Power

These ByteDance apps stored US user data in China – at least until they started to disappear

TikTok may keep U.S. user data out of China, but other ByteDance apps downloaded hundreds of thousands of times in the U.S. play by a different set of rules.

These ByteDance apps stored US user data in China – at least until they started to disappear

ByteDance has several apps with U.S. users that have been storing data in China, according to their privacy policies.

Getty Images

Over the last year, TikTok's leaders have repeatedly sworn both in court and in the court of public opinion that they don't share any U.S. user data with China, where their parent company, ByteDance, is based.

But the same can't be said for several other ByteDance apps, which also have a sizable audience in the United States and abroad.

While none is as popular in the U.S. as TikTok, a Protocol investigation found that some of ByteDance's most popular apps in China, including Xigua and Toutiao, appear to have been downloaded hundreds of thousands of times in the United States. And as their privacy policies clearly state — albeit in Chinese — all of the data collected from those apps is stored in China.

According to SensorTower estimates, Xigua, a YouTube-like video streaming app, has been downloaded some 296,000 times across the Apple App Store and the Google Play Store in the U.S., while Toutiao, a news aggregation app, has been installed at least 808,000 times from the two U.S. app stores.

SensorTower's data indicates those downloads ended abruptly the week of Oct. 5, suggesting both apps were removed from U.S. app stores around that time, just as the Trump administration was pressuring ByteDance to cut ties with TikTok and sell it to a U.S. company. On Oct. 11, SensorTower's data suggests the apps were also pulled from most app stores in Europe. Now, neither app is available on app stores in the U.S. or most of the E.U. Removing an app from stores, however, does not remove it from users' phones.

Another app, GoGoKid, disappeared from the U.S. Apple App Store Thursday after Protocol asked ByteDance about the app's privacy policy, which had stated data was stored in China.

ByteDance would not confirm the download numbers or provide any of its own. In a statement, a ByteDance spokesperson said: "Toutiao and Xigua are designed for the Chinese market and are only available in Chinese. Accordingly we made a business decision to discontinue offering them in markets like the US, rather than devoting additional resources to them."

The spokesperson did not answer direct questions from Protocol about whether those apps had been storing U.S. users' data in China, as their privacy policies indicate. The spokesperson also didn't answer a question about whether U.S. users who previously downloaded these apps would be able to receive security updates and patches now that they're no longer on the app stores.

The other ByteDance app, GoGoKid, matches teachers in the U.S. and Canada with Chinese students who want to learn English. The privacy policy for GoGoKid's U.S. teacher portal says only that data may be moved outside of the country. But for Canadian teachers, the policy stipulates that data may be transferred and processed "in jurisdictions where our affiliates or service providers are located, including Singapore, China and the United States."

The privacy policy for the U.S. iPad app for students, meanwhile, was different. As of Wednesday, it stated in Chinese, "We store your personal information collected within the territory of the People's Republic of China in accordance with the provisions of laws and regulations." It is no longer available in the U.S. App Store.

In response to questions about where GoGoKid's U.S. user data is stored, another ByteDance spokesperson said, "GoGoKid is focused on giving students in the Chinese market the opportunity to learn English, and it is only available for students in Chinese." That doesn't account for the many American and Canadian teachers on the platform who are also GoGoKid users. GoGoKid's own website features testimonials from several non-Chinese teachers.

The spokesperson downplayed the app's traction in the U.S., saying GoGoKid "has only been downloaded around 1,000 times in the U.S. market," but didn't specify whether that number referred to the student app, the teacher portal or both. Data on U.S. downloads of the app among teachers is hard to come by, and SensorTower doesn't track it, but one GoGoKid Teachers Facebook group alone has more than 5,000 members.

At no point did ByteDance deny that these apps stored U.S. user data in China.

These data storage arrangements for Xigua, Toutiao and GoGoKid raise questions about why ByteDance hasn't walled off U.S. user data for those apps in the same way it's done for TikTok. Neither the White House nor the Department of Commerce, which have both issued orders related to TikTok this year, responded to Protocol's request for comment.

In sworn testimony as part of TikTok's legal battles against the Trump administration this year, the company's chief security officer, Roland Cloutier, described at length the difference between TikTok's tech stack and that of its Chinese counterpart, Douyin. Cloutier wrote that the "source code and user data for TikTok are maintained separately from the source code and user data for Douyin (and other ByteDance products)." Cloutier went on to state that TikTok "would not comply with a request for U.S. user data from the Chinese government."

That argument, it seems, has been compelling in court, where TikTok has been winning case after case against the Trump administration's attempts to ban the app under the guise of a national security emergency. But while TikTok was carefully spinning off its own servers for U.S. users, ByteDance appears to have taken no such precautions with its other apps.

ByteDance's acquisition of the app that predated TikTok, called Musical.ly, was the subject of an investigation by the Committee on Foreign Investment in the United States, which vets foreign acquisitions of U.S. companies. But both Toutiao and Xigua are homegrown Chinese apps that just happen to have U.S. users, which would place them outside of the purview of CFIUS, said Shannon Reaves, special counsel at the law firm Stroock, who specializes in CFIUS reviews.

"The establishment of that entity and its operation is not subject to CFIUS review," Reaves said, adding, "[CFIUS] could certainly look at that to inform their views about the TikTok acquisition and what they think might happen with the data from TikTok."

The Trump administration was under no such constraints, however, and tried (unsuccessfully) to to ban all transactions with ByteDance through executive order. The order paid particular attention to TikTok, and a subsequent directive from the Commerce Department specifically prohibited TikTok (again, unsuccessfully) from operating in the U.S. after a certain date. But neither order made any mention of these apps.

There are differences of course, between TikTok and Xigua or Toutiao. For one thing, TikTok has tremendous scale in the U.S.; recent court filings revealed that the company has 100 million monthly active U.S. users. SensorTower's data suggests Toutiao and Xigua combined have only around 1 million users in the U.S. And while TikTok is clearly marketed directly to Americans, complete with a huge American staff, Xigua and Toutiao are delivered internationally in Chinese and seem entirely geared toward Chinese people and the Chinese diaspora. That may make these apps less of a target to U.S. regulators and politicians, but it doesn't make their U.S. users' data any more secure.

GoGoKid, on the other hand, is very clearly marketed to teachers in the U.S. and Canada. While some teachers expressed anxiety about President Trump's executive orders this fall, fearing it might interfere with income they made from GoGoKid, the teacher app is still available in the U.S.

The Federal Trade Commission recently ordered ByteDance and U.S. social media companies to hand over information about how they collect data from users. In response to a question about whether the FTC will be looking at ByteDance's other properties beyond TikTok, spokesperson Juliana Gruenwald said, "The orders focus on any and all social media and video streaming services" that these companies own, adding that the investigation will look into not just how data is collected, but also how and where it is stored.

Protocol | Enterprise

Meta thinks it can now use smaller data sets to flag Facebook content

Despite the constant deluge of content flowing into Facebook and Instagram, Meta has struggled to get enough data to train AI to spot harmful content, so it’s banking on an emerging approach.

Meta plans to announce that few-shot learning shows promise in its constant battle to weed out disinformation or other content that violates its policies on Facebook and Instagram.

Image: Meta

After a terrorist attack on a mosque in Christchurch, New Zealand was livestreamed on Facebook in 2019, its parent company, now called Meta, outfitted London police officers with body cams while they conducted terrorism training. At the time, Meta said there wasn’t enough video data to train its artificial intelligence systems to detect and remove violent content, so it hoped the body cam project would produce more of that scarce AI training data.

A year prior to that horrific incident, the company acknowledged that it failed to keep up with inflammatory posts from extremist groups in Myanmar. Again, it said the problem was a lack of data — there wasn’t enough content in Burmese to train algorithmic moderation systems to spot more of it.

Keep Reading Show less
Kate Kaye
Kate Kaye is an award-winning multimedia reporter digging deep and telling print, digital and audio stories. She covers AI and data for Protocol. Her reporting on AI and tech ethics issues has been published in OneZero, Fast Company, MIT Technology Review, CityLab, Ad Age and Digiday and heard on NPR. Kate is the creator of RedTailMedia.org and is the author of "Campaign ’08: A Turning Point for Digital Media," a book about how the 2008 presidential campaigns used digital media and data.

In a tight labor market, businesses are competing for top talent, even as employees leave in droves. A record 4.4 million Americans resigned in September 2021 — the highest on record for nearly 20 years — ushering in what some call the Great Resignation. That same month, 65% of U.S. workers said they were looking for a new job.

Business leaders have to respond to mitigate the negative impacts of this disruptive churn, with 36% of CFOs saying they're very concerned about turnover remaining high indefinitely and weighing on revenue growth. The answers to this challenge should be informed by the root causes of employee dissatisfaction as well as retention drivers.

Keep Reading Show less
Suneet Dua, PwC
As PwC’s US Products & Technology Chief Revenue and Growth Officer, Suneet Dua is responsible for driving more than $1 billion in product revenue and executing PwC’s product revenue strategy. He’s focused on driving innovation, delivering world-class, forward-thinking products and digitally upskilling the workforce and society at large. With 20+ years of technology, media and entertainment industry experience, he’s positioned as a catalyst for organizational transformation and delivers on the firm’s promise to solve the world’s most important problems. Additionally, he launched Salesforce and client-focused centers of excellence, such as our Cybersecurity centers in Israel, Singapore and India––all to improve the way PwC serves its clients. During his tenure as US Chief Product Leader, Suneet, and his team, played a critical role in designing and implementing digital tools that upskilled more than 55,000 of its US employees, which led to the development of PwC’s digital learning platform, ProEdge, that addresses the digital skills gap crisis facing today’s workforce. He also serves as a board member of PwC’s Trifecta Consulting (US, China, Japan and Mexico). Previously, Suneet served on PwC’s US leadership team and was Global Client Market Leader for PwC’s Global Network.
Protocol | Workplace

What will work look like in 2022? Glassdoor makes four predictions.

Tech companies will continue to have trouble hiring workers.

According to a report from Glassdoor, local companies will also have to pay more to compete with companies that are offering San Francisco or New York rates to remote workers.

Photo: MoMo Productions/Getty Images

2021 was a difficult but pivotal year for tech workers and employers alike. We’ve got mixed news: 2022 will likely continue to be difficult but perhaps a little more, well, precedented.

Glassdoor released four predictions for the workplace of 2022 Wednesday based on data it gathered from reviews, salaries and conversations happening on its site, as well as economic trend data. Here’s what the career platform sees in the workplace crystal ball.

Keep Reading Show less
Michelle Ma

Michelle Ma (@himichellema) is a reporter at Protocol, where she writes about management, leadership and workplace issues in tech. Previously, she was a news editor of live journalism and special coverage for The Wall Street Journal. Prior to that, she worked as a staff writer at Wirecutter. She can be reached at mma@protocol.com.

Protocol | Enterprise

COVID-19 kickstarted a war over web accessibility

The pandemic spurred demand for a more accessible web, but experts and practitioners disagree on the best approach to get there.

Experts and practitioners disagree on the best approach to building an accessible web.

Image: alexsl/Getty Images

The pandemic triggered a surge in demand for technology that helps companies adapt their websites for users with disabilities as businesses scrambled to accommodate customers who were now forced to do almost everything online.

This period gave a boost to companies such as AudioEye, EqualWeb and Deque, which offer accessibility services like alternative text that describes images for visually impaired users. But it also sparked a war over the best way to build a more accessible web, with one side arguing the fastest way to achieve change is to put accessible overlays onto existing sites, and the other arguing the web will never be truly accessible until developers build it that way from the start.

Keep Reading Show less
Aisha Counts

Aisha Counts (@aishacounts) is a reporting fellow at Protocol, based out of Los Angeles. Previously, she worked for Ernst & Young, where she researched and wrote about the future of work, emerging technologies and startups. She is a graduate of the University of Southern California, where she studied business and philosophy. She can be reached at acounts@protocol.com.

Hirsh Chitkara

Hirsh Chitkara (@ChitkaraHirsh) is a is a reporter at Protocol focused on the intersection of politics, technology and society. Before joining Protocol, he helped write a daily newsletter at Insider that covered all things Big Tech. He's based in New York and can be reached at hchitkara@protocol.com.

Latest Stories
Bulletins