TikTok users across the United States are sounding the alarm after an in-app message notified them about updates to the app’s privacy policy tied to TikTok’s new U.S. ownership structure. The alert sent many people digging through the revised document for the first time, and what they found sparked a wave of anxiety: language explaining that TikTok may process “sensitive information,” including details related to “sexual life or sexual orientation, status as transgender or nonbinary, citizenship or immigration status,” along with other personal categories.
On social media, some users interpreted the wording as a sign that TikTok is newly collecting highly personal data about them, or that the platform is preparing to share it in ways that could put them at risk. A number of posts warn others to delete the app or stop using it altogether. Given the cultural and political tension around privacy, surveillance, immigration, and civil rights, it’s not hard to see why this kind of phrasing would hit a nerve.
But there’s an important detail getting lost in the panic: this disclosure is not new, and it doesn’t automatically mean TikTok is actively asking users for their immigration status, sexual orientation, or other deeply personal identifiers as part of normal app use. The same categories appeared in TikTok’s earlier privacy policy as well, before the ownership deal closed. What changed is that many people are only now noticing the language because the policy update was pushed directly to them through the app as part of setting terms under a new legal entity.
Why the policy spells out sensitive information in such blunt detail comes down largely to U.S. state privacy laws. Regulations like California’s Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) require companies to tell consumers when they collect and use “sensitive personal information,” and to explain how that information may be handled. Under these laws, “sensitive” can include items such as government identification numbers, account logins and financial credentials, precise geolocation data, union membership, the contents of certain communications, genetic and biometric identifiers, and personal data tied to health or sex life or sexual orientation.
In other words, the law pushes companies toward explicit disclosure. If a platform could potentially process content containing sensitive traits, it often lists those traits to meet legal notice requirements and to reduce legal exposure. California also expanded the scope of what counts as sensitive information in recent years; citizenship and immigration status were specifically added in 2023 when Governor Gavin Newsom signed AB-947.
This helps explain why the policy uses broad, sometimes unsettling categories. TikTok’s policy states it could process sensitive information from user content or from information users may share through surveys. That doesn’t necessarily mean TikTok is building a secret database of everyone’s private life. It can also mean something more straightforward: if a user posts a video discussing a health diagnosis, immigration experiences, religious beliefs, or LGBTQ+ identity, that sensitive information is now part of the content on the platform, and the platform is acknowledging that it may process that content while operating the service.
Legal experts note that companies include this kind of specificity not only for compliance, but also to protect themselves in a growing wave of privacy-related disputes. Plaintiffs’ attorneys have increasingly challenged tech companies over what they claim is the collection or processing of protected traits, and detailed disclosures can be part of a broader strategy to show transparency and meet statutory requirements.
Other major social media platforms also disclose processing of sensitive information, though the level of detail varies. Some keep their explanations general, while others provide more granular lists. Ironically, spelling everything out can sometimes create more fear and confusion for regular users, because these documents are often written with regulators, litigators, and compliance checklists in mind—not everyday readers.
Still, the timing of this update has amplified the reaction. Many Americans are already on edge about how personal data could be used in the current political climate, particularly as immigration enforcement has escalated and sparked protests and backlash in multiple places. Against that backdrop, any mention of “citizenship or immigration status” in a privacy policy can feel less like legal boilerplate and more like a threat—even if the text has been there for months.
The bigger reality is that social media always carries risk when people share intimate details publicly. Platforms collect large amounts of data by design, and governments can create legal pathways to access information. In a twist of irony, TikTok’s U.S. ownership restructuring was driven by concerns that Chinese laws could compel companies to assist state intelligence and data security efforts, raising alarms among U.S. lawmakers about surveillance and influence operations. Now, many users are less worried about foreign access and more worried about domestic monitoring and how personal data might be interpreted or used.
For users trying to make sense of the policy, the key takeaway is this: the scary list of “sensitive information” categories is best understood as a legal disclosure shaped by state privacy requirements, not necessarily a new plan to target or profile users. However, it’s also a reminder that anything shared on a social platform—especially in videos, captions, messages, or surveys—can become part of the data a company processes while running its service.
If you’re concerned, the practical approach is to be intentional about what you post, review your privacy settings, limit app permissions like precise location where possible, and think carefully before sharing details you wouldn’t want searchable, screenshot, or stored. The policy may read like a warning, but the larger lesson is one users have faced across social media for years: what you choose to share can carry consequences far beyond the moment it’s posted.
