TikTok’s updated privacy policy in the US gives it permission to collect biometric data from users

TikTok has updated its privacy policy in the US and has introduced a section that states that the app “may collect biometric identifiers and biometric information” from its users’ content. And this includes data like “faceprints and voiceprints”. According to TechCrunch who reached out to TikTok for a comment, the platform could not confirm “what product developments necessitated the addition of biometric data to its list of disclosures about the information it automatically collects from users”. However, TikTok said that they could ask for consent in case such data collection practices began.

These new biometric data collection details have been introduced under a newly added section called “Image and Audio Information” that’s placed under the “Information we collect automatically” heading in the policy. This section of TikTok’s privacy policy lists the types of data the app collects from users and it is a pretty extensive list.

The first part of the new section that’s been added explains that TikTok may collect information about audio and images that are in users’ content such as - “identifying the objects and scenery that appear, the existence and location within an image of face and body features and attributes, the nature of the audio, and the text of the words spoken in your User Content.”

While this does sound creepy, this is not surprising since other social networks also do “object recognition” on images that you upload to power accessibility features like describing what’s in the photo for the visually impaired. This is also done for ad targeting purposes. Also, identifying where a person and the scenery can help with AR effects and converting spoken words helps with features like TikTok’s automatic captions.

TikTok has also explained that this data collection is for enabling “special video effects, for content moderation, for demographic classification, for content and ad recommendations, and for other non-personally-identifying operations”.

What is more concerning is the plan to collect biometric data, as TikTok states - “We may collect biometric identifiers and biometric information as defined under US laws, such as faceprints and voiceprints, from your User Content. Where required by law, we will seek any required permissions from you prior to any such collection”.

As TechCrunch points out, this statement is vague as it does not specify whether TikTok is considering federal laws or state laws, or both. The platform also does not explain why it needs this data. They also have not defined the terms “faceprints” and “voiceprints” and have not mentioned how exactly they are going to seek the “required permission” from users, or if they are going to look at either federal or state laws to guide this process of gaining consent.

Only a few US states have biometric privacy laws, including Washington, California, Texas, New York, and Illinois. If TikTok requests consent “where required by law”, it means that in other states where there are no biometric privacy laws, users will have no have to be informed about this data collection.

A TikTok spokesperson said that they could not immediately offer any more details about their plans for biometric data collection and how it may tie into current or future products. “As part of our ongoing commitment to transparency, we recently updated our Privacy Policy to provide more clarity on the information we may collect,” the spokesperson told TechCrunch.