TikTok ‘may’ collect biometric identifiers in the U.S. because it can: App adds concerning clause to Privacy Policy about faceprints and voiceprints

TikTok has added a rather concerning clause to its Privacy Policy. The appended statements indicate the app may collect biometric identifiers such as faceprints and voiceprints in the near future.

The viral ultra-short video-sharing social media platform has indicated it may collect additional information about users and content creators. There’s no clear indication about the purpose or intention behind the additional biometric data harvesting.

TikTok will collect biometric identifiers from users in the U.S.:

TikTok has quietly updated its Privacy Policy. The platform has added a new section titled “Image and Audio Information”. The sub-section is under the “Information we collect automatically” section.

The first part of the new section informs that TikTok may collect information about the images and audio that are in users’ content, “such as identifying the objects and scenery that appear, the existence and location within an image of the face and body features, and attributes, the nature of the audio, and the text of the words spoken in your User Content.”

Needless to mention, nearly every social media platform, including Facebook, Instagram, YouTube, conducts object recognition on images that users upload. This helps to develop “accessibility features”. But more importantly, such information helps social media platforms develop and deliver customized or targeted advertising.

In the case of TikTok, the platform will reportedly power its AR (Augmented Reality) effects and automatic captioning of spoken words. While this may sound standard and innocent, the next part of the newly added sub-section is concerning.

It states: “We may collect biometric identifiers and biometric information as defined under US laws, such as faceprints and voiceprints, from your User Content. Where required by law, we will seek any required permissions from you prior to any such collection”.

TikTok will collect biometric identifiers only after securing consent and in accordance with U.S. laws:

As the official statement claims, TikTok will first seek user consent before harvesting biometric identifiers. However, the platform does not offer any clarity about which laws will it follow: Federal law, States laws, or both.

The U.S. has very few states that have clearly defined biometric privacy laws. These include Illinois, Washington, California, Texas, and New York. In other words, TikTok could, theoretically, avoid informing users about biometric data harvesting in other states.

As far as National or Federal Laws are concerned, TikTok is already complying. The platform confirmed that it stores TikTok U.S. user data in its U.S. data centers and in Singapore.

However, the platform recently agreed to pay $92 Million as part of a national class-action lawsuit. As part of the settlement, TikTok has agreed to avoid several behaviors that could compromise user privacy unless it specifically discloses those behaviors in its privacy policy.

Simply put, TikTok may or may not collect biometric identifiers for its users. However, the platform may have inserted the sub-section to play it safe by cautioning users beforehand.

It is important to note that the appended clause is applicable only to TikTok’s userbase in the U.S. TikTok’s users in UK continue to remain shielded owing to the prevalent GDPR (General Data Protection Regulation).