Report: TikTok’s efforts to silo US data are ‘largely cosmetic’

Since 2022, TikTok has undertaken a massive, expensive effort to silo off its US operations — and American users’ data — from its Chinese parent company, ByteDance. TikTok has described the corporate restructuring, which it dubbed Project Texas, as “an unprecedented initiative dedicated to making every American on TikTok feel safe, with confidence that their data is secure and the platform is free from outside influence.” Several former employees, however, told Fortune that Project Texas is instead “largely cosmetic” and that they and their colleagues continued to work closely with Beijing-based ByteDance executives after the plan’s implementation.

One major aspect of Project Texas — so named because Oracle, TikTok’s “technology partner,” is headquartered in Austin — was transferring all US user data over to Oracle’s cloud infrastructure. (Per Texas Monthly, none of Oracle’s cloud data servers are actually in the state.) Under Project Texas’ terms, Americans’ data isn’t supposed to leave the US at all, nor can it be accessed by ByteDance employees in China. 

In practice, the data was less walled off than TikTok led users and politicians to believe, Fortune reports. Evan Turner, who worked at TikTok as a data scientist between April and September of 2022, described a “stealth chain of command” in which he was reassigned — on paper — to a manager in Seattle but continued reporting to executives in China. Every two weeks or so, Turner would email spreadsheets with data on hundreds of thousands of US users to ByteDance workers in Beijing, he told Fortune. The spreadsheets included users’ names, email addresses, IP addresses, and geographic and demographic information and was used to determine how to develop TikTok’s algorithm to encourage users to be more active on the app, he said.

Another former employee, Katie Puris, alleges that TikTok was never fully independent from ByteDance. Puris, TikTok’s former head of business marketing, sued the company for discrimination in February, claiming she was fired because her Beijing-based higher-ups didn’t consider her demure enough. Puris’ lawsuit, which is referenced in the Fortune report, claims that ByteDance executives began to exert more control over TikTok’s daily operations in 2020 and organized bimonthly meetings led by ByteDance’s chair. “Despite its attempts to appear independent, TikTok’s day-to-day management and business decisions came directly from ByteDance’s top-level management in China,” the suit claims.

These claims could add more fuel to Congress’ ongoing effort to get ByteDance to sell TikTok. In March, the House overwhelmingly voted to ban TikTok unless it breaks away from its parent company; the Senate has yet to take up the bill.

TikTok CEO Shou Zi Chew, for his part, has repeatedly emphasized the company’s independence from ByteDance. “The bottom line is this American data is stored on American soil by an American company overseen by American personnel,” Chew said in a 2023 appearance before Congress. 

In interviews with Fortune, other former employees described the concerns about TikTok’s connections to ByteDance as overblown and rooted in xenophobia. (During Chew’s most recent congressional hearing, for example, some members of Congress asked whether he was affiliated with the Chinese Communist Party. Chew is a citizen of Singapore.) One former manager said Project Texas and its European counterpart, Project Clover, made a “significant difference” in walling off Americans’ and Europeans’ data. “I can’t speak to leadership decisions, but in terms of the technology stack, there’s been a lot done to delineate them,” the former employee said. Jacob Wallach, who worked on TikTok’s global business solutions team from 2020 to 2022, said TikTok’s data collection practices are no less concerning than those of Meta, Google, or Amazon. 

Still, this isn’t the first report that suggests TikTok’s descriptions of Project Texas overstate the degree to which TikTok’s US operations are separate from those in China. Project Texas informally started rolling back some of its data-sharing rules in the spring of 2023, The Wall Street Journal reported in January. According to the Journal’s report, managers have instructed US-based workers to share data with colleagues elsewhere in the company — including with ByteDance employees. And in 2022, BuzzFeed News reported that ByteDance employees in China had repeatedly accessed US user data — though the report noted that most of these instances were actually in service of Project Texas’ goal of limiting the ability of Chinese ByteDance employees to access Americans’ data.

When asked for comment, TikTok spokesperson Michael Hughes directed The Verge to a long X post responding to Fortune’s report. “Everything cited in this article is based off of information prior to the set-up of [US Data Security, the Project Texas division] and relies on fabrications from individuals who had no access or insights into data privacy and security practices,” the X post reads.

Update April 16, 5:45PM ET: This piece has been updated with comment from TikTok.