TikTok Privacy Policy

This document is TikTok's global Privacy Policy (last updated July 8, 2025), governing data collection, processing, and sharing practices for TikTok apps, websites, and related services operated by TikTok Pte. Ltd. (Singapore), and applies to all users of the Platform outside jurisdictions with separate dedicated policies. The policy states that TikTok collects an extensive range of personal data including account credentials, user-generated content and associated metadata, messages and message metadata, precise and approximate location, device identifiers (including keystroke patterns and audio settings), face and body feature data extracted from videos and images, clipboard content, phone and social network contacts, and off-platform behavioral data supplied by advertisers and business partners; the terms authorize use of this data for purposes including personalized advertising on and off the Platform, training machine learning models and algorithms, inferred profiling of age, gender, and interests, and sharing with corporate affiliates, advertisers, measurement partners, and independent researchers. The policy's scope of biometric-adjacent data collection (face and body feature identification from user content) and the explicit authorization to use user content in advertising and marketing campaigns, combined with broad off-platform data ingestion from advertiser partners, are operationally notable; the agreement asserts these rights on a global basis, though applicable law in specific jurisdictions (including GDPR in the EU/EEA, UK GDPR, CCPA/CPRA in California, and PDPA in Singapore) may constrain the legal bases, consent requirements, and data subject rights that govern these practices in practice. The policy engages GDPR, UK GDPR, CCPA/CPRA, COPPA (given minor-user considerations), Singapore PDPA, and potentially the EU AI Act given AI/ML training uses; material compliance considerations include the adequacy of consent mechanisms for biometric-adjacent processing, the legal basis for cross-context behavioral advertising, and the robustness of data subject rights mechanisms across jurisdictions.