Assessing Privacy Policies and App Settings for User Data Protection: A Data Subject‐Centered Framework Analysis of TikTok in the U.S. and Europe (2023–2024)

ABSTRACT

This study examines the extent to which TikTok's privacy policies and app settings in the U.S. and Europe protect the rights entailed in the data subject‐centered framework. Using a case study approach, we analyze current policy documents and app settings to identify the alignment of TikTok's policies with the GDPR perspective. Our findings reveal that current policies and settings fall short in key areas. First, TikTok policies lack details related to managing and protecting sensitive data. Second, the policies neglect to discuss the responsibilities of social media companies when such data is utilized by unspecified third parties. Furthermore, there is a noticeable deficiency in the U.S. regarding detailed in‐app privacy notices and setting options, especially in terms of managing location data and advertisements. Additionally, there is a need for explanations on how specific settings impact users. Lastly, a critical demand exists for default settings, including those for advertisements, to enhance data protection.