TikTok Users Panic Over ‘Immigration Status’ Data — Here’s What the Policy Actually Says

TikTok users across the United States are expressing alarm after receiving an in-app notification about updates to the platform’s privacy policy, prompting fears that the app is now collecting sensitive personal data — including users’ immigration status.

The concern has spread rapidly across social media, with some users warning others to delete the app and accusing TikTok of expanding its data collection practices. But privacy experts say the language causing the backlash is not new — and does not mean what many users think it does.

Instead, the disclosure reflects longstanding legal requirements tied to U.S. state privacy laws, particularly in California, and has little to do with TikTok suddenly seeking access to users’ immigration records.

Why Users Are Seeing the Policy Now

The timing of the alert has amplified the reaction. TikTok recently finalized a restructuring of its U.S. operations into a new joint venture, triggering a legal requirement to notify users of updated terms and policies. For many Americans, this marked the first time they had closely read TikTok’s privacy documentation.

What they found was language stating that TikTok may process “sensitive personal information,” including details related to a user’s “citizenship or immigration status,” sexual orientation, gender identity, health information, and precise location.

On its face, the wording struck many users as intrusive — and, given the current political climate, potentially dangerous.

The Legal Context Behind the Language

According to privacy lawyers, the disclosure exists largely because TikTok is required by law to include it.

California’s Consumer Privacy Act (CCPA) and its successor, the California Privacy Rights Act (CPRA), require companies to explicitly inform consumers when they collect or process “sensitive personal information.” That category is broadly defined and includes not just financial or biometric data, but also attributes such as race, ethnicity, religious beliefs, and immigration status.

In October 2023, California Governor Gavin Newsom signed AB-947 into law, formally adding citizenship and immigration status to the list of protected sensitive data. Since then, companies operating in California have been required to acknowledge that such information may be processed under certain circumstances.

TikTok’s policy, updated in August 2024 — well before the ownership transition — already contained the same language now causing panic.

“The company is required under those laws to notify users in the privacy policy that sensitive personal information may be collected, how it is used, and with whom it is shared,” said Jennifer Daniels, a partner at the law firm Blank Rome who advises companies on regulatory compliance.

What TikTok Is — and Isn’t — Collecting

Crucially, the policy does not say TikTok actively asks users for their immigration status.

Rather, it states that TikTok may process sensitive information if it appears in user-generated content or is voluntarily disclosed — for example, in a video, livestream, comment, or survey response.

“If you disclose something sensitive, that information becomes part of the content the platform technically ‘collects,’” said Ashlee Difuntorum, an associate at Kinsella Holley Iser Kump Steinsapir who represents technology companies in litigation. “These policies are written for regulators and litigators, not everyday users.”

In other words, if a creator posts a video discussing their immigration experience, that information is inherently part of the content TikTok hosts and moderates. The platform is legally obligated to acknowledge that reality.

The policy explicitly states that TikTok processes such data “in accordance with applicable law,” and even references the CCPA by name as one of those governing frameworks.

Why TikTok Chose Specific Language

While similar disclosures appear across the tech industry, TikTok’s policy stands out for its specificity.

Philip Yannella, co-chair of Blank Rome’s Privacy, Security, and Data Protection Practice, says companies are increasingly detailed in their disclosures to limit litigation risk.

Plaintiffs’ lawyers have recently brought claims under laws like California’s Invasion of Privacy Act, alleging improper collection of racial, ethnic, or immigration-related data. Listing legally defined categories of sensitive information helps companies demonstrate compliance.

However, that same precision can backfire.

“At least one downside is that spelling everything out so explicitly can actually confuse or alarm users,” Yannella noted.

By contrast, Meta’s privacy policy includes granular disclosures but does not explicitly list immigration status, opting for broader language instead.

A Climate of Heightened Fear

The reaction to TikTok’s policy update cannot be separated from the broader political environment.

Immigration enforcement has intensified across parts of the United States, triggering protests and civil unrest. In Minnesota, recent clashes between Immigration and Customs Enforcement agents and local residents have led to mass arrests, business closures, and the death of an American citizen during demonstrations.

Against that backdrop, the idea that a social media app might collect or expose immigration-related data feels especially threatening — even if the fear is misplaced.

Irony of the Ownership Shift

There is a further layer of irony in the backlash.

TikTok’s U.S. restructuring was driven by long-standing concerns from lawmakers that Chinese ownership through ByteDance could expose American users to surveillance or influence campaigns. Chinese laws require companies to cooperate with state intelligence requests, fueling bipartisan scrutiny in Washington.

Now, after TikTok moved its U.S. operations under American ownership to address those fears, users are increasingly worried about potential access by their own government instead.

TikTok declined to comment on the controversy.

The Bottom Line

Despite viral claims to the contrary, TikTok has not quietly begun collecting Americans’ immigration status.

The language alarming users has been in place for months and exists primarily to satisfy state privacy laws that demand transparency around sensitive data — even when that data comes from users themselves.

Still, experts acknowledge that the blunt wording highlights a broader issue: privacy policies are designed to protect companies legally, not to reassure the people who use them.

For now, the panic appears driven less by policy changes than by mistrust — of technology platforms, of government surveillance, and of how personal data can be used in an increasingly polarized political landscape.