TikTok's updated privacy policy may let it collect your biometric data

TikTok has updated its U.S. privacy policy to make clear that it might collect your biometric information, but none of this really changes anything. Even if it did, you weren't going to stop using the app anyway.

In February this year, TikTok's parent company ByteDance settled a lawsuit which alleged it violated Illinois' biometric privacy laws. In addition to paying a $92 million settlement, ByteDance agreed that it would not use TikTok to collect users' biometric information "unless disclosed expressly in the TikTok Privacy Policy and in compliance with all applicable laws."

Now TikTok has updated its policy accordingly. On Wednesday the video sharing app added a new paragraph in the section of its privacy policy concerning automatically collected information. Under the new subheading "Images and Audio Information," TikTok now makes it clear that it may collect users' images and audio to enable filters and video effects, allow it to moderate content, and "for other non-personally-identifying operations."

"We may collect information about the images and audio that are a part of your User Content, such as identifying the objects and scenery that appear, the existence and location within an image of face and body features and attributes, the nature of the audio, and the text of the words spoken in your User Content," TikTok's changed policy reads.

This makes sense — many of TikTok's filters need to detect users' faces in order to correctly apply their virtual makeup and greenscreen effects. Features such as TikTok's automatic captions have to collect audio in order for the app to transcribe it as well. The difference is that now TikTok is explicitly disclosing this.

Of course, TikTok also states it may use this information to determine demographics, and to help it recommend content and ads. And while the new privacy policy indicates that information gathered will typically be general, focused on the existence of a face rather than the specifics of its features, it also notes that the app may collect faceprints and voiceprints.

"We may collect biometric identifiers and biometric information as defined under US laws, such as faceprints and voiceprints, from your User Content," the policy notes. "Where required by law, we will seek any required permissions from you prior to any such collection."

Like fingerprints, faceprints and voiceprints are unique to each individual and can be used for security and identification purposes. TikTok does not currently have features that require either, though it isn't impossible that it will in the future. Being able to gather users' voiceprints would be useful if the app's automatic captioning feature was updated to recognise multiple speakers, for example.

TikTok maintained in the aforementioned lawsuit that it has never gathered users' biometric information, but agreed to clearly disclose if it did in order to prevent future transgressions. The updated privacy policy also notes that TikTok may transmit user data to its servers outside the U.S. for storage or processing, and that third parties it shares data with may also be outside the U.S. — another disclosure mandated by the settlement.

"As part of our ongoing commitment to transparency, we recently updated our Privacy Policy to provide more clarity on the information we may collect and how it’s used," a TikTok spokesperson told Mashable.

The company declined to comment on whether TikTok currently collects biometric information, or what this information is or might be used for.

It's never nice to learn that you're being tracked and analysed. However, in a world where nobody can be truly anonymous anymore, being explicitly told that you're being watched is much preferable to it being done in secret.

UPDATE: June 7, 2021, 10:01 a.m. AEST This article has been updated to include TikTok's statement.