Dear Reader,

The House has passed a bill that would force social media app TikTok’s parent company, ByteDance, to divest its foreign ownership within six months or be banned in the United States. The bill now awaits its fate in the Senate. Legislators, following a closed-door briefing with intelligence community officials, say TikTok’s foreign ownership is a national security threat that must be addressed immediately. With over 150 million American users, it’s fair to ask whether this is too drastic a step to take in the name of national security – what, exactly, are the threats TikTok poses?

To unpack this question, we first need to understand the scope and scale of the data collected by TikTok. Like other social media platforms, TikTok accesses a user’s messages, images, video content, contacts, location, and other personal data. But TikTok goes even further: Its terms of service explicitly note that it collects information about a user’s behavior beyond the app itself, like information about your device and how you use it, including “app and file names and types, keystroke patterns or rhythms, battery state, audio settings and connected audio devices,” and also connects information about you with “information collected from devices other than those you use to log-in to the Platform.” Perhaps most alarmingly (writing as a person who doesn’t use TikTok), the company collects data on people who don’t even use the app through trackers called “pixels” that are part of the code on various websites and that load on to your browsers when you use those sites.

But why can’t we have nice things? Perhaps that‘s just the price we pay for being able to watch lip-synced dance memes. After all, we turn a lot of this same information over to all kinds of companies every day. The problem with TikTok is that ByteDance is a Chinese company, which means there’s a good chance this data is being funneled right into the hands of the Chinese government. And while it might not seem like a big difference from an individual user’s perspective, the ability of a foreign adversary to collect data on half of the United States’ population generates far greater national security risks than when that same data is handed over to advertisers, as is the case with U.S.-owned social media platforms (which, don’t get me wrong, is also not great, but a different problem). These risks can be broadly placed into three categories: foreign influence operations, espionage, and malign cyber activity.