-
TikTok
· TikTok Privacy Policy
The policy states that TikTok may collect biometric identifiers including faceprints and voiceprints from user-uploaded content such as videos and audio recordings, and that it will seek required permissions only where applicable law mandates this....
Why it matters: This provision creates compliance exposure under state biometric privacy statutes including Illinois BIPA, Texas CUBI, and Washington's biometric privacy provisions, each of which impose specific notice, consent, and retention obligations that may exceed the policy's general disclosure framework. The clause conditions consent obligations on whether law requires them, meaning the scope of user consent sought may vary by state....
-
TikTok
· TikTok Privacy Policy
The policy states that TikTok may collect and process user-generated content including video, audio, and images at the point of creation or import, before the user decides whether to save or publish the content....
Why it matters: This provision authorizes data collection from content that the user has not finalized or consented to share, which is operationally distinct from collection limited to published content. The pre-upload scanning mechanism may implicate state-level interception or wiretapping statutes depending on the content type and jurisdiction....
-
TikTok
· TikTok Privacy Policy
The policy states that TikTok collects all content submitted to its AI-powered interfaces, including prompts, questions, and files, as well as the AI-generated responses, as part of the information associated with a user's account....
Why it matters: This provision establishes that AI interaction data, including potentially sensitive content submitted in prompts or files, is retained and associated with user accounts for purposes including service improvement, machine learning model training, and content enforcement review as disclosed elsewhere in the policy....
-
TikTok
· TikTok Privacy Policy
The policy states that TikTok automatically assigns device and user identifiers and uses them to link activity across multiple devices, and that collected information is used to infer demographic attributes including age, gender, and interests....
Why it matters: This provision authorizes construction of cross-device activity profiles and demographic inference from behavioral data, which informs ad targeting on TikTok and through the TikTok Ad Network on third-party platforms. The inferred data may include attributes not directly provided by the user....
-
TikTok
· TikTok Privacy Policy
The policy states that TikTok receives behavioral data from external advertisers and partners, including off-platform browsing, purchase history, and app downloads, and uses this data alongside mobile advertising identifiers and hashed contact information to deliver targeted advertising both on TikTok and through the TikTok Ad Network on third-party platforms....
Why it matters: This provision establishes that TikTok's advertising infrastructure extends beyond the TikTok platform to third-party websites and apps via the TikTok Ad Network, using off-platform behavioral data received from partners to inform targeting. Users without TikTok accounts may also be targeted through TikTok Ad Network based on data received from partners....
-
Monitoring
These provisions have changed before.
Monitor includes same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
-
TikTok
· TikTok Privacy Policy
The policy states that TikTok uses collected data including user content, messages, AI interactions, and metadata to train and improve machine learning models and algorithms, and that this includes scanning and analyzing user content and messages....
Why it matters: This provision authorizes use of user-generated content, direct messages, and AI interaction data for machine learning training purposes, which extends the use of this data beyond service delivery into technology development. The inclusion of messages in the scope of ML training data is operationally notable....
-
TikTok
· TikTok Privacy Policy
The policy states that TikTok provides a separate limited-data experience for users under 13 in the US (and 13-year-olds in Florida under state law), and that accounts identified as belonging to children outside this experience will be terminated and their data deleted....
Why it matters: This provision establishes COPPA-aligned protections for users under 13, with a Florida-specific extension reflecting state law requirements. The policy also references parental and guardian rights to request account deletion and data download for both child and teen accounts, with state-specific variations in Connecticut....
-
TikTok
· TikTok Privacy Policy
The policy states that TikTok retains user information for as long as necessary for service provision, legal compliance, legitimate business interests, and defense of legal claims, with retention periods varying by data type and purpose. Cross-border data transfers outside the United States are authorized subject to compliance with Executive Order 14352....
Why it matters: The reference to Executive Order 14352 as a governing constraint on cross-border data transfers is operationally significant, as this executive order addresses data transfer restrictions to certain foreign entities and may affect the architecture and permissible scope of TikTok's international data sharing. The retention period framework does not specify maximum retention periods for most data categories....
-
TikTok
· TikTok Privacy Policy
The policy states that TikTok automatically collects keystroke patterns or rhythms from users' devices as part of technical information collection, alongside device identifiers, IP addresses, app and file names, and audio device configuration....
Why it matters: The collection of keystroke patterns or rhythms is operationally distinct from standard device fingerprinting practices and may be used for behavioral biometric authentication, fraud detection, or user identification purposes. The policy does not specify the exclusive purpose for which keystroke data is collected....
-
TikTok
· TikTok Privacy Policy
The policy states that users may submit requests to know, access, correct, or delete their personal information via a webform or mailing address, and may appeal denied requests through the same channels. The policy further states that exercising rights will not result in retaliation, although some service features may become unavailable....
Why it matters: This provision establishes the operational framework for user data rights under CCPA and similar state privacy laws, including access, correction, deletion, and appeal mechanisms. The non-retaliation carve-out noting that some service features may become unavailable requires users to understand which features are contingent on data collection consent....
-
TikTok
· TikTok Terms of Service
By posting content on TikTok, users grant TikTok USDS Joint Venture a non-exclusive, irrevocable, royalty-free, worldwide, assignable, and sublicensable license to reproduce, distribute, adapt, create derivative works from, and publicly display that content, including for the purpose of training and improving TikTok's machine learning models and algorithms. This license extends to service providers and business partners through multiple sublicensing tiers....
Why it matters: This provision authorizes TikTok to use all user-generated content, including Input submitted to generative AI interfaces, as training data for machine learning models and algorithms, and the license is designated as irrevocable and sublicensable through multiple tiers. The license persists after account deletion to the extent that content has been incorporated into other users' content, as stated in Section 3.6....
-
TikTok
· TikTok Terms of Service
The terms require that any legal proceeding or action arising out of or related to the Terms or the Platform must be initiated within one year of the underlying event, and any claim not brought within that period is permanently barred....
Why it matters: This provision contractually shortens the period within which users may bring legal claims to one year, which is shorter than the default statutes of limitations applicable under California law and many other U.S. jurisdictions for various claim types. The enforceability of contractually shortened limitation periods varies by jurisdiction and claim type....
-
TikTok
· TikTok Terms of Service
The agreement caps TikTok's total financial liability to any user at the greater of $100 or the total amount paid by that user to TikTok in the preceding 12 months, and this cap applies to TikTok USDS Joint Venture, its affiliates, service providers, business partners, and their personnel collectively....
Why it matters: This provision establishes a maximum aggregate liability ceiling that would apply to the combined claims of any user against TikTok and its affiliated entities. For users who have not paid TikTok directly, the effective cap is $100 regardless of the nature or magnitude of the claimed harm....
-
TikTok
· TikTok Terms of Service
The terms authorize TikTok to use a user's name, profile image, and username in connection with advertisements, sponsored gifts, offers, and branded or sponsored content that the user interacts with, without providing compensation to the user, unless a separate commercial agreement governs a specific promotion....
Why it matters: This provision establishes that user interaction with sponsored content constitutes permission for TikTok to deploy that user's name, profile image, and username in advertising contexts without additional compensation. The scope of what constitutes an interaction with sponsored content is not precisely defined in this clause....
-
TikTok
· TikTok Terms of Service
The terms require users to defend, indemnify, and hold harmless TikTok USDS Joint Venture and a broad group of affiliated entities and individuals from all claims, costs, damages, and expenses arising from the user's Platform use, including breaches of the Terms and violations of export control or sanctions laws in any applicable jurisdiction....
Why it matters: This provision requires users to cover TikTok's legal costs, settlements, and damages across a broad class of claims and a broad set of covered parties, including affiliates, service providers, and their personnel, arising from any use of the Platform. The indemnification obligation survives termination of the agreement....
-
TikTok
· TikTok Terms of Service
The terms authorize TikTok to ban, suspend, or restrict user accounts at any time without prior notice at its sole discretion for a range of stated reasons, including suspected policy violations, legal requirements, security issues, or suspected illegal activity. TikTok may also revoke and reassign usernames after 180 days of inactivity or upon account ban....
Why it matters: This provision establishes that account suspension and username reclamation may occur without advance notice, with the decision resting at TikTok's sole discretion. An appeal mechanism is available, but the initial action does not require prior notification to the user....
-
TikTok
· TikTok Terms of Service
The terms disclaim all warranties for AI-generated Output, assign full responsibility for Input and Output use to the user, and exclude TikTok's liability for any harm arising from reliance on Output. Users are directed not to rely on Output as a source of truth, professional advice, or basis for decisions related to health, finance, or law....
Why it matters: This provision places the entire operational risk of generative AI feature use on the user, including consequences from acting on inaccurate, incomplete, or misleading Output. The disclaimer covers health, finance, and legal decision contexts explicitly, which are domains where harmful reliance is most likely to have significant real-world consequences....
-
TikTok
· TikTok Terms of Service
The terms designate California law as governing and require all disputes to be litigated exclusively in either the U.S. District Court for the Central District of California or the Los Angeles County Superior Court, with users consenting to personal jurisdiction in those courts....
Why it matters: This provision establishes a mandatory California venue for all disputes, which may create a practical barrier to litigation for users located outside California. The retroactive application to claims that arose prior to the user's agreement to these Terms is operationally notable....
-
TikTok
· TikTok Terms of Service
The terms prohibit users under 13 (or under 14 in Florida) from accessing the standard Platform, directing them to a separate Under 13 Experience with limited data collection and additional safety features governed by a dedicated Children's Privacy Policy. Users under 18 are subject to feature restrictions, and TikTok monitors for underage use and will ban accounts that do not meet age requirements....
Why it matters: This provision establishes the age-gating and parental consent framework applicable to minors, including a Florida-specific age threshold of 14, which reflects applicable state law requirements. The existence of a separate Children's Privacy Policy governing data collection for the Under 13 Experience is directly relevant to COPPA compliance obligations....
-
TikTok
· TikTok Terms of Service
The terms prohibit use of the Platform in connection with transactions, services, or activities involving embargoed jurisdictions including Cuba, Iran, North Korea, and specified Ukrainian regions, or persons on designated sanctions lists including the OFAC SDN List, UN Security Council Consolidated Sanctions List, and EU Consolidated Financial Sanctions List. Users must certify they are not located in or subject to these restrictions....
Why it matters: This provision incorporates multi-jurisdictional export control and sanctions compliance obligations into the Terms, covering U.S., UK, EU, and Singapore regulatory frameworks, and extends user liability under the indemnification clause in Section 7 to violations of these requirements across all applicable jurisdictions....
-
X
· X Privacy Policy
This provision states that X may share user data with third-party collaborators who are then permitted to use that data for their own independent purposes, including training AI models, unless the user opts out via account settings....
Why it matters: This clause establishes an opt-out default for data sharing with third parties for purposes outside X's own stated policy uses, including AI model training. The provision applies to all users globally and may require evaluation under GDPR's purpose limitation and lawful basis requirements, as well as CCPA's data sharing and opt-out disclosure obligations....
-
X
· X Privacy Policy
This provision states that X may collect and use biometric information from users, conditioned on user consent, for purposes of safety, security, and identification....
Why it matters: This provision discloses biometric data collection as a consent-based practice applicable to the X platform. Biometric data is subject to heightened legal protections in several US states and under GDPR, and the adequacy of X's consent mechanisms for this data type may warrant review under applicable statutes....
-
X
· X Privacy Policy
This provision states that X may associate a user's account with browsers and devices beyond those used to sign in, including signed-out devices, and may infer identity by linking hashed email addresses with common components to a user's account....
Why it matters: This clause establishes that X's identity inference and cross-device tracking practices extend to signed-out users and to probabilistic email address matching, which has implications for the scope of data processing disclosed to users and may require evaluation under GDPR's transparency and purpose limitation principles....
-
X
· X Privacy Policy
This provision states that X receives browser cookie IDs, device IDs, hashed email addresses, demographic data, and behavioral data from ad partners, and may collect similar data directly from advertiser websites and apps via integrated advertising technology; this data may be combined with user-provided and platform-collected data....
Why it matters: This clause establishes that X's data collection extends to off-platform behavioral data sourced from advertiser websites and apps, and that this data is combined with on-platform data to build user profiles for advertising purposes. The scope of this data combination is relevant to GDPR's transparency requirements and CCPA's disclosure obligations for data collected from third-party sources....
-
X
· X Privacy Policy
This provision states that X may retain the email address, phone number, or other account creation identifiers of users whose accounts are suspended for policy violations for an indefinite period....
Why it matters: This clause authorizes indefinite retention of personal identifiers following account suspension, which may require evaluation under GDPR's data minimization and storage limitation principles and CCPA's retention disclosure requirements. The provision does not define a maximum retention period or a process for challenging or limiting this retention....
-
X
· X Privacy Policy
This provision states that X relies on SCCs and participates in the EU-US, Swiss-US, and UK Extension Data Privacy Frameworks to legitimize cross-border personal data transfers, and that disputes about DPF adherence are resolved through X's internal process, then JAMS, and then DPF arbitration....
Why it matters: This clause establishes the legal mechanisms X relies on for transferring personal data from the EU, EEA, Switzerland, and the UK to the US and other countries. DPF participation subjects X to FTC investigatory and enforcement authority and creates a specific dispute resolution pathway for EU, Swiss, and UK users that is distinct from general GDPR supervisory authority channels....
-
X
· X Privacy Policy
This provision states that account deletion is processed as a deactivation followed by a data deletion queue, with a 30-day window during which the account can be restored before deletion is finalized....
Why it matters: This clause establishes that data deletion is not immediate upon account deactivation and that a 30-day restoration period precedes final deletion. Users and compliance teams should account for this delay when processing data subject deletion requests under GDPR or CCPA....
-
X
· X Privacy Policy
This provision states that X may revise the Privacy Policy at any time, and that notice and an opportunity to review are provided only for changes that X itself determines to be material....
Why it matters: This clause reserves to X the determination of whether a policy change is material enough to require user notice. Changes not deemed material by X may take effect without proactive notification, which has implications for user awareness and consent under GDPR and CCPA....
-
X
· X Privacy Policy
This provision states that X's services are not directed to users under 13, that X does not knowingly collect personal information from children under 13, and that accounts found to belong to children under 13 are terminated and their data removed....
Why it matters: This clause establishes X's stated COPPA compliance posture and discloses the remediation process for underage account discovery. The policy also references country-specific consent ages, acknowledging that in some jurisdictions parental consent is required for users above 13 but below the local age of digital consent....
-
X
· X Privacy Policy
This provision states that X may use collected user information and publicly available information to train its own machine learning and AI models, limited to the purposes described elsewhere in the policy....
Why it matters: This clause discloses that user data collected through platform use, combined with publicly available information, may be used as training data for X's internal AI and machine learning systems. The scope is stated to be limited to purposes outlined in the policy, though the policy describes a broad range of purposes including service operation, personalization, safety, research, and advertising....