Tick Tock. The Clock May be Ticking to Request Your TikTok Account Data.
The right to portability.
Introduction
Better known as the TikTok Act, the “Protecting Americans from Foreign Adversary Controlled Applications Act” has become federal law. It prohibits certain enablement and access of foreign adversary controlled applications within the land or maritime borders of the United States with TikTok explicitly being referred to as one such application. You probably know much about this Act already. But did you know it gives you a potential right to your TikTok account data? We discuss below. And we recommend you act fast.
What Data can you Request?
Section (2)(b) of the Act gives users in the land or maritime borders of the United States the right to “all the available data related to [their TikTok] account”. The Act states that this right to data includes any “data maintained by such application” which includes content such as “post, photos, and videos” and “all other account information”.
There is some ambiguity about the scope of this data right. For instance, does it include inferences and profiling categorizations of you derived at least partly from your use of your account? I think it unlikely that this was the intent, but it could be interpreted that way. And I think in any case, whether this was the intent or not, TikTok is not going to provide any such information to you.
We get some help in clarifying the potential intent of this data right from the title of Section (2)(b) which reads: “Data and Information Portability to Alternative Applications”. Thus, a reasonable interpretation is that the intent is to enable you to get enough data so that you can port your TikTok life onto another platform.
The specific mention of content to include “posts, photos, and videos” supports that interpretation. But the addition of “all other account information” makes it unclear if such portability to the alternative application was the only intent behind this clause.
And still there are other questions about the scope of the data right. For instance, it refers to all “available” data. What is all “available” data? I suppose if the data is on your account when you log in or within your history accessible to you, then you should very much expect that such data is considered available. But what if any data is archived from your usage that might be incredibly burdensome to access (such as tapes)? Should those tape archives also be considered available? Do you care about such data? You might.
Also, does this right include just data related to you from your account or data related to others that might have commented or liked one of your posts? This data right in this Act is not a privacy right per se. But under many privacy regulations there could be situations that might restrict what third party data you can access even though it meets the definition of being data related to you. That might affect some of the data you receive or don’t receive.
How do you get your request?
TikTok is required to provide the data you request in a machine-readable format. How you request it and how they transmit it is left silent. The drafting of this requirement leads me to guess (but don’t know for sure) that a privacy expert did not draft or review this Act before it was published. Again, I realize this data right is not a privacy right per se. But a privacy expert would likely have added that the machine-readable format must be one that is commonly used.
Privacy experts have experience with portability issues in the GDPR, CCPA, and other regulations. And likely they would have picked up on this important qualifier. Also, a privacy expert may have considered requiring it to be structured, if technically feasible. If the idea is for you to port, it should probably be in a format that is commonly used so you can easily access it and structured so that it can be easily ported to and accepted by the alternative application. If it isn’t, it could negate the whole intent of the portability right.
When do you get the data?
Your account data should be provided to you before the prohibition kicks in which in this case will be 270 days from the date of the enactment of this TikTok Act. But you first must request it. And the wording leaves some imagination about what is supposed to happen if you wait to request it on day 269.
Also, there can be a one-time 90-day discretionary extension for the prohibition to kick in but in such case if there is, it will probably mean a divestiture is underway and you will still have access to TikTok as you do today when all the dust settles. However, even that could fall apart so perhaps the best course of action is to make your request as soon as possible.
Other Portability Concerns
I am a big fan of the concept of portability in privacy law. But I think it is fair to say that for many it has not lived up to its expectations to act as mechanism to lower the barrier for consumers to transfer from one app or service to another. Reasonable people can disagree. And that is a subject for another time.
But in any case, to port, you still need some cooperation from the other app you are porting to or at least some easy and practical way to port it. That is often easier said than done. And I guess only time will tell how this all works out.
Will it Matter?
TikTok says they aren’t going anywhere. I don’t know what that means. Does it mean a legal challenge? Are there some potential loopholes in the law TikTok could try to implement? Will they divest? I don’t know what will happen and only time will tell. But time may go faster than you think.
For now, even though so much is unclear, if you want to keep some of your TikTok account data, you might want to request it as soon as possible. But beware, whatever you get may be only what TikTok wants to deliver. And whatever you get, may not practically port anywhere.