Photo: AFP / Jaap Arriens
Explainer - Though delayed, the threat of a TikTok ban remains in the United States.
For years, lawmakers and regulators have been concerned about Beijing's influence over the famously addictive app. But TikTok has denied its data or algorithms can be accessed or manipulated by the Chinese government.
In April 2024, Congress passed legislation to ban the social media platform, owned by Chinese company ByteDance, unless it was sold to a government-approved buyer before 19 January.
President Donald Trump, who took office on 20 January, signed an executive order giving the company a 75-day reprieve.
The app already faces restrictions in other countries.
Most notably India, reported to be the app's biggest overseas market at the time, banned it in 2020, after a border clash with China. The ban was made permanent in January 2021.
New Zealand, Canada, Australia, Britain, and the European Union have prohibited the app on government devices.
While some argue the US' ongoing concerns warrant New Zealand treating TikTok as a more serious, national threat, others say the ban is less about security and more about geopolitics.
New Zealand's response
Numerous Western nations, New Zealand included, have expressed concerns the Chinese government could access sensitive user data via TikTok and ByteDance.
They have pointed to laws that allow the Chinese government to demand data from Chinese companies and citizens. They are also worried about the app being used to spread propaganda.
Regardless of where an app user is located, their data is subject to the legal and privacy requirements of the company's location.
"In the case of TikTok, this includes the Peoples Republic of China, whose national security laws mean the [government] can require data to be provided to them by private companies, even where they operate outside of the jurisdiction," a spokesperson for the GCSB's National Cyber Security Centre told RNZ.
The GCSB doesn't have the authority to ban specific software from operating in New Zealand. But it offers advice to government agencies on managing social media apps, based on independent analysis.
In March 2023, New Zealand's Parliamentary Service announced TikTok would be removed from all devices with access to the Parliamentary network.
The agency's deputy chief executive of corporate solutions, Amy Brier, confirmed the ban remains in place, "due to ongoing privacy and security concerns".
Apps are "regularly reviewed" to ensure they comply with security and privacy standards, she said. TikTok is the only app banned on Parliament devices for these reasons.
"The decision was made following advice from cybersecurity experts and in consultation with other government agencies and international counterparts."
Since 2020, TikTok has sought to join the Christchurch Call, an initiative launched in 2019 to mitigate terrorist and violent extremist content online, in response to the Christchurch terrorist attack. The attack that killed 51 people was livestreamed on Facebook.
The Call comprises 55 national governments and the European Commission, and 19 online service providers, with Microsoft, Google, Amazon, and Meta among them.
Christchurch Call Foundation chief engagement officer Ellen Read told RNZ there was a standard onboarding process for supporters and partners: "This involves scrutiny by the Call Community over the compatibility of any applicant and their ability to uphold and deliver on the principles and commitments of the Call.
"We don't comment on this process for any potential applicant. If a new supporter or partner joins, we announce that."
What about other social media platforms?
Of course, TikTok isn't the only social media platform collecting vast swaths of user data - and not just names and addresses, but so-called pattern-of-life data revealing the habits and behaviours of individuals and populations.
"Meta is also doing this stuff," former Labour government minister responsible for the GCSB, Andrew Little, told RNZ.
"But Meta isn't a nation-state with obligations to provide security for its people. It's a corporation. It's commercial."
There are "checks and balances" preventing ready access by the US government to Meta-held data, Little added.
"The critical thing here is the obligation for Chinese corporates to comply with security agencies' requests [for data], - requests that aren't subject to any oversight and scrutiny."
And how could that data be used to the detriment of New Zealanders?
China could gain insight into large events and - "this is speculative" - cause disruption by targeting a power grid, he explained.
"Or, if they are renegotiating a free-trade agreement, they understand what's important to us, what's less important, through behaviour analysis, market analysis."
In short: "The question is what they know about countries and people in them, and how that helps [China] conduct itself."
When asked whether it's likely or unlikely the Chinese Communist Party has accessed New Zealanders' data via TikTok, Little replied: "Highly probable."
Paul Buchanan, former intelligence worker and director of the 36th Parallel Assessments risk and strategic assessment consultancy, said New Zealand has historically had a reputation as a "weak link" in the world's most far-reaching spy group, Five Eyes, owing to the country's poor cyber security.
Meaning New Zealand TikTok users could be a "primary target" of data collection for Chinese intelligence-gathering purposes, he said.
"The issue is not the wholesale acquisition of personal data per se, but to what ends it is being used."
TikTok denies security risk
Independent technology expert Allyn Robins said there's no evidence TikTok's data collection and handling is "meaningfully different" to any other comparable social media company, "besides the fact that they're a Chinese company that stores a lot of data in China".
TikTok has said US user data is housed on servers controlled by Texas-based Oracle.
"They've been under immense scrutiny and as such I think if there were proof TikTok was doing anything unusually nefarious with the data it collected, we'd have seen it by now," Robins said.
A TikTok spokesperson told RNZ: "Data security is of the highest importance to TikTok, and there is zero evidence suggesting that TikTok is a national security risk to New Zealanders.
"TikTok is used by many politicians, including Prime Minister Luxon, to reach, engage, and communicate with their constituents."
About the Christchurch Call, they said: "Tech companies working together to stamp out violent extremism on their platforms is incredibly important, which is why, alongside our close and collaborative relationship with the Department of Internal Affairs, we are also members of Tech Against Terrorism and have been engaging with the Christchurch Call for some time."
Launched by the United Nations in 2016, Tech Against Terrorism, according to its website, works with the public and private sector to develop ideas and capabilities to "effectively disrupt terrorist activity online".
TikTok joined in September 2022.
Last year, TikTok chief executive officer Shou Zi Chew vowed to fight the US ban and urged users to speak up for their rights. In a video, he said: "This legislation [...] will also take billions of dollars out of the pockets of creators and small businesses."
TikTok has an estimated 1 billion users worldwide and more than 170 million in the US.
It contributed US$24.2 billion to US Gross Domestic Product in 2023, according to a company-paid report. The report, by economics consultancy Oxford Economics, found TikTok supported more than 224,000 jobs in the US.
Chew, a Singaporean, has previously said ByteDance was not "an agent of China or any other country".
Officials in Beijing have also blasted the US ban.
What's next?
ByteDance has previously said it can't sell the app, in part because the Chinese government wouldn't allow the export of its crucial algorithm.
Meanwhile, Trump has told reporters there has been "a lot of interest", from potential buyers such as Microsoft, Oracle, and Elon Musk.
Regardless of what happens to TikTok in the US, the privacy and security risks posed by all social media platforms are only going to grow.
Dr Andrew Lensen, a senior lecturer in artificial intelligence at Te Herenga Waka - Victoria University of Wellington, said New Zealand's cultural and political alliance with the US makes us more comfortable with its use of our data.
This could be a mistake.
"These private companies are becoming more powerful. Their market caps in some cases are getting to the size of large nations. Just because they're not a state actor, doesn't mean they can't have similar influence."
There's no guarantee the checks and balances preventing easy private and public data-sharing in the US will remain intact long-term, he added.
"We saw the tech bros with front-row seats at Trump's inauguration."
And even if New Zealand had stronger privacy laws, "it's not obvious how we'd force large, international companies to comply with those".
"It's hard to see what we as New Zealanders can do, outside of coming to a social awareness, or social consensus to not use these tools. And that's easier said than done."
A Privacy Amendment Bill is currently making its way through Parliament, with an aim to improve transparency for people about their personal information. But, Privacy Commissioner Michael Webster said much more needs to be done to ensure the Act is fit for the digital age.
While TikTok, like all organisations doing business in New Zealand, remains subject to the Act, the Office of the Privacy Commissioner doesn't have the ability to audit its compliance outside an active investigation or inquiry. (And it's not currently investigating TikTok or any other online social media provider.)
"This is a known gap in our compliance tool kit," Webster said.
"This gap becomes more critical as new technologies make it increasingly difficult for consumers to know how their information is being used."
