Face and voice recognition: Why TikTok wants to be allowed to collect biometric data in the USA

TikTok's privacy policy for the US now mentions the collection of biometric data from faces and voices. The background is likely to be a legal dispute that cost the company $92 million.

Neue Datenschutzbestimmungen sind oft eher etwas für Juristen, doch die jüngste Aktualisierung von TikTok sollte alle Nutzerinnen und Nutzer in den USA aufhorchen lassen. Denn in den am 2. Juni aktualisierten Datenschutzbestimmungen für die USA ist ein Abschnitt enthalten, den es zuvor nicht gab. Er lautet übersetzt: »Wir sammeln möglicherweise biometrische Identifikationsmerkmale und biometrische Informationen, wie sie im US-Recht definiert sind, wie etwa von deinem Gesicht und deiner Stimme, aus deinen Inhalten.« Im englischsprachigen Original ist von »faceprint« und »voiceprint« die Rede. »Bevor wir damit anfangen«, frage man jedoch nach dem Einverständnis, wenn dies gesetzlich nötig sei, fügte noch TikTok hinzu.

In response to an initial inquiry from "TechCrunch" about the background for this change and TikTok's plans, the company could not or would not initially say what it plans to do with such data. "As part of our ongoing effort to be transparent, we recently updated our privacy policy to make it clearer what information we may collect," "TechCrunch" quoted a spokesperson as saying.

The background is likely to be a class action lawsuit that ended with a $92 million settlement and involved TikTok's violations of the Illinois Biometric Information Privacy Act. The lawsuit involved more than 20 cases in which TikTok allegedly collected and shared biometric data without obtaining the permission of those affected - apparently also for a facial filter for special effects in the app.

Admittedly, the new paragraph of the guidelines does not specify which US laws are meant, what TikTok might need the biometric data for, and what exactly the terms "faceprint" and "voiceprint" are supposed to cover. It also remains unclear how the relevant consent is to be obtained. Nevertheless, it is likely that TikTok already wants to protect itself a little better from further lawsuits in Illinois with the wording. The settlement states that TikTok is committed to no longer collecting biometric data unless it is explicitly in its privacy policy and meets all legal requirements.

In TikTok's privacy policy for the European region, the biometrics section does not exist and is not planned, as a spokeswoman told SPIEGEL: "At this time, no updates have been made to our EU privacy policy. We periodically review and update our privacy policies to best reflect our current practices based on market, regional and legal requirements."

The rest of the relevant paragraph in the U.S. regulations also has no equivalent in the version for Europe. It says TikTok may want to collect what body parts, objects and backgrounds are seen in a video, what sounds are heard and what text is spoken. This is done, among other things, in order to offer special effects, for the moderation of videos, and for content and advertising recommendations.