Driver’s licenses, addresses, photos: Inside how TikTok shares user data

In August 2021, TikTok received a complaint from a British user, who flagged that a man had been “exposing himself and playing with himself” on a livestream she hosted on the video app. She also described past abuse she had experienced.

To address the complaint, TikTok employees shared the incident on an internal messaging and collaboration tool called Lark, according to company documents obtained by The New York Times. The British woman’s personal data — including her photo, country of residence, Internet Protocol address, device and user IDs — were also posted on the platform, which is similar to Slack and Microsoft Teams.

Her information was just one piece of TikTok user data shared on Lark, which is used every day by thousands of employees of the app’s Chinese owner, ByteDance, including by those in China. According to the documents obtained by the Times, the driver’s licenses of American users were also accessible on the platform, as were some users’ potentially illegal content, such as child sexual abuse materials. In many cases, the information was available in Lark “groups” — essentially chat rooms of employees — with thousands of members.

The profusion of user data on Lark alarmed some TikTok employees, especially since ByteDance workers in China and elsewhere could easily see the material, according to internal reports and four current and former employees. Since at least July 2021, several security employees have warned ByteDance and TikTok executives about risks tied to the platform, according to the documents and the current and former workers.

“Should Beijing-based employees be owners of groups that contain secret” data of users, one TikTok employee asked in an internal report last July.

The user materials on Lark raise questions about TikTok’s data and privacy practices and show how intertwined it is with ByteDance, just as the video app faces mounting scrutiny over its potential security risks and ties to China. Last week, Montana’s governor signed a bill banning TikTok in the state as of Jan. 1. The app has also been prohibited at universities and government agencies and by the military.

TikTok has been under pressure for years to cordon off its U.S. operations because of concerns that it might provide data on American users to the Chinese authorities. To continue operating in the United States, TikTok last year submitted a plan to the Biden administration, called Project Texas, laying out how it would store American user information inside the country and wall off the data from ByteDance and TikTok employees outside the United States.

TikTok has downplayed the access that its China-based workers have to U.S. user data. In a congressional hearing in March, TikTok’s CEO, Shou Chew, said that such data was mainly used by engineers in China for “business purposes” and that the company had “rigorous data access protocols” for protecting users. He said much of the user information available to engineers was already public.

The internal reports and communications from Lark appear to contradict Chew’s statements. Lark data from TikTok was also stored on servers in China as of late last year, the four current and former employees said.

The documents seen by the Times included dozens of screenshots of reports, chat messages and employee comments on Lark, as well as video and audio of internal communications, spanning 2019 to 2022.

Alex Haurek, a TikTok spokesperson, called the documents seen by the Times “dated” and disputed that they contradicted Chew’s statements. He said they did not accurately depict “how we handle protected U.S. user data, nor the progress we’ve made under Project Texas.”