The privacy policy everyone ignored for 17 months is suddenly front page news

So TikTok users logged in over the weekend to a fun little pop-up demanding they agree to new terms of service. And then they actually read them.

The privacy policy helpfully explains that TikTok may collect information you disclose about your “racial or ethnic origin, national origin, religious beliefs, mental or physical health diagnosis, sexual life or sexual orientation, status as transgender or nonbinary, citizenship or immigration status, or financial information.”

Trans status. Immigration status. Religious beliefs. Health diagnoses. All casually listed like items on a grocery receipt.

The reaction was immediate. People flooding Reddit asking “Have they always tracked citizenship??? Am I tweaking?”

Screenshots flying around showing the policy language. Users rage-deleting the app. The Wayback Machine actually crashed from too many people trying to fact-check at once. That’s the state of things – so many people simultaneously trying to verify whether a social media company is cataloging their immigration status that it broke the internet archive.

Here’s the twist nobody wanted: this language isn’t new. It’s been in the privacy policy since approximately August 2024. Eighteen months. Sitting there. Quietly collecting.

The forced pop-up didn’t add these provisions. It just made people actually look at what they’d already agreed to.

Which is somehow worse? Like finding out your roommate has been reading your diary for a year and a half, not that they just started today.

But while everyone’s freaking out about the old stuff they just noticed, there are actually new changes from 2025 that are arguably scarier – and those are getting buried in the discourse.

Until April 25, 2025, TikTok’s policy said they would notify users before handing their data over to law enforcement. Now?

They’ll tell you only “where required by law” – and even then, possibly after they’ve already handed everything over.

The timing shifted from “before disclosure” to “if disclosure occurs.”

That’s not a small edit. That’s the difference between “hey, the cops are asking for your stuff, you might want to get a lawyer” and “oh by the way, the government has your data now, good luck.”

They also added language allowing data sharing with “regulatory authorities, where relevant” – which is doing a lot of work in that sentence. Regulatory authorities could mean basically anyone with a government ID and a request form.

And here’s my favorite part: the old policy said TikTok “rejects data requests from law enforcement authorities.”

The new one says TikTok “may reject” such requests. May. The confidence just radiating off that word.

So what does this mean in practice?

Forbes asked TikTok directly whether they’ve shared or are sharing user data with DHS or ICE. TikTok declined to answer. Multiple times. They just… didn’t respond to the question.

Let me paint the picture. TikTok has over 200 million US users. Their policy now explicitly acknowledges they may process information about immigration status. They’ve removed the promise to warn users before giving data to the government. They won’t say whether they’re already cooperating with immigration enforcement. And this is all happening under a new ownership structure created in compliance with a Trump executive order, with the app desperate to stay in the administration’s good graces.

The new US TikTok joint venture is 80.1% owned by American investors now – Oracle, Silver Lake, and Abu Dhabi’s MGX each hold 15%. ByteDance keeps 19.9%. The stated mandate is to “secure U.S. user data” through “comprehensive data privacy and cybersecurity measures.”

Secure it from whom, exactly? Not from the US government, apparently, given the policy changes.

Someone on Reddit put it perfectly: “The fact that they’ve been doing this while no one noticed is the real wake-up call.”

For eighteen months, TikTok’s policy has said they can process information about whether you’re trans, undocumented, what religion you practice, what health conditions you have. Users agreed to this every time they opened the app. They just didn’t know it because they didn’t read the terms – which, let’s be honest, nobody reads.

Now they’re forced to click “Agree” on a pop-up that links to those terms, and suddenly everyone’s reading. And they don’t like what they’re finding. The app that became famous for dance videos and unhinged cooking content has been sitting on a potential surveillance goldmine the whole time.

The really dark thing is that this data collection isn’t even TikTok actively scanning government databases to find out your immigration status. It’s simpler than that. It’s just: did you ever make a video about being an immigrant? Did you answer a survey? Did you post about your transition? Your mental health? Your religion?

Content you created becomes data they can process. And that data can now be shared with regulatory authorities without you necessarily being told until after the fact. In a political climate where ICE is reportedly building out new social media intelligence programs.

So yeah. People are deleting TikTok.

The app gave them two options: agree or leave. A lot of them are choosing leave.

But here’s what kills me. The stuff everyone’s panicking about today has been there since August 2024. The stuff that actually changed in 2025 – the removal of user notification, the expansion of government data sharing, the softened language on rejecting requests – that’s getting lost in the noise.

The pop-up did its job too well. It made people read the old scary stuff so hard that they’re missing the new scary stuff.

SOURCES

https://www.tiktok.com/legal/page/us/privacy-policy/en

https://www.ibtimes.co.uk/what-us-tiktok-knows-about-you-updated-terms-highlight-collection-immigration-status-1773402

https://piunikaweb.com/2026/01/23/tiktok-immigration-status-sexual-orientation-data-policy/

M
https://tech.slashdot.org/story/25/10/21/2125252/tiktoks-new-policies-remove-promise-to-notify-users-before-government-data-disclosure