'" Ashlee Difuntorum, an associate at Kinsella Holley Iser Kump Steinsapir, explained to TechCrunch. "Policies like this often look alarming because they're written for regulators and litigators, not for ordinary consumers."
Philip Yannella, co-chair of Blank Rome's Privacy, Security, and Data Protection Practice, pointed to another reason for the specific language: litigation risk. He's seen demands under the California Invasion of Privacy Act from plaintiffs' lawyers alleging "the collection of racial, immigration, and ethnic data." Spelling everything out protects companies from claims they failed to disclose.
Meta faces the same requirements. The company's privacy policy includes similar disclosures about sensitive information, though it uses slightly less specific language - mentioning "philosophical, political, trade union, or religious beliefs" rather than spelling out individual categories. The approach seems designed to comply with the law while not freaking people out quite as much.
But as one privacy lawyer consulted by TechCrunch noted, spelling out these details so precisely can backfire. It makes things less clear to regular users, not more. What reads as transparency to a regulator reads as confession to a worried user.
Social media feeds are filling with panic. Users are posting screenshots, warning friends, and threatening to delete their accounts. Some are making the connection to broader surveillance concerns. "Between this and everything happening in Minnesota, I don't feel safe on any platform anymore," one user posted to Threads.
The irony is thick. The whole reason TikTok's U.S. operations moved to new ownership was surveillance concerns - but with China cast as the threat, not the U.S. government. Chinese laws, including the 2017 National Intelligence Law and 2021 Data Security Law, require companies to assist with state intelligence gathering. U.S. lawmakers worried ByteDance's ownership of TikTok could enable surveillance of Americans or algorithmic manipulation to push Chinese propaganda.
Now the tables have turned. With immigration enforcement ramping up and the political climate shifting, Americans are more worried about their own government accessing their data than Beijing's. The fear isn't hypothetical - governments regularly demand user data from tech platforms, and companies are legally required to comply with valid warrants and subpoenas.
TikTok didn't respond to requests for comment, leaving users to parse the legal language on their own. That's led to a lot of misinterpretation. The policy doesn't say TikTok is actively harvesting immigration status from users. It says that if such information appears in content users create, TikTok may process it in accordance with applicable law.
Still, the underlying concern isn't baseless. Social media platforms do collect enormous amounts of data, and that data can be accessed by governments through legal process. Whether users feel comfortable with that reality - especially for categories as sensitive as immigration status - is a different question than whether the privacy policy language is new or unusual.
What's clear is that privacy policies written for legal compliance don't translate well to user understanding, especially when timing amplifies every fear. TikTok's disclosure meets the letter of California law. But it's failing the test of user trust.
TikTok's privacy policy panic reveals a deeper truth about the disconnect between legal compliance and user understanding. The language that protects companies from litigation alarms the very users it's meant to inform. As privacy laws proliferate across states, expect more of these moments where legalese meets public fear - especially when the political climate makes every data disclosure feel like a potential threat. For now, TikTok users are learning that reading the fine print doesn't always bring clarity, just more questions about who's watching and what they can see.
