At the start of this month, President Trump announced that the US would “close down” TikTok on September 15 unless it was acquired. Data privacy and security concerns have always shrouded the app, and a new report reveals one particular loophole that TikTok exploited on Android to collect MAC addresses.
The Wall Street Journal today detailed how TikTok for Android “collected MAC addresses for at least 15 months, ending with an update released Nov. 18 of last year.”
In 2015, Google prohibited Android apps distributed through the Play Store from connecting “personally-identifiable information or associated with any persistent device identifier.” This includes MAC addresses and IMEIs.
However, TikTok leveraged a workaround that the WSJ describes as being “circuitous.” That identifier, a device’s advertising ID, and other data are sent to ByteDance the first time you open the app — before users can provide any consent. While the ad ID can be reset, there’s no real benefit if any new ones can be associated with an existing MAC address.
The MAC address is useful to advertising-driven apps because it can’t be reset or altered, allowing app makers and third-party analytics firms to build profiles of consumer behavior that persist through any privacy measure short of the owner getting a new phone.
The company said that the “current version of TikTok does not collect MAC addresses” but otherwise did not comment on its past practices. Meanwhile, Google said it’s examining today’s report.
FTC: We use income earning auto affiliate links. More.