The Trump administration is closing in on a deal with the Chinese government to transfer TikTok into American hands. White House Press Secretary Karoline Leavitt told Fox News on Saturday that she was “100% confident that a deal is done,” and that the app’s data, privacy and algorithm would be controlled by American ownership.
The deal is the result of a bill that Congress passed last year, based on fears that China was collecting the user data of Americans and using the platform for surveillance and propaganda. But while many Americans are celebrating the deal as a victory for user privacy rights and national security, some cybersecurity experts still have concerns. They contend that TikTok’s new structure, based on the scant details that have emerged about the deal, could open up users to surveillance and influence not from China—but the American government itself.
[time-brightcove not-tgx=”true”]
“Giving the government more power to surveil its own people or to do large data collections is not a good thing,” says David Kennedy, a cybersecurity expert and the founder of TrustedSec and Binary Defense. “We’re just basically switching one government for another.”
Data security
While the deal has yet to be formalized, the White House laid out several details in a statement on Monday obtained by Bloomberg. At least 80% of TikTok U.S. will be American-owned, with a consortium of investors led by Oracle, Silver Lake, and Andreessen Horowitz. Trump said on Sunday that Rupert Murdoch and his son Lachlan would likely be involved. ByteDance, TikTok’s original Chinese parent company, would keep a minority stake. The data of 170 million U.S. users will be kept on Oracle servers in Texas.
Read More: What Users Should Know About the TikTok Deal
The location of TikTok’s data centers has been a major point of contention for years. Last year, the Department of Justice alleged that TikTok was storing sensitive U.S. customer data on Chinese servers. This would pose a problem if the Chinese government was then taking the data and using it to learn about the American public and build dossiers for blackmail or espionage.
TikTok has disputed the accusation that the government can access user data, and that it collects more data than other social media companies. In 2023, TikTok CEO Shou Chew testified before the U.S. Congress that “100 percent of U.S. user traffic is being routed to Oracle” and a U.S. TikTok subsidiary.
Cybersecurity experts say that Oracle’s oversight of consumer data under the new deal goes a long way in assuaging some concerns. “Now we have U.S. regulations helping to protect American data,” says Dave Chronister, the CEO of the cybersecurity company Parameter Security.
But Beijing has plenty of other ways to access American data, including buying it from data brokers. Samm Sacks, a senior fellow at New America who specializes in Chinese technology policy, points out that before the ban, TikTok was already in the process of strengthening data privacy through Project Texas. This initiative proposed protecting American user data in an American subsidiary managed on Oracle’s cloud, and conducting regular third-party audits of data privacy and security.
It is unclear how many of those proposals will be implemented into this new system. “All of that under Project Texas was quite robust: there was a separate source code inspection entity and separate cybersecurity firms that were involved,” says Sacks. “So I’d want to understand to what extent you have other independent vetting.”
Surveillance
The other main concern of ByteDance critics was with the company’s algorithm itself, and how China might be wielding it for propaganda. (A federal appeals court wrote in December that the U.S. government had provided no evidence of these claims.) In 2020, the Chinese government signaled the algorithm’s importance when they updated export control rules to cover sensitive technologies including TikTok’s personalized recommendation engine.
In this new deal, Oracle will also retrain a licensed version of ByteDance’s algorithm “from the ground up,” and “will operate, retrain, and continuously monitor the U.S. algorithm to ensure content is free from improper manipulation or surveillance,” the White House statement said.
While the White House statement says the new arrangement would completely strip any Chinese influence over the algorithm, it’s unclear whether that is technically feasible. And there have been conflicting reports about this transfer: One U.S. adviser told the Financial Times last week that “China keeps the algorithm.”
“The devil is in the details. If we’re able to modify it, that’s one thing,” says Chronister. “But if they’re allowing it to be exported and we use it as is, it doesn’t change anything. The cynical part of me says that China is okay with it because the algorithm isn’t going to change.”
Some cybersecurity experts worry that China will retain too much power under the new arrangement. Others, however, worry that the U.S. government will have the power to control this new licensed algorithm and view user data—raising its own set of concerns, since Trump himself could theoretically influence what content the platform elevates or buries.
Many of the leaders of this new consortium have close ties to President Trump: Oracle’s Larry Ellison has hosted fundraisers for the president, while former leaders at Andreessen Horowitz are now a part of the White House. Ellison’s son, David, now runs one of the biggest media companies in the world, Paramount Skydance, thanks to a recent merger approved by Trump’s FCC. In July, Trump claimed he struck a side deal which netted him $20 million worth of PSAs of his choosing on their networks. Paramount disputed the claim.
And the new rules stipulate that TikTok U.S.’s new board must have one member designated by the U.S. government. All of this makes it seem like the U.S. government will hold inordinate power over the decision-making at TikTok U.S. (Coincidentally or not, the White House just launched its own TikTok account last month.)
“If the government wants to ensure appropriate safeguards, then it should pass government standards or federal laws on social media companies, not have a specific government entity on the board itself,” Kennedy says. “That seems like a very bad separation of power and duty.”
Kennedy, a former hacker for the NSA, says that the U.S. government already uses social media all the time to surveil suspects, and worries that these close ties will make it even easier for the government to weaponize TikTok. “All that data out there itself is very easy for the government to obtain and then use against its own people,” he says.
Larry Ellison, for his part, has endorsed this vision of the future: At an Oracle meeting in 2024, he envisioned a new era of AI surveillance in which “we are constantly recording,” causing police and citizens to “be on their best behavior.”
Sacks also says that the deal should be examined in the larger context of U.S.-China trade relations. “Beijing knows that Trump really wanted to bring home a win,” she says. “I think there are now questions about what Beijing is looking to extract by greenlighting TikTok.”