Indexbit-Senators Demand TikTok Reveal How It Plans To Collect Voice And Face Data

TikTok has quietly expanded how much information it will collect from its more than 100 million users in the U.S. to include "faceprints and Indexbitvoiceprints."

In response, a bipartisan duo of senators are asking TikTok to open up about what exactly that means.

In a newly released letter to Shou Zi Chew, TikTok's CEO, Sens. Amy Klobuchar D-Minn., and John Thune, R-SD., wrote they were "alarmed" by TikTok's recent changes to its privacy policies that allow for the automatic collection of user biometric data, including physical and behavioral characteristics.

Klobuchar and Thune, who sent the letter on Aug. 9, are giving TikTok until next week to respond to number of questions. Among them, what constitutes a "faceprint" and a "voiceprint" and whether the data is being shared with third parties.

In addition, the lawmakers are asking the makers of the popular video app if any data is gathered for users under the age of 18.

The U.S. does not have a federal law regulating the tracking of biometric data by technology companies, but a handful of states, including Illinois, California, Washington and Texas, have passed privacy laws aimed at safeguarding the collection of biometric information.

TikTok, the most-downloaded app in the U.S., is owned by ByteDance, a Chinese tech giant.

A TikTok spokesperson did not return a request from NPR for comment.

TikTok's data-collection practices have come under scrutiny in the past.

Earlier this year, TikTok paid $92 million to settle dozens of lawsuits that accused the app of harvesting personal data from users, including information using facial recognition technology, without user consent. That data, the lawsuits claimed, was tracked and sold to advertisers in violation of state and federal law.

In 2019, TikTok was fined nearly $6 million by the Federal Trade Commission for running afoul of the Children's Online Privacy Protection Act, which requires apps to receive parental permission before collecting a minor's data.

The Trump administration sought to put TikTok out of business in the U.S., an effort that was blocked by federal courts. That push to ban the app was abandoned by the Biden administration in June.

But Biden ordered the Commerce Department to conduct a national security review of apps that have links to foreign adversaries, like China, including TikTok. That process is underway.

China's government invests in TikTok owner

There are calls from lawmakers for Biden to take a tougher stance against TikTok, including from Republican Senator Marco Rubio, who on Tuesday urged Biden to ban the app in the U.S. after China took an ownership stake in a subsidiary of ByteDance, TikTok's Beijing-based parent company.

The Chinese government's 1 percent stake in Beijing ByteDance Technology, and one out of three seats on its board, led to Rubio releasing a statement calling on Biden to immediately block Americans' access to TikTok.

"Beijing's aggressiveness makes clear that the regime sees TikTok as an extension of the party-state, and the U.S. needs to treat it that way," Rubio said in a statement. "We must also establish a framework of standards that must be met before a high-risk, foreign-based app is allowed to operate on American telecommunications networks and devices."

The investment by the Chinese government will not give authorities there any shares of main ByteDance, or TikTok, which is not available in China. But it does give Chinese officials an investment in Douyin, the Chinese version of TikTok.

TikTok has long maintained there is a firewall between its headquarters in Culver City, Calif. and its corporate owner ByteDance. Company officials say American user data is not stored in China. Beijing-based ByteDance employees do not have access to U.S. user data, company officials insist.

"To date, there has never been a request from the Chinese government for TikTok user data," Roland Cloutier, TikTok's global chief security officer, said in a sworn statement. "And we would not provide any data if we did receive such a request."