Earlier this year, TikTok quietly changed its policies about when and how it would share data with governments.
As the company negotiated terms with the Trump Administration that would allow its app to continue operating in the U.S., it added language to its policies that covered data sharing not just with law enforcement, but also with “regulatory authorities, where relevant,” and weakened promises to inform users about government requests for their private data.
Now, TikTok has repeatedly declined to answer questions from Forbes about whether it has shared or is sharing private user information with the Department of Homeland Security (DHS) or its investigative arm, Immigrations and Customs Enforcement (ICE). The policy changes, combined with the company’s silence about them, leave open the possibility that it could do so if asked.
The Stored Communications Act limits the kinds of information that tech companies can disclose about their users’ communications without a court order, but DHS and ICE have nonetheless begun demanding data — including, in at least one case, “usernames, phone numbers, IP addresses, and other identifying information” — from platforms. The demands have come in the form of administrative subpoenas, which are signed by an ICE or DHS agent, but not a judge. Administrative subpoenas don’t carry the same legal burden as judicial ones, and companies can’t face legal consequences for ignoring them unless a judge orders them to comply. They also generally cannot prevent companies from communicating with users about requests for their information.
Historically, tech giants have tried to make sure their users have an opportunity to challenge demands for their private information in court. And in recent months, people challenging ICE subpoenas have had some success. Both Facebook and Instagram recently received subpoenas from ICE demanding information about the people behind anonymous accounts tracking and reporting on ICE agents’ identities and movements. The apps’ parent company, Meta, notified the users behind the accounts, and in at least one case the firm shared a redacted copy of a subpoena with a user. Both users then successfully challenged their subpoenas before judges, who told Meta not to hand over their data to the government without a court order. (In a previous life, I held content policy positions at Facebook and Spotify.)
One of the recent changes to TikTok’s policies, though, could make it harder for some people to challenge ICE subpoenas seeking their data. The change eliminates promise by the company to give notice to users before it turns over their data to the government. Without notice, a person whose data is being requested doesn’t have a chance to contest the subpoena.
Until April 25, 2025, TikTok’s website said, “It is our policy to notify TikTok users before disclosing their data to law enforcement.” But now, the company says only that it will tell users about requests for their data “where required by law,” rather than as a matter of policy. The new policy also says the company will tell people if it discloses their data, rather than before it discloses their data — a difference with stark consequences for anyone hoping to challenge and prevent a disclosure before it occurs.
The company did not respond to repeated questions about why it changed this policy language.
In most cases, federal law requires tech companies to notify you before they respond to an administrative subpoena for your data. But since it was implemented in 1986, that law has contained an exception that threatens to swallow the rule: the government can ask companies to delay notice to a person if there is reason to believe they might flee upon receiving it — and there is ample reason to believe that people sought by ICE might flee to avoid them. Moreover, in countries where notice is not built into the law, TikTok’s policy changes might have an even bigger impact than they do in the United States.
TikTok’s new policies also include new, softer language related to data requests. An FAQ answer that formerly read “Yes, TikTok rejects data requests from law enforcement authorities…” now says “TikTok may reject data requests….” (emphasis added). The policy also renamed a former subsection (formerly titled “reporting obligations”) to “Proactive reports obligations.” The subsection addresses situations where “TikTok may disclose user data without receiving a formal legal request (based on valid legal process).” The updated policy says examples of this type of disclosure “include reporting suspected child exploitation to the U.S. National Center for Missing and Exploited Children,” something that TikTok has done hundreds of thousands of times, and that all tech companies do. It lists “reporting suspicious financial transactions to relevant authorities” as a second example.
The company did not respond to a question about why it changed the policy.
The Trump Administration has tried to exert leverage over many companies since the beginning of Trump’s second term, but his control over TikTok is unique. The White House is working with Chinese Communist Party leader Xi Jinping to negotiate a sale of parts of TikTok’s U.S. business to a group of mostly U.S.-based investors, including noted Trump supporters Larry Ellison and Lachlan Murdoch and the Emirati investment firm MGX, and any deal is subject to both Xi’s and Trump’s approval. Moreover, under U.S. law, TikTok should be banned in the United States. The only reason it’s online is because Trump has issued multiple executive orders instructing the Department of Justice not to enforce the ban law — a decision he could still reverse, if he has a change of heart.
In January, facing imminent enforcement of the ban law, TikTok briefly flickered its service off and back on in the U.S., blasting out notifications to its 170 million American users that thanked and praised Trump for helping the app come back online. In the days before the flicker, TikTok CEO Shou Zi Chew praised Trump, calling him “a president who truly understands our platform.” Along with other big tech CEOs, Chew joined Trump at his inauguration in January and sponsored an inauguration party for the president’s supporters.
TikTok isn’t the only major tech company bending to the will of the Trump White House. Shortly after Trump’s second electoral victory, both Meta and Google opted to pay eight-figure settlements in response to lawsuits of questionable merit from the president. Under pressure from the Justice Department, Google and Apple both recently removed apps from their app stores that enabled people to report and track live sightings of ICE agents, and Meta removed a Facebook Page with a similar purpose (also upon a Justice Department request). In early August, Apple CEO Tim Cook presented Trump with a block of gold with a piece of iPhone glass in it and announced plans to create an “American Manufacturing Program”. The president had previously threatened to impose a 25% tariff on iPhones if Apple did not move its production for U.S. sales to the United States.
TikTok’s approach to government data requests recently landed it in trouble in Indonesia. Between August 25 and 30th, a wave of violent protests swept the country as citizens raised awareness about police brutality and lavish benefits for lawmakers, and some turned to TikTok to speak and organize. On the 30th, TikTok voluntarily disabled livestreaming in the country for several days because it didn’t want to contribute to flaring tensions — but after the protests subsided, the government demanded data from TikTok about people who were livestreaming before the suspension went into effect.
Initially, TikTok responded by telling the government that its internal policies prevented disclosure of the requested data. But it appeared to change its approach after the government suspended TikTok’s license to operate in the country.
Days after the suspension, the government announced that TikTok had shared the data that it had requested. The data was broad, including “everything from web-traffic patterns to suspected online gambling activity,” per Bloomberg. (The government insisted that it was anonymized, so it could not be used to track individuals.) Accordingly, the government un-suspended TikTok’s license. TikTok told Bloomberg it respected laws and regulations and wanted to “ensur[e] that our platform provides a safe and responsible experience for the community in Indonesia.”
www.forbes.com
