TikTok's US user data was repeatedly accessed from China despite company denials

For years, TikTok executives insisted there was nothing to worry about. When concerns mounted about Chinese access to American user data, the company's leadership went on the record with reassurances that US information was protected and isolated from ByteDance operations in China. Those statements, it turned out, were false.

BuzzFeed News obtained leaked audio recordings from 80 internal TikTok meetings that documented something the company had spent considerable effort denying: US user data was being repeatedly accessed by engineers and staff operating from China. The meetings, which spanned multiple years, revealed a pattern of data access that contradicted every public statement the company had made about data security and geographic containment.

The specifics were damning. According to the Department of Justice's analysis of these materials, sensitive information including personally identifiable information was shared through Lark, an internal communication tool, and stored on servers physically located in China. ByteDance engineers had even constructed specialized scraping tools designed specifically to collect bulk data on American users—not random samples, but systematic harvesting of user information tied to politically sensitive topics like views on gun control, abortion, and religion.

This wasn't a minor data breach or an isolated incident of unauthorized access. The Wall Street Journal's subsequent reporting confirmed that managers had explicitly instructed workers to route data through unofficial channels, deliberately bypassing the company's stated security protocols. The instruction itself implied knowledge of wrongdoing—if the data transfers were legitimate, there would be no need to hide them.

TikTok's public response to these revelations followed a familiar corporate playbook. The company suggested the findings were being mischaracterized, that the data access was routine and necessary for business operations, and that American users' information was ultimately safe. But the gap between these statements and the reality documented in the leaked meetings was too large to credibly bridge. The audio recordings existed. The meetings had happened. The engineers had accessed the data.