TikTok unlawfully tracks shopping habits and use of dating apps?

Posted by doener 9 hours ago

Counter189Comment100OpenOriginal

Comments

Comment by thisisthenewme 8 hours ago

I guess it's pretty much impossible to stop these companies from gathering data, there's too much money in it, it's too easy to implement, and there's no cohesive force to stop them. I'm wondering whether a crowdfunded effort to feed fake data into these systems would work so we overwhelm them and make their plans a bit more difficult.

Comment by mc3301 8 hours ago

"The only winning move is not to play."

If you look at these systems that same way some people look at casinos - places specifically designed to take your money - you realize there isn't a way to change them nor improve your overall experience with them. You just don't go inside. I'm kinda hoping that it becomes the trend in the next few decades to completely abandon these algorithm-driven data-hoarding attention-stealing apps. I've been calling it "digital hygiene", personally.

Comment by banana_sandwich 7 hours ago

I used to be highly addicted to scrolling. Tiktok, reddit, instagram, everything. It nearly cost me my relationship and I swore it off ever since. I’ve been offline those apps for a few months now, and have never felt better. Cant believe what i was allowing to happen to my attention!

Comment by cons0le 6 hours ago

Its the endless shortform videos. The brain was not meant to switch contexts every 20 seconds for 3 hours straight. I replaced most of my screens with e ink, and only allow myself to scroll through text based sites and rss feeds

Comment by flirtyqwerty 1 hour ago

Interesting concept. I'd like to hear more about your process. What e-ink screen(s?) are you using? Any good text based websites to recommend?

Comment by sofixa 1 hour ago

Not who you asked, but personally I'm using an Onyx Boox Palma, which is a phone-sized Android device with an e-ink screen. I have Readwise's Reader on it, which doubles as "read later" and RSS feed reader, and works offline. Pretty happy with the workflow overall - I use it extensively when travelling and having time to waste (e.g. waiting at an airport or while on the plane/train).

Note about Onyx, they're kind of violating GPL by refusing to publish source code. Also, their Android devices are a bit special and you have to jump through a couple of small hoops at set up to be able to use Google Play (nothing special or complicated).

Comment by mc3301 7 hours ago

Youtube: There are a few long-form creators I watch, maybe 4 hours a month of content. Besides that, viewing history is off, no apps, browser extensions block mostly everything (comments, suggestions, etc.)

Instagram: I have a 15 minute daily timer, because I sometimes post, and I sometimes receive DMs.

Reddit: Fully blocked, I think I ublocked everything.

Tiktok: I won't even download it ever again. It has an algorithm like no other for sucking me in. Dangerously addictive.

Facebook? Deleted it completely around 2013, so no idea what's going on there.

Comment by johnofthesea 1 hour ago

For those that are subscribed to Youtube channels: no need to have account. Youtube has RSS.

Comment by fragmede 6 hours ago

How's the dating scene where you are? Whatever bubble I'm in, in the US, while I could not be on Instagram, that would be making things harder on myself.

Comment by safety1st 3 hours ago

I totally get this sentiment and I think it applies equally to the actual dating apps, these apps are all garbage fires that you don't really want in your life, but they do have utility if you want to date.

So an idea I've been thinking about lately, is that evolution didn't produce humans that were wired to date forever. These app publishers undoubtedly would prefer that you keep using their apps until you die, so they're happy to see you also keep dating until you die. But that shouldn't really be how things go and it's not how most of us are wired. Most humans throughout history went through a brief courtship period and then they settled down with someone, even if that person wasn't perfect.

The app has utility in that courtship period, but the activity itself is meant to be temporary, possibly even brief, and ultimately give way to something else. The app publisher has an incentive to make you forget that.

Comment by Aurornis 4 hours ago

I’m curious what you mean by this. Most of the guys I know treat their Instagram accounts like their LinkedIn accounts: It has enough information and occasional updates with major life changes, but they don’t actively engage with it all the time. Just let it exist and respond to any messages if they come in. Would that work, or are you saying the dating scene in your area requires some type of active constant engagement with Instagram?

Comment by mc3301 5 hours ago

No idea about the dating scene in central Japan; I'm not in it.

Comment by octoberfranklin 3 hours ago

No, that really wouldn't.

Instagram is a tool to help women manage their fan club of orbiters and get validation from them on demand (which is what makes so addictive for women). It might look like "hey there's all these hot women here if i hang out here i will get dates with them" but that's the mirage.

Comment by wkat4242 2 hours ago

Hmm in our community it's also a way to connect when you meet someone at parties, that doesn't expose too many details like your real name or phone number.

Comment by safety1st 3 hours ago

This is so true. I can't signal boost it enough.

I'm also a recovering social media addict, it was a slow and painstaking transition but the benefits in terms of attention, concentration and attitude have been profound. The main metric for me was going from almost 5 hours a day of phone time 2-3 years ago, to about 1 hour today. Of course the socials still snuck in on other devices but that was the main thing which killed the poison at its root and then eventually all the offshoots withered.

The apps condition you to come back through a feedback loop. Once I broke the feedback loop enough times the whole idea of going into one of these apps or sites and watching my life disappear into it started to feel revolting, like I just knew it was going to make my day worse not better, then the hold was gone.

The next battle I see on my horizon is that I sometimes watch 20-30 minutes of YouTube subscriptions in the morning with my coffee. There's some good content, but sooner or later Google's going to try and kill my ad blocker and probably look for new ways to creep that time up into hours instead of minutes. I know it's coming and I'm ready to die on this hill rather than lose my morning. I will do absolutely anything to continue blocking ads, up to and including saying goodbye to YouTube, to Google, to a web browser, putting only TUI interfaces on my TV, anything.

My favorite small act of defiance this year was purchasing a $120 deluxe hardcover edition of the Lord of the Rings trilogy - that's a great work I enjoy enough that I'm happy to read it many times over the course of my life, it improves my attention span instead of worsening it, and it won't show me a single ad ever. So I figured in terms of recreation, it's one of the best investments I could make. Perhaps several of such omnibuses on a shelf next to a comfortable armchair is the best defense against Big Tech.

Comment by mc3301 46 minutes ago

"Would you like to watch a 30 second add to skip to the next chapter?"

Comment by bdangubic 6 hours ago

6 years and counting for me

Comment by fragmede 7 hours ago

How'd you do it?

Comment by __MatrixMan__ 6 hours ago

They're not identical concepts, but I've been bringing up "dopamine hygiene" a lot lately and it seems to resonate with people.

Given that these companies tend to converge on addiction as their business model, I think there's a lot of overlap.

Comment by Mathnerd314 4 hours ago

It seems an absurd amount of people misuse the term dopamine, I found this video https://youtu.be/x6_Ukic1tRM?t=1297 (in Polish, but there are subtitles and dubs). If you want to continue to spread "manipulative disinformation", by all means, some people have to be evil, but just be clear that it is pseudoscience up front.

Comment by kibwen 7 hours ago

> I've been calling it "digital hygiene", personally.

Don't forget mental hygiene. Letting these apps have access to your brain causes legitimate brain damage in the same way smoking causes lung damage.

Comment by mc3301 7 hours ago

I said, "next few decades," but I meant to say "next few years."

Comment by 7 hours ago

Comment by izacus 57 minutes ago

American legal system will curb stomp any tiny company on the other side of the world if they dare to draw an outline of Mickey Mouse, and you're saying that this same nation can't stop big abusive companies?

Comment by thecopy 52 minutes ago

The big companies simply gives the predisent of the USA a made-up peace prize or a gold Rolex and get exempted.

Comment by monster_truck 1 hour ago

Please spend 5 seconds thinking about this. It isn't impossible, it isn't earnestly valuable now that gambling has taken ad fraud's throne (guess what the throne is for), and fake data doesn't work.

Comment by shepherdjerred 5 hours ago

https://adnauseam.io/

Comment by jonway 1 hour ago

Faking data is a good method, but has issues it seems.

Moxie tried that with GoogleSharing system back in the day.

Not really sure what the biggest downsides were, but it was discontinued.

Comment by bdangubic 7 hours ago

it is possible through legislation. slap them with the fine equal to their two previous years ebita combined and all this stops within an hour. of course not like people that need to pass a legislation aren’t bought for a fraction of that.

these things are why frequent comments on HN that go “this company is not using our data for training, it is in ToS etc…” makes me literally LOL.

Comment by noman-land 3 hours ago

In the attention economy you have to vote with your attention.

Block, ignore, disengage from, and scorn any software or service that behaves this way.

Make fun of your friends when they use these apps and use peer pressure to dissuade them from using them. These services need to be uncool.

Be the change you want to see. Research alternatives. Provide alternatives. Make alternatives easier, better, and cooler.

Choose principles over convenience and encourage your peers to do the same.

Comment by nephihaha 6 minutes ago

And probably much more than that.

Comment by tkel 8 hours ago

Pretty sure TikTok and Instagram are sharing data somehow as well. My feeds are near identical.

Comment by slg 7 hours ago

I don't know, maybe they are colluding, but it is funny to default to that assumption over both platforms just delivering you the same content because you have the same behavior across both apps.

Comment by ehnto 6 hours ago

They don't have to collude, the third party advertisers that collate and provide shadow profiles do that work for them.

Comment by vkou 4 hours ago

The advertisers don't get the raw data feeds necessary to do that.

Comment by tkel 7 hours ago

Notably, this started happening the day that I made my TikTok account public. My Instagram feed began to be a copy of my TikTok feed. The exact same videos. Even after changing my Tiktok back to private and deleting all of my followers, the feeds are still identical, every single day. My behavior is not. On Instagram, I follow and interact with very different accounts than on TikTok. It seems to me that Instagram is buying or accessing TikTok's data, and it is not through advertising providers, because the identical content is coming directly from Instagram/TikTok and not promoted ads.

Comment by fragmede 7 hours ago

There are three possibilities though. One is Instagram copying TikTok, without their knowledge, the other is Instagram copying your TikTok feed with their knowledge but not their blessing, and finally Instagram copying your TikTok feed with TikTok's knowledge and their blessing. If we take a look at http://TikTok.com/robots.txt, it seems if you make your TikTok public, TikTok is happy to let Instagram take a look at it (but not a number of AI crawlers). What Instagram does with it is up to them, but it's in robots.txt.

Comment by tkel 4 hours ago

The simplest explanation would be that Instagram crawled my TikTok's account's followers and is curating my Instagram reels based on that point in time.

However that's not what happened, because my "following list" is restricted to be viewable by "only me", even though my account was public. "Public" just means that you can view my videos without me accepting a follower request. And I don't have any videos anyway.

So I can only deduce that setting it to "public" flipped some bit in either Instagram or TikTok's backend to where now they both are sharing the same or very similar data to curate my feeds.

Comment by bflesch 2 hours ago

In the book "careless people" it is highlighted that Facebook embedded spyware in their app which tracked other apps that were installed/used on the phone. This allowed them to figure out that so many of their users were installing WhatsApp, and enabled the legendary WhatsApp purchase. It is very much possible that Instagram is reading some sort of temporary files created by TikTok and extracts data using this method.

Facebook/Meta has a proven track record of fetching all data from your phone, even when abusing security vulnerabilities to do so. And the clowns at Apple can't even fix RCEs in their network-exposed applications, I'm not convinced the separation between apps is flawless.

Comment by yibg 7 hours ago

Not sure if they're explicitly sharing data, but there does seem to be something that's sharing data across the platforms. When I buy something from Tiktok, the ads for the same thing shows up on my instagram almost instantly. Doesn't necessarily mean they're directly sharing data of course, could be a third party too. But as a consumer that has very little difference for me.

Comment by svat 6 hours ago

If you buy something from Tiktok, you presumably visit the merchant's website, which almost surely will have chosen to have a tracking pixel that sends data to FB (Instagram). You can read a bit about how tracking pixels work here: https://jvns.ca/blog/how-tracking-pixels-work/

In this case it's not Tiktok and Instagram that are sharing data with each other, but the product website that is choosing to share data with both of them.

Comment by aprilthird2021 6 hours ago

It's because you are the exact target demographic consumer for that product, and it's visible in your behavior patterns when using your apps combined with what they know about you (age, sex, location, demographics, etc.)

Comment by ehnto 6 hours ago

Much more likely an explicit retargeting ad network that doesn't realise they already bought it.

Retargeting has been a thing for like 15 plus years now. Visit website for knives, ad network tracking cookie notes that down, same ad network later serves you ads for the same knives. Or some convoluted data sharing network that has the same outcome these days.

Comment by aprilthird2021 2 hours ago

It's not much more likely. People don't realize but demographic targeting works really well. When you are a certain age, certain gender, living in a certain area, with a few other inferred characteristics, you're very likely to be talking about, thinking about, and buying a small set of product types

Comment by ehnto 13 minutes ago

I think the OP knows best what happened to them, so I will leave it up to them to decide. But to get targeted for a product you just looked feels like pretty standard retargetting.

I don't disagree with your point that demographics can be very good and sometimes uncanny, that aspect I agree with. It is just the timing that leads me to believe it is retargetting.

Comment by witnesprotect67 7 hours ago

Not so laughable after working in big tech

Comment by bflesch 2 hours ago

So where is your book? You gotta spill the beans.

Comment by gruez 5 hours ago

Why would two competing apps share data with each other?

Comment by bflesch 2 hours ago

Facebook has a track record of abusing security vulnerabilities to snoop up information about other apps installed on your phone. It might be as simple as Instagram reading leftover temp files created by the TikTok app.

Comment by tkel 4 hours ago

If two profit-seeking organizations can profit more from collaborating, why wouldn't they? Increasing profit is not zero-sum.

Comment by ajdude 5 hours ago

Earlier this year I downloaded TikTok once, I needed to access some very niche videos and couldn't watch them without getting an account. I never added anybody, and I never associated with any other socials, but somehow I started getting emails from TikTok that one of my NEIGHBORS were viewing my profile! Even used their full name. I deleted the account and uninstalled the app.

Comment by randycupertino 1 hour ago

I had a creepy one like this happen to me with Linkedin. I sold my uncle's guitar on craigslist using a throwaway gmail address to a guy with a very unique, rhyming name that I would never forget (ie - Gerald Herald). Immediately after he left with the guitar linkedin suggests I add him to my professional network. I never logged in to linkedin from that gmail, never looked this guy up, don't have linkedin app installed on my phone, literally met him for 60 seconds to get cash and hand over a guitar. It still weirds me out.

Comment by pests 41 minutes ago

Did you both have location on? Were you both connected to the same wifi?

Did he do any research on you beforehand?

Did you and him both search the same guitar model, in the same days, while in the same area?

Comment by sweca 4 hours ago

This is because when you click a shared TikTok link, your account and the sharer's accounts are associated in a social graph. The sharer will see your account as a suggested friend and vice versa.

Comment by oefrha 2 hours ago

No sharing link needed. Before I deleted my Facebook account more than a decade ago, it was already suggesting random people I met once IRL and are at least two hops away in terms of existing FB relationships. I had very few friends (~20 IIRC).

Comment by hapticmonkey 1 hour ago

I uninstalled it after about half an hour of use when it became clear the app kept pushing me to watch videos with Andrew Tate (with him on the top half of the screen and random racing games on the bottom half). It’s dystopian.

Comment by noman-land 3 hours ago

yt-dlp will allow you to download individual videos and even entire channels.

Comment by RandallBrown 3 hours ago

TikTok knows where you are and where they are. Easy connection to make.

Comment by wkat4242 2 hours ago

Do you have to share your location with it? I don't use it but similar apps like Instagram don't have my location permission.

Comment by Legend2440 7 hours ago

> TikTok was only able to receive this information with the help of the Israeli data company AppsFlyer and Grindr itself.

So basically, the TikTok app is not spying on your dating apps - your dating apps are willingly selling your information to them, through intermediaries.

This means uninstalling tiktok won’t help. And worse, many other companies are getting your dating info too.

Comment by Animats 6 hours ago

Grindr had a big data "leak" in 2024.[1] Not a "leak", really, just ordinary reselling of people's gay and HIV status. In 2025, a data broker who resold Grindr data also had a big breach. That wasn't Grindr-specific - it included Temple Run, Subway Surfers, Tinder, Grindr, MyFitnessPal, Candy Crush, Truecaller, 9GAG, Microsoft 365, and others. But not TikTok, because TikTok monetizes that info themselves.

[1] https://thehill.com/business/4614940-grindr-sold-hiv-status-...

[2] https://www.pcmag.com/news/major-data-broker-leak-might-have...

Comment by ptrl600 6 hours ago

I wonder if that "fake permissions" Android sandboxing thing from like a decade ago still works.

The right to lie to apps should be part of the new tech Magna Carta

Comment by mac-attack 6 hours ago

I hate to sound like a those pesky Kagi supporters, but that is built into Graphene OS.

Comment by gruez 5 hours ago

It's not, though. If you deny location permissions the app will still know and pester you to enable. Same with other sensitive permissions with the exception of internet.

Comment by ikekkdcjkfke 2 hours ago

This has been a thing for rooted devices for a long time with faking senstive data on android Although i wouldnt root any sensitive devices nowadays

Comment by cheschire 8 hours ago

https://docs.pi-hole.net/docker/

Comment by advisedwang 5 hours ago

People deserve privacy even if they aren't tech savvy enough to use pi-hole, even when they aren't on a network they control, even if they don't know their privacy is under attack.

Comment by OptionOfT 8 hours ago

Pi-Hole only works when the tracking / ad scripts are hosted from different domains than the actual content.

Comment by cheschire 8 hours ago

Don't worry, when you blackhole the entire tiktok domain, you'll still be able to use grindr.

Or did you still want to be able to view tiktok?

Sorry. Can't help you there. Or can I? https://www.torproject.org/download/ or https://chromewebstore.google.com/detail/proton-vpn-fast-sec...

Comment by lelandfe 7 hours ago

TikTok will de-anonymize you and connect you back to the ad networks in days, speaking as someone who tried really, really hard to not get it to do that.

They probably have the most sophisticated fingerprinting ever created.

Comment by cheschire 7 hours ago

Yep! And luckily Tor Browser works pretty hard at defending against that. It even goes so far as to box the rendered page resolution so it cannot be connected to the same resolution as your main browser.

But you can take first steps by using a simple dns proxy to make things more difficult.

Comment by lelandfe 5 hours ago

I don't mean that, I mean behavior. The algorithm that is TikTok is running a test fingerprinting you with every video shown. It's like stylometry on steroids.

Comment by Ferret7446 6 hours ago

Honestly that probably makes it easier to fingerprint you. How many people do you think actually use Tor? Instead of needing to identify you from millions of users, now they just need to identify you from the five or so Tor users

Comment by tkel 8 hours ago

Highly recommend people check out this simple alternative. It's like a better, modern dnsmasq.

https://github.com/AdguardTeam/dnsproxy

Comment by cheschire 8 hours ago

Setting up a whole-home adblocking solution takes a few minutes with pi hole, and it's got a very functional web interface for actions such as unblocking specific sites for specific systems on your network.

That dns proxy looks intriguing but looks like quite a bit different from the simplicity of pi hole.

Comment by tkel 7 hours ago

dnsproxy is a single binary that does everything, very simple.

Comment by Xiol 2 hours ago

My nontechnical wife isn't going to care it's a single binary when I remove the PiHole web interface that she's used to using on the odd occasion she needs to disable blocked for a bit (for example).

Comment by hekkle 8 hours ago

If you want to find which apps are the worst at this use GrapheneOS. Amazon flat out REFUSES to work unless it has unfettered access to everything.

Comment by bri3d 6 hours ago

This isn’t likely to be a good indicator. Essentially only the network permission and any fingerprint is necessary for the tracking in this accusation; the idea is not that TikTok were spying on Grindr on the device, but that a device fingerprinting firm who broker both TikTok and Grindr data were able to correlate the user.

Comment by Aurornis 3 hours ago

The headline is misleading. The TikTok app isn’t doing the tracking. The dating app providers are selling their user’s data. TikTok is one of the companies buying it.

Technical protections on your phone aren’t going to stop anything if you’re using apps that sell your data from their servers out the back door.

Comment by vjvjvjvjghv 4 hours ago

The whole permission thing is broken. They are too broad and nobody understands what they really mean. I would also like to see a log of when and how an app uses granted permissions.

Comment by asdff 3 hours ago

Ironically amazon.com works perfectly with javascript disabled. One of the few major sites that still do in my experience.

Comment by gerdesj 8 hours ago

I (UK based) have pfblocker-ng running at the perimeter with quite a lot of blocking. My browser FF has uBlock Origin and Privacy Badger too.

Amazon works fine.

I suspect they work along the rather practical lines of: if we can snag your data we will but if you want to block our efforts at predation but want to spend out, we are fine with that too.

Amazon absolutely will not refuse your money and they are jolly good at extracting it.

Comment by hekkle 6 hours ago

Fair enough, it does make sense that they will maximise their profits where they can, I'm just saying that it (the app not the website) refuses to work unless you provide it a full scope of literally every permission available. Maybe it has more to do with attestation, and verifying that you are not a scammer, than stealing and selling data?

Comment by 5 hours ago

Comment by gruez 5 hours ago

Doesn't grapheneos have the same permission model as stock android? The only thing it adds is internet access and sensors (eg. gyroscope) access. What extra stuff is amazon asking for?

Comment by quesera 5 hours ago

The only websites that are allowed to run apps on my phone are financial institutions.

All other websites are just websites.

Comment by august125 3 hours ago

This was Steve Jobs' original vision for the iPhone, before he relented and launched the App Store. Maybe it was the correct one.

Comment by ZuoCen_Liu 6 hours ago

This seems to be the "original sin" of the current Internet "platform" paradigm.

Comment by Vpsteroski 7 hours ago

Companies always track data and major social media companies and online search engines ALWAYS keep track of user search history. That data is often sold or used to find out what you are searching about and what brands you like. I guess it IS impossible to stop these big brands :-)

Comment by grugagag 8 hours ago

Very likely all other social media are doing it. Not to dimish the harm done by Tiktok but sadly it’s an industry wide phenomenon. Shouln’t forget about surveilance, misinformation, election rigginng and so on.

Comment by newZWhoDis 7 hours ago

I'll post some inside baseball:

Almost everyone in ecom is running every ad network integration they can, no matter the source of traffic.

So if you click a Facebook ad, load a website, enter your information/checkout ALL of your information goes to every other network they integrate with.

You might never use TikTok, you might have every Facebook domain blacklisted, but when you clicked on a Google search "result" (ad) and checked out everything about your order was sent to meta/tiktok/applovin/400 other "networks" via S2S APIs.

Until this is made illegal, the incentive structure will ALWAYS push marketing departments to do this.

Comment by MrFots 7 hours ago

I'm already low-consumption, but my personal boycott of any site using shopify, which straight up has all integrations in their js you can inspect, has lowered my consumption even further. I've been emailing stores asking them to switch to bigcommerce, or whatever, and stop sharing their customers' data. Never get answers, though I never expect any.

Comment by fortzi 6 hours ago

Switching over to another ecommerce provider is a massive undertaking. It’s like if someone asked you to move your residence because the smoke from your bbq hurts their lungs

Comment by stefan_ 6 hours ago

It is made illegal. As the post notes, you need to (1) give notice and (2) data collected needs to be made available in a user access request and (3) deleted irrevocably on request. You must have a legitimate reason to process and store this data (scattershot forwarding to everyone is a prima facie violation). Unless you comply with all of these, you are in violation.

Comment by telchior 8 hours ago

I assume TikTok and similar apps are always doing this stuff.

The thing I'm curious about is whether the GDPR / DSB complaints are likely to have any result. Is that likely to just result in some cost of business fines and TikTok goes on with life? Or could those complaints bring about substantial repercussions?

Comment by Nextgrid 3 hours ago

The expected result is that the complaints will rot in the queue for years and eventually either closed on a technicality or result in a token fine. That's the reality of GDPR "enforcement".

Comment by wkat4242 2 hours ago

Great job from noyb.

It's sad that the gdpr is now being watered down, especially the protection of these specially protected data points.

Comment by digitaltrees 7 hours ago

That earnest congressional testimony by the CEO looks pretty bad at this point. Either he was lying or doesn’t know anything about how his company works.

Comment by exabrial 7 hours ago

Some state needs to pass an explicit consent law, since consent is too hard of a concept for Silicon Valley and other startups to understand.

Comment by 6 hours ago

Comment by Simulacra 7 hours ago

I don't think any app or service can hold a candle to the data harvesting of dating apps. Social media knows your likes and dislikes, but dating apps knows your deepest desires and wants.

Comment by charcircuit 7 hours ago

>Article 9.2 (d) processing is carried out in the course of its legitimate activities

TikTok has a legitimate activity of personalizing the feed of users to make it as relevant as possible.