The TikTok challenge

Banning the app hasn't really worked in India. It's unclear if the partial ban in the UK will. Perhaps the solution lies in creating an alternative

New technology tends to lead to some unpredictable outcomes. Take TikToK (TT). Who would have thought an app that allowed users to make 15-second videos would have turned into a security risk that led to multiple governments frothing at the mouth?

Consider the tech trajectory that led to TT. In the early 2000s, Steve Jobs launched the smartphone, and Mark Zuckerberg launched Facebook. Then Twitter and Instagram got going. YouTube and visual social media became a big thing. Plus location services became available. The selfie culture led to multiple high-end cameras being attached to smartphones.

Add young populations with lots of creativity and a healthy dose of narcissism. Something like TikTok was inevitable. Multiple apps with similar features were released around the same time. TikTok beat out the rest because it had the best interface. It was the beneficiary of network effects, once it rapidly picked up a following. There are also multiple ways for content creators to monetise TT.

The issue is massive data leaks — this is a feature, not a bug. TT asks for multiple permissions. It tracks pretty much every activity wherever it’s installed. That data is aggregated in its servers. It is no exaggeration to say the life of a TT user is an open book to anybody with access to that data. You know where the user is, what the user does, their friends, interests and maybe their sensitive personal banking data too. If TT is used by military and law-enforcement personnel, and by “spooks”, (and it is), that’s a huge security risk.

If it’s used by policymakers (and it is), that’s also bad.

But that’s the back-end. Most people are not tech-savvy enough to care about bleeding their personal data. Very few cellphone users even bother to read the end-user license agreement, or check the permissions list for a given app. 

The front-end delivers a very popular service, with a user-friendly interface. It is literally possible for a 70-year-old with zero tech-savvy to get onto TT and start posting content and browsing within 10 minutes of installation. This is why TT has caught on like wildfire.

The owner, ByteDance, is a Chinese company. China has a “Sarkar takes all” law when it comes to data stored on Chinese servers. Indeed, China’s National Intelligence Law could arguably be used to collect data even from ByteDance servers based in Singapore if it’s useful for “state intelligence”.  This is very similar to every iteration of India’s Draft Privacy Bill. Nor are there any guarantees that prior data collected will be deleted, even if TT changes its data collection policy.

India banned TikTok in mid-2020 but by that time, there were at least 200 million active desi users and a thriving TT ecosystem. Kids were making money posting about marriages, birthday parties, or just funny stuff. While the ban impacted the livelihoods of content creators, Indians didn’t stop using TT. Anecdotally, TT ranks alongside Pornhub as the two biggest drivers for Indians learning the skills required to circumvent Internet blocks. Three years later, new TikTok content generated in India continues to be passed around on WhatsApp, and is freely available even to non-users.

The Ukraine war highlighted some of the more obvious dangers of casually using social media, and indeed, using cellphones. It’s easy to get a lock on user-location and shell it. But much of the danger is more insidious.

The India ban hasn’t really worked, except in terms of driving content creators underground. It’s unclear if the partial ban in the UK, on public servants using TT, has been much use. The US is trying to force TT to change its ways via Project Texas but that is a band-aid. It’s also unclear if US lawmakers will be able to bulldoze ByteDance into selling TT, given the Chinese government’s resistance.

One solution I can think of: Create an alternative with similar features and a decent user-interface. Locate it in the EU with its best-of-class privacy protection via the General Data Protection Regulation. Duplicating the network effects will be hard. But a billionaire with that game plan could see this as a potential opportunity.