Both iOS' App Store and Android's Google Play Store had in 2015 changed their policy to ban apps from collecting the MAC addresses of the users.
TikTok was collecting users’ data against Android’s rules, according to a new Wall Street Journal report. Short video platform TikTok was collecting the MAC addresses of its Android users for a period of 18 months, in what appears to be a clear violation of Android policies. These MAC addresses would have helped in identifying the device of each user, and this data could be valuable for advertising and also for possibly more invasive tracking.
Both iOS’ App Store and Android’s Google Play Store had in 2015 changed their policy to ban apps from collecting the MAC addresses of the users, but TikTok had managed to collect this data using a loophole. The report cites a study that showed that there were as many as 350 apps on Google Play Store which had also made use of a similar loophole and used it for targeted advertising purposes.
The practice is said to have been discontinued by the Chinese platform in November 2019, probably because of the increasing political pressure from the US.
The WSJ report has come at a time when TikTok is already standing at a delicate position, and is facing questions from the White House about the level at which its parent company, China-based ByteDance, has access to US user data. Apart from that, the US also recently issued an executive order cutting off all the transactions that the US has with TikTok, and the order is scheduled to come into force from September 20, unless TikTok manages to sell its US operations by then. So far, Microsoft has been in talks with TikTok, but it is not clear how far the negotiations have reached or where they are headed.
The findings have punctured a hole into TikTok’s main line of defence against the allegations made by the US. The Chinese company has been maintaining that it was not collecting any more data than the standard app. MAC addresses are mostly used for targeted advertising, but they are a more invasive form of tracking.