TikTok skirted a privacy safeguard in Google’s Android operating system to collect unique identifiers from millions of mobile devices, data that allows the app to track users online without allowing them to opt out, a Wall Street Journal analysis has found.
The tactic, which experts in mobile-phone security said was concealed through an unusual added layer of encryption, appears to have violated Google policies limiting how apps track people and wasn’t disclosed to TikTok users. TikTok ended the practice in November, the Journal’s testing showed.
The identifiers collected by TikTok, called MAC addresses, are most commonly used for advertising purposes. The White House has said it is worried that users’ data could be obtained by the Chinese government and used to build detailed dossiers on individuals for blackmail or espionage.
TikTok, which said earlier this year that its app collects less personal data than U.S. companies such as Facebook Inc. and Alphabet Inc.’s GOOG -1.05% Google, didn’t respond to detailed questions. In a statement, a spokesperson said the company is “committed to protecting the privacy and safety of the TikTok community. Like our peers, we constantly update our app to keep up with evolving security challenges.”
The company said “the current version of TikTok does not collect MAC addresses.”
Most major mobile apps collect a range of data on users, practices that privacy advocates have long found alarming but that tech companies defend as providing highly customized experiences and targeted advertising. Data collection varies by company.
About 1% of Android apps collect MAC addresses, according to a 2018 study by AppCensus, a mobile-app analysis firm that consults with companies on their privacy practices.
A Google spokesperson said the company was investigating the Journal’s findings and declined to comment on the loophole allowing some apps to collect MAC addresses.
The issue involves a 12-digit “media access control,” or MAC, address, which is a unique number found in all internet-ready electronics, including mobile devices.
The MAC address is useful to advertising-driven apps because it can’t be reset or altered, allowing app makers and third-party analytics firms to build profiles of consumer behavior that persist through any privacy measure short of the owner getting a new phone. The Federal Trade Commission has said MAC addresses are considered personally identifiable information under the Children’s Online Privacy Protection Act.
“It’s a way of enabling long-term tracking of users without any ability to opt-out,” said Joel Reardon, an assistant professor at the University of Calgary and co-founder of AppCensus, Inc. “I don’t see another reason to collect it.”
Apple Inc. locked down iPhone MAC addresses in 2013, preventing third-party apps from reading the identifier. Google did the same two years later in Android. TikTok bypassed that restriction on Android by using a workaround that allows apps to get MAC addresses through a more circuitous route, the Journal’s testing showed.
The security hole is widely known, if seldom used, Mr. Reardon said. He filed a formal bug report about the issue with Google last June after discovering the latest version of Android still didn’t close the loophole. “I was shocked that it was still exploitable,” he said.
Mr. Reardon’s report was about the loophole in general, not specific to TikTok. He said that when he filed his bug report, the company told him it already had a similar report on file. Google declined to comment.
TikTok collected MAC addresses for at least 15 months, ending with an update released Nov. 18 of last year, as ByteDance was falling under intense scrutiny in Washington, the Journal’s testing showed.
TikTok bundled the MAC address with other device data and sent it to ByteDance when the app was first installed and opened on a new device. That bundle also included the device’s advertising ID, a 32-digit number intended to allow advertisers to track consumer behavior while giving the user some measure of anonymity and control over their information.
Privacy-conscious users can reset the advertising ID from the settings menu of the device, an action roughly equivalent to clearing cookies in a browser.
Google’s Play Store policies warn developers that the “advertising identifier must not be connected to personally-identifiable information or associated with any persistent device identifier,” including the MAC address, “without explicit consent of the user.”
Storing the unchangeable MAC address would allow ByteDance to connect the old advertising ID to the new one—a tactic known as “ID bridging”—that is prohibited on Google’s Play Store. “If you uninstall TikTok, reset the ad ID, reinstall TikTok and create a new account, that MAC address will be the same,” said Mr. Reardon. “Your ability to start with a clean slate is lost.”
Despite the prohibition, ID bridging is fairly widespread, according to AppCensus, particularly among free gaming apps. But it seldom involves the MAC address, the most persistent identifier accessible in the current version of Android.
In a random study by AppCensus of 25,152 popular internet-enabled Android apps in 2018, only 347, or 1.4%, were seen using the Android loophole to send the MAC address. Of those, only 90 were also transmitting the built-in Android ID, which changes if the device is reset.
The Journal’s analysis confirmed some of the behavior detailed in a widely-discussed anonymous Reddit post in April charging that TikTok transmitted a range of personal data to ByteDance servers, including the MAC address. Google said it’s investigating the claims in that post.
The Journal examined nine versions of TikTok released on the Play Store between April 2018 and January 2020. The Journal’s analysis was limited to examining what TikTok collects when freshly installed on a user’s device, before the user creates an account and accepts the app’s terms of service.
Apart from the MAC address, the Journal’s testing showed that TikTok wasn’t collecting an unusual amount of information for a mobile app, and it disclosed that collection in its privacy policy and in pop-ups requesting the user’s consent during installation.
Less typical are the measures ByteDance takes to conceal the data it captures. TikTok wraps most of the user data it transmits in an extra layer of custom encryption.
As with virtually all modern apps, TikTok’s Internet traffic is protected by the web’s standard encryption protocols, making it unlikely that an eavesdropper can steal information in transit. That makes the additional, custom encryption code TikTok applies to user data seemingly extraneous—unless it was added to prevent the device owner from seeing what TikTok was up to, said Nathan Good, a researcher at the International Digital Accountability Council, a watchdog group that analyzes app behavior.
“TikTok’s obfuscation of this data makes it harder to determine what it’s doing,” Mr. Good said. That added layer of encryption makes it harder for researchers to determine whether TikTok is honoring its privacy policy and various laws. He said he isn’t aware of a business purpose for the encryption.
“It doesn’t provide any extra level of Internet security,” agreed Mr. Reardon. “But it does mean that we have no transparency into what’s being sent out.”
It is common for mobile apps to hide parts of their software to prevent them from being copied by competitors, but TikTok’s encryption doesn’t appear to be hiding a proprietary secret, said Marc Rogers, vice president of cybersecurity strategy at Okta, Inc., which provides services that help users securely log in online.
“My guess is that the reason they do that is to bypass detection by Apple or Google because if Apple or Google saw them passing those identifiers back they would almost certainly reject the app,” Mr. Rogers said.
Google should remove TikTok from its platform, said Sen. Josh Hawley (R., Mo.), in a statement to the Journal, when apprised of the findings. Sen. Hawley has been critical of TikTok and a hawk toward China generally.
“Google needs to mind its store, and TikTok shouldn’t be on it,” he said. “If Google is telling users they won’t be tracked without their consent and knowingly allows apps like TikTok to break its rules by collecting persistent identifiers, potentially in violation of our children’s privacy laws, they’ve got some explaining to do.”
Some schools are reopening this fall. COVID-19 is still going around, so parents have a lot of questions about what this means for their kids, their families, and their extended families. Here’s our take on the top questions we’re hearing.
1. If my child returns to school, should I expect my child to contract COVID-19? If so, should I be scared about that?
Amy Anderson, RN, DNP: As a nurse and mother of four children, three of whom are school-aged and one in college, I understand the fear associated with reopening schools. It is possible that when our kids go back to school, some will contract COVID.
The good news is that children testing positive for COVID-19 are mostly asymptomatic or have mild illness compared to adults and almost all fully recover. Of course, as parents or guardians, it is our responsibility to assess our child’s own personal health risk and determine what is best for our family. If you are unsure about your child’s health risk, contact your medical provider. In my school district, parents can choose online school or in-person school.
Overall, I feel fairly comfortable with my kids going back to in-person school and participating in their normal school activities with reasonable safety measures.
Kevin Pham, M.D.: School-aged children are at low risk of both being infected and of infecting others. According to the Centers for Disease Control and Prevention, only 2% of confirmed cases are among those under 18 years of age.
Multiple studies from across the world have found consistently that children are at lower risk than adults of contracting the virus, and many nations that have not closed down their schools have found no evidence that children readily spread the virus to one another. Furthermore, school-aged children are at the lowest risk for developing severe disease, for hospitalization, and for mortality.
Children seem to be resistant to even being infected by the virus, but of children under 15 who do become infected, the mortality rate has been 0.3%. This 0.3% likely includes mostly children with underlying conditions that predispose them to severe disease, such as obesity, immunodeficiency syndromes, or heart or lung conditions, and interventions should focus on protecting these children.
The vast majority of students will be safe, especially if the schools implement at least basic precautions such as those outlined by the CDC.
2. Will my child have to wear a mask in school? How feasible is that all day for a 7-year-old?
Anderson: Having worked as a school nurse, I can tell you that masks are going to be a challenge, especially in some age groups.
Masks are probably unwarranted in younger children. For those required to wear masks, it is important that we talk through how to manage their mask during the day and the importance of not touching the mask and using hand sanitizer or hand-washing if they do. Schools likely will provide some mask and hand-washing instruction this fall.
Parents also should discuss with teachers and principals when students can take a break from the mask during the day. When students are able to social distance or are outside away from other kids, they should be able to take some breaks.
3. Should teachers wear masks?
Anderson: Masks should be worn by teachers when they are around other adults and when they are unable to maintain social distancing from their students.
Reports indicate teachers are more likely to catch the virus from other faculty and staff than from students, so enhanced instruction on when and how to wear masks and vigilance with mask-wearing and mask management should occur before school starts. This should help blunt the spread on campus.
4. Will COVID-19 vaccines be required to attend public schools once a vaccine is available? Should they be required?
Pham: Public schools already require a series of vaccinations to enroll, such as the measles, mumps, and rubella vaccine, or the pertussis vaccine. Schools can require vaccinations for attendance, and because COVID-19 has been the impetus for closing down parts of society, school districts likely will require a COVID-19 vaccine when one becomes available.
Anderson: Because of our lack of immunity to this novel virus and concern about widespread transmission to vulnerable groups, it’s likely states will require that students be vaccinated for school enrollment.
Because COVID-19 vaccinations will need to be prioritized during initial distribution and children seem to be at lower risk, certain age groups and those with no underlying health conditions may have to wait for the vaccine, and school requirements thus likely won’t take effect until all kids have access to the vaccine in their age group and location.
5. I have two children. If one contracts COVID-19, will the other child also have to stay home from school?
Pham: If someone in the household tests positive for COVID-19, the best practice would be to quarantine everyone for 14 days or until a diagnostic test returns negative. By the time people test positive, there is a good chance they already will have transmitted the virus to someone else, especially within the same household.
Anderson: Because close household contacts are the most likely way for children to contract the illness, students with a close family member with the virus will need to remain at home until cleared.
Parents should keep all their children home and contact the local district for direction if a close family member tests positive for COVID. Most schools have developed online or at-home options for classes and have a plan for how to handle the situation should the need arise.
6. Will there/should there be temperature checks every morning at school?
Pham: There may be, as a screening measure, but temperature checks may not always reveal an underlying case of COVID-19 and, especially with school-aged children, fever is not always a presenting symptom.
Temperature screens could be considered “better than nothing,” as they are generally cheap and easy to do, but they are unlikely to be helpful for purposes of COVID-19. Temperature checks may help find other illnesses, such as influenza or the cold.
Anderson: Some districts are using this as a screening measure, and student athletes may be asked to complete a screening questionnaire prior to participating in activities. This may not be a reliable or practical way to screen, given those who are pre-symptomatic or asymptomatic do not always have fever and not even all who test positive for COVID have a fever.
Parents or caregivers should monitor children daily for signs and symptoms of infection or a general feeling of unwellness and keep them home if there is any concern. School personnel will be watching for signs and symptoms of illness and immediately isolating and sending kids home if they suspect they are sick.
7. What school sanitation procedures do you recommend?
Pham: COVID-19 is thought to spread primarily through respiratory droplets, which can contaminate surfaces. If another person comes in contact with the contaminated surface, that person may become infected. That being the case, desks, chairs, and common surfaces such as doorknobs should be sanitized as frequently as feasible.
Anderson: Hand soap and hand sanitizer should be readily available. If feasible, students or teachers should wipe down surfaces between classes, and districts should increase cleaning procedures.
If a student, teacher, or staff member does contract the virus or there is an outbreak in a classroom, the school should implement the highest protocol for cleaning and sanitizing the areas that were directly encountered.
School districts most likely will consult the public health department in these circumstances, and parents should feel comfortable that appropriate measures will be implemented before students return to school.
8. Should schools be batching students (co-quarantining them) in small groups?
Anderson: When feasible, districts should consider having teachers move between classrooms instead of having students move throughout the building to reduce contact points. Maintaining smaller groups would allow for easier contact tracing.
Pham: To the extent possible, yes. Although students are at low risk of being infected or infecting others, it is still possible. Keeping classes together with less intermingling of different grades and classrooms would work to contain any possible spread.
9. Do you recommend schools hold class outside?
Anderson: Given weather and safety concerns, this may not be practical in many schools.
Opening windows where appropriate and providing good ventilation for classrooms is important. Taking breaks and occasionally going outside for class, weather permitting, improves learning and mental health.
Kids need physical activity and activities such as marching band and athletics should be quite safe to do outdoors when safety measures are in place.
Our kids have been cooped up for almost six months. Reopening is essential to improve the social-emotional well-being, mental health, and long-term trajectory of our kids and will return vulnerable kids to a safer environment during the day.
10. My family has an elderly grandparent living with us and COVID-19 presents a high risk to them. Should I send my kid to school? If so, how do I keep our elders safe?
Anderson: This is a difficult decision that many now have to make. Every family’s situation is different, and those who aren’t certain should consult with medical providers. Families should have the choice between in-person or remote learning for just this reason.
Our elderly are feeling more isolated and lonely during the pandemic as well. It has affected their quality of life, physical well-being, and mental health. There may be some creative ways to safely continue family interaction and keep the elder family member safe when kids return to school. There is just not a one-size-fits-all solution that will suit every family.
Pham: The science shows repeatedly that children are at extremely low risk for transmitting the virus to adults. One worldwide study found that outbreaks or clusters of COVID-19 were traced back to adults in more than 90% of cases.
That said, the risk to elder Americans is great. Even though most of the recent cases are among those less than 65, most hospitalizations and deaths have been among those 65 and older.
This means that school-aged children and most teachers are at low risk for hospitalizations and deaths, but families that have elders in the household should consider further safety measures. It would be reasonable for these families to continue distance learning or otherwise keep children away from schools where maintaining distance and isolation is difficult or impossible.
In short, children pose little risk to others, and that risk only decreases if the school or school district implements good safety precautions. But the risk will never be zero, and families will have to look at what the schools are planning and decide for themselves how to proceed.
Policymakers should look to support those choices. As my colleague Lindsey Burke has written, families who want in-person instruction should be able to take their child’s share of education funding to learning options of choice.
