Montana’s TikTok ban a wake up call on data privacy

The response to Montana’s TikTok ban reveals lawmakers’ misconceptions about privacy and data security and hints at how they could get it right.

Montana, the first US state to ban TikTok, has picked a battle with the younger generation’s favourite app – a fight it is unlikely to win.

Montana’s new law, set to come into force on 1 January 2024, faces an uphill battle to lock TikTok out of the state.

The unprecedented move has sparked a range of concerns and reactions. While legal experts have questioned the constitutionality of the ban, young people took their revolt to the app posting videos mocking politicians for their lack of understanding of the app.

This has  caught the attention of more progressive politicians, such as US Congresswoman Alexandria Ocasio-Cortez, who publicly opposed the ban. Still, uncertainty lingers over whether such a ban can even be enforced.

As it stands, the law won’t target individual users. Instead, it will focus on entities that allow access to and downloads of TikTok within Montana state lines.

In other words, the onus would be on Apple and Google, which operate the app stores through which TikTok is downloaded, to limit access to the app. Non-compliance by these providers would attract hefty fines of up to USD$10,000 per day.

Storefronts like Apple’s App Store and Google Play store operate on a country rather than a state level. While they could potentially identify Montana-based users using their billing address, this would place an administrative burden on the app stores. Users could also  circumvent this by changing their address.

While apps can be removed from national digital storefronts (like how TikTok can’t be downloaded in India), the responsibility for blocking Montana residents from accessing TikTok falls with the platform itself, operated by its parent company Bytedance based in China.

However, to do so, TikTok would need to collect geolocation data to determine if someone is in Montana and block their access accordingly.

This creates a glaring irony because TikTok would need to collect more personal data, raising the very privacy concerns the law intended to address.

It is a situation where the solution introduces a new set of privacy issues.

Still, even if there are technical ways to enforce the ban, residents can use alternative strategies to circumvent it. For example, since users wouldn’t be punished for using the app, they could cross the state border to download and use it when they are back in Montana.

Alternatively, more tech-savvy users could bypass the ban using a VPN (virtual private network). VPNs are affordable and accessible, allowing users to make it appear like they are accessing a website, an app or a service from a different location, effectively bypassing local restrictions.

If Montana believes people won’t go to such lengths to keep using TikTok, they are in for a rude surprise. In particular, younger users have a strong attachment to the platform, the creators they follow, and the communities they have built.

Around 60 percent of TikTok’s users in the US are from Generation Z – those born in the late 1990s and early 2000s. The app also has a significant impact on e-commerce. As such, a sudden and arbitrary ban on the app would have economic consequences.

The global advertising revenue is projected to reach USD$ 15.2 billion in 2023. This comes with the whole ecosystem of full-time content creators relying on TikTok to reach their audience. A  ban would affect not only the users but also the livelihoods of those creators.

While Montana governor Greg Gianforte proclaims the law is to “protect Montanans’ personal and private data”, his frequent references to the Chinese Communist Party while justifying the ban suggest this is more of a geopolitical clash than a data security concern.

Following TikTok CEO Shou Zi Chew’s testimony before the US Congress and the strained US-China relations, the Republican governor is coming down harder on the Chinese-owned social media than his party ever did on Silicon Valley counterparts.

US legislators are indeed correct in expressing concerns about data security and social media platforms. In today’s digital age, when there is an ever-increasing amount of personal data collected about each of us, it is essential to prioritise privacy and data security.

However, by directing their ire on TikTok due to a broader geopolitical stoush, policymakers are missing out on more comprehensive action to address privacy and data concerns across the digital landscape adequately.

Recent data leaks in countries like Australia have highlighted the need for action across the digital landscape.

This means addressing privacy and data security on popular social media including TikTok, Facebook, Instagram, Twitter and others – but also all other websites and digital services collecting enormous amounts of personal data.

One starting point to consider addressing these concerns is developing a legislative framework mirroring the European Union’s General Data Protection Regulation (GDPR).

The GDPR is a set of rules designed to protect the personal data of individuals within the (EU). It establishes guidelines for how organisations handle and protect personal information, ultimately enhancing individuals’ control and rights over their data.

Since its introduction in 2016, GDPR has become a model for many countries worldwide, including the US state of California.

Australia, a few steps behind in this regard, may benefit from following the EU and implement robust privacy and data protection regulations. By doing so, users would have greater control over their data, including the ability to request data deletion and opt out of certain data collection practices.

These regulations would also require companies to be transparent about collecting, using, and storing personal data. This would ensure better protection for individuals’ data and foster trust between users and online platforms.

In addition to data regulations, it is also essential to prioritise data literacy among the population. This includes directing attention and investment towards data literacy programs, primarily targeting young people but accessible to everyone.

Unlocking data literacy allows individuals to understand better and appreciate the value of their private information.

These skills are imparted through data literacy programs, educating individuals on the potential consequences of sharing their data, protecting privacy, and responsibly engaging with digital platforms. Armed with this knowledge, people can better safeguard their privacy and mitigate potential risks.

While Montana’s efforts may not directly halt the popularity of TikTok, this event can hopefully be a wake-up call to introduce stronger and holistic privacy regulations and prioritise digital literacy initiatives. This would lay the foundations for building a more privacy-conscious and healthier digital ecosystem in the future.

Dr Milovan Savic is a Research Fellow at the Swinburne node of the ARC Centre of Excellence for Automated Decision-Making and Society (ADM+S).

Originally published under Creative Commons by 360info™.