Every app collects some data — that’s not unique to TikTok. What’s worth understanding is the specific scope, because TikTok’s privacy policy covers more categories than most people scrolling past the “I agree” button realize, and some of it has already led to real regulatory consequences.
The basics: what’s actually in the policy
TikTok’s current US privacy policy (last updated February 2026, now operated by TikTok USDS Joint Venture LLC following the 2026 ownership restructuring) discloses collection of:
- Account and profile information — the standard stuff: email, phone number, birthdate, username.
- Content and its metadata — not just the videos you post, but details attached to them, and notably, content you start uploading but never actually publish can still be collected.
- Messages and message metadata — who you’re messaging and when, alongside the content itself.
- Precise and approximate location — GPS coordinates when location services are enabled, plus location inferred from your IP address and connected Wi-Fi networks even without GPS access.
- Biometric identifiers — faceprints and voiceprints extracted from the videos and images you upload, used for effects and content categorization.
- Keystroke patterns and clipboard content — yes, this includes text copied from other apps in certain contexts, not just what you type inside TikTok itself.
- Device identifiers and technical data — hardware details, operating system, and other device-level identifiers.
- AI interaction data — prompts and responses if you use any of TikTok’s AI-powered features.
- Inferred attributes — age, gender, and interest categories the system estimates based on your behavior, even when you haven’t directly provided this information.
Who this data gets shared with
The policy authorizes sharing with advertising and analytics partners, payment processors, sellers on the platform, other business partners, and corporate affiliates. TikTok states it does not sell personal information outright or share it for cross-context behavioral advertising in places where that’s restricted by law — but the list of parties data does flow to is still fairly broad.
The EU fine that put a number on this
In May 2025, Ireland’s Data Protection Commission fined TikTok €530 million (roughly $600 million) — one of the largest GDPR penalties ever issued — specifically over how European user data was being transferred to and accessed from China. Investigators found TikTok had, at one point, stored some EU user data on servers in China despite previously stating otherwise, and that its privacy policy hadn’t clearly disclosed this to users. TikTok has said it plans to appeal, and has pointed to its separate “Project Clover” initiative — European data centers meant to reduce exactly this kind of cross-border data flow — as evidence the situation has since improved. Worth noting this predates the 2026 US ownership change and specifically concerns the European entity, not the newly restructured US operations.
What you can actually control
- Ad personalization — most regions let you limit targeted advertising through Settings → Privacy → Ads, though this reduces ad relevance rather than stopping data collection entirely.
- Location access — can be revoked at the OS level (device Settings, not just within TikTok), which stops precise GPS collection specifically, though approximate location from IP address typically still applies.
- Your legal rights — depending on where you live, you generally have the right to request access to what’s been collected, ask for correction or deletion, and in the US, opt out of certain targeted advertising under state privacy laws like the CCPA.
- Family Pairing — if you’re a parent, this lets you limit data collection and screen time for a linked minor’s account (we’ve got a full guide on setting this up).
Frequently asked questions
Does TikTok really read my clipboard?
The policy discloses clipboard content collection in certain contexts — this drew significant attention a few years ago when iOS added a notification showing apps accessing the clipboard, and TikTok was among those flagged. It’s a disclosed practice, not a rumor.
Is my data actually stored in China?
For US users, data is now handled under the new joint-venture structure following the 2026 ownership deal, which was specifically designed to address these concerns. For EU users, the 2025 fine found that some data had been stored on China-based servers despite earlier assurances otherwise — TikTok disputes the finding and is appealing.
Can I delete data TikTok has already collected about me?
You can request deletion under applicable privacy laws depending on your region (GDPR in the EU, CCPA and similar laws in various US states), though this is a formal request process rather than an instant toggle — deleting your account entirely is the more direct option if you want a clean break.