TikTok - Videos, Shop & LIVE Security & Privacy Scorecard
by TikTok Ltd. · iOS
Viewing habits, interactions, and in-app behavior are collected to personalize the user's feed and deliver targeted ads. Some of this activity is shared with third-party analytics services. Account controls are available, but the app builds a detailed behavioral profile as users scroll, like, and shop.
Best for
Casual video discovery and social entertainment
Findings
- 0 critical
- 1 high
- 6 medium
- 6 low
- 6 info
1 issue identified across security and privacy analysis.
Top security issues
- Twitter OAuth Consumer Secret Embedded in Client Binary
- WebView Arbitrary HTTP Content Loading with ATS Exception
- Cross-App Keychain Sharing Enables ByteDance Ecosystem Identity Linking
Top privacy issues
- PII and Device ID Declared for Cross-App Tracking and Third-Party Advertising
- ByteDance First-Party Monitoring Initializes Before User Consent
- Slardar APM Comprehensively Monitors All WebView Network Activity
Full analysis
TikTok - Videos, Shop & LIVE
What This Means for You
Viewing habits, interactions, and in-app behavior are collected to personalize the user's feed and deliver targeted ads. Some of this activity is shared with third-party analytics services. Account controls are available, but the app builds a detailed behavioral profile as users scroll, like, and shop.
Recommendation: Acceptable
Best For: Casual video discovery and social entertainment
Key Findings
Data Security - 4 findings (1 medium, 1 low, 2 info)
Network Security - 2 findings (1 medium, 1 info)
Code Safety - 0 findings
Privacy - 6 findings (3 medium, 1 low, 2 info)
Privacy Concerns
What Data is Collected
TikTok collects a broad range of personal data including viewing history, watch time, likes, comments, shares, search terms, and in-app purchase activity. Device identifiers, location signals, and behavioral patterns are gathered during app usage.
Third-Party Data Sharing
No specific third-party analytics or advertising services were identified. TikTok's privacy policy describes data sharing with affiliated entities and advertising partners for ad targeting and measurement.
Understanding the Scores
| Category | Score |
|---|---|
| Security | 83/100 |
| Privacy | 82/100 |
| Data Security | 88/100 |
| Network Security | 88/100 |
| Code Safety | 86/100 |
| Data Collection | 82/100 |
| Data Sharing | 88/100 |
| User Control | 85/100 |
Positive Security Features
- No standout positive security practices were identified in this analysis.
Areas for Improvement
- The app collects a broad range of behavioral data during passive browsing. Reducing the scope of data gathered in the background would lower user exposure.
- Some data transmission practices have room for improvement to better protect user activity as it moves between the device and the app's servers.
- Privacy controls exist but could be more accessible. More prominent opt-out options and simpler data deletion tools would give users greater control over their profile.
About This Analysis
This scorecard reflects the security and privacy posture of the app at the time of the scan, based on static analysis of the app's code and configuration.
App Details
- App: TikTok - Videos, Shop & LIVE
- Package: com.zhiliaoapp.musically
- Scan Date: 2026-03-16
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #8 (current) | 82/100 | |
| #6 | 88/100 | |
| #5 | 68/100 |