Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that users may submit requests to know, access, correct, or delete their personal information via a webform or mailing address, and may appeal denied requests through the same channels. The policy further states that exercising rights will not result in retaliation, although some service features may become unavailable.
This analysis describes what TikTok's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the operational framework for user data rights under CCPA and similar state privacy laws, including access, correction, deletion, and appeal mechanisms. The non-retaliation carve-out noting that some service features may become unavailable requires users to understand which features are contingent on data collection consent.
⚠ Personal information will continue to be collected and used as described in the policy absent a deletion or restriction request
Cross-platform context
See how other platforms handle User Rights and Data Subject Request Mechanism and similar clauses.
Compare across platforms →Monitoring
TikTok has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"You may submit a request to know, access, correct or delete the information we have collected from or about you here or by sending your request to the physical address provided in the "Contact Us" section below. You may appeal any decision we have made about your request through these same methods. [...] We will not retaliate against you for exercising your rights and choices, although some aspects of the Services may no longer be available to you.Excerpt from TikTok's Privacy Policy
(1) REGULATORY LANDSCAPE: This provision implements the data subject rights framework required under CCPA, including the right to know, access, correct, delete, and appeal. Analogous rights exist under Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Texas TDPSA, and other state privacy laws. The non-discrimination provision aligns with CCPA's non-retaliation requirement. (2) GOVERNANCE EXPOSURE: Low. The rights request mechanism is disclosed with a specific webform URL and mailing address, and an appeal pathway is provided. The caveat regarding service feature availability is consistent with standard CCPA non-discrimination carve-outs. (3) JURISDICTION FLAGS: California, Virginia, Colorado, Connecticut, Texas, and other states with comprehensive privacy laws mandate specific response timeframes and verification procedures. Authorized agent requests are addressed in the policy, with a requirement to provide power of attorney or written authority documentation. (4) CONTRACT AND VENDOR IMPLICATIONS: Organizations acting as data processors on behalf of users through TikTok integrations should assess whether user rights requests directed to TikTok may require coordination with downstream data processors or vendors. (5) COMPLIANCE CONSIDERATIONS: Legal teams should verify that TikTok's response timelines for data subject requests meet applicable state law requirements. The verification mechanism (email address confirmation or account information) should be evaluated against state-specific verification standards. The authorized agent process should be tested for operational adequacy.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes the operational framework for user data rights under CCPA and similar state privacy laws, including access, correction, deletion, and appeal mechanisms. The non-retaliation carve-out noting that some service features may become unavailable requires users to understand which features are contingent on data collection consent.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by TikTok.