Safeguarding U.S. User Data

Project Texas

We have been working on an innovative data-security-centered initiative called “Project Texas” that has significantly enhanced the way that U.S. user data is stored and accessed.

Protected Data

Under Project Texas, protected data of U.S. users is afforded stricter protection. Protected data broadly means personal information collected from a TikTok U.S. user. Subject to exceptions, protected data include the following categories of data, even if deidentified, anonymized, or aggregated: user data, such as email and birthdate; non-public user content, such as private videos and direct messages; behavioral data, such as user interaction with content including likes and favorites; data inputs to TikTok’s recommendation engine, such as video completion and video viewing time; and device and network data, such as IP address and device model.

There are some necessary exceptions to protected data to allow TikTok to continue operating as a business and as a global platform, including public data such as public videos, business metrics such as daily active user stats, data of certain creators pursuant to an agreement, interoperability data such as data needed to apply a user’s privacy settings globally, and e-commerce data such as shipping information.

Data Storage

Data security starts with where and how protected data is stored. All protected data of U.S. users will be stored by default in the Oracle Cloud Infrastructure in the U.S. As of June 2022, 100% of U.S. user traffic is routed to the Oracle and TikTok U.S. Data Security (“USDS”) infrastructure instead of our data centers in Virginia and Singapore. In March 2023, we began the process of deleting U.S. user protected data from the Virginia and Singapore data centers.

Data Access

Another critical component of data security is limiting data access. All access to protected data is managed by USDS, a U.S. TikTok subsidiary that is responsible for managing all functions of the TikTok platform related to access and security of U.S. user protected data.

As of January 2023, all access to systems containing new U.S. user protected data has been exclusively controlled by USDS, and all access to the new protected data is restricted to approved USDS employees. There are some limited exceptions where non-USDS employees may be granted access to protected data, for example, for legal and compliance, but such access must be expressly authorized by USDS pursuant to a robust data access protocol.