The TikTok Problem Is Not What You Think
Despite what you've been told, the U.S. government is serious about privacy and data. And the TikTok divestment is just one prong of a bigger strategy.
Welcome to BIG, a newsletter on the politics of monopoly power. If you’d like to sign up to receive issues over email, you can do so here.
This week, the House of Representatives passed a bill to force a divestment of TikTok from entities affiliated with the Chinese government. The vote was overwhelming, with 90% of Republicans and 75% of Democrats assenting.
There are many reasons members agreed to support this legislation, and there are open questions about what will happen in the Senate, and then what happens in the marketplace if this bill gets signed into law. There are also many objections, such as the claim that this legislation is an abridgment of free speech, that it’s xenophobic, that it will jeopardize the hard work of creators or businesses who depend on TikTok, or that addressing TikTok ownership shouldn’t happen because we haven’t passed basic privacy protections or regulated social media in any significant way.
While I support the bill, and find most of these objections lacking in credibility, there is some legitimacy to the skepticism, which I’ll get into. But what I want to offer is some basic framing, which is that this legislation has to be understood not as a substitute to a broader movement for reform of social media and privacy, but as part of it. And there are two basic points here. The first is while it’s true that Congress hasn’t passed a ‘comprehensive Federal privacy law,’ it’s also true the Biden administration is orchestrating a remarkable revolution in privacy protections by resurrecting old legal tools. There are reasons you haven’t heard of this revolution that have to do with the incentives of privacy scholars, but the litigation here is fierce and deeply bitter. The second is those who say ‘we can’t even regulate social media and now you want to divest TikTok’s ownership!’ have it 180 degrees backwards. Being able to address Chinese ownership of one video sharing platform is part of the movement to reform all platforms.
Ok, let’s dive in.
Biden Rewrites the Rules of the Internet
Two months ago, the Network Advertising Initiative (NAI), an advertising trade association composed of data brokers and tech giants like Google and Adobe, announced it was developing new industry standards for corporations who “collect and process sensitive consumer location data.” It might have seemed like a one off, except that major law firms were also sending out alerts and information to clients telling them to just stop using certain location data to target individuals. It turns out, people really don’t like it when corporations, or employers, abusers, etc know when they go to the doctor, church, a political rally, a gay bar, and so forth. And the industry of data brokers was listening.
Why? Well it’s because of a little noticed but pivotal legal change in enforcement by the Federal Trade Commission in a series of privacy cases. Traditionally, brokers could do anything they wanted with your data (with a few exceptions), as long as they disclosed they were doing it. So usually there was some long web form that you’d click on, and that’s it, your data is now their data. That’s the ‘notice and consent’ framework. The FTC brought cases, but these were under the framework of deception, not using your sensitive data but lying to you about it. Brokers could also fix this situation with another impenetrable click-through screen you wouldn’t notice. But in August of 2022, the commission brought a different kind of case, against a data broker called Kochava, arguing that collecting and using certain kinds of data, whether that was disclosed or not, was unfair. It was a novel legal claim, and it wasn’t clear if a judge would ratify it.
In January of this year, the FTC settled a case against a corporation called X-Mode Social for selling “sensitive locations such as medical and reproductive health clinics, places of religious worship and domestic abuse shelters.” This case relied on unfairness, not deception. The commission repudiated the notice and consent framework, arguing that it wasn’t enough to put a form in front of a domestic abuse victim asking if they consented to let a broker sell their data, but that data simply couldn’t be sold, period. The FTC did it again by settling a case against InMarket, another data broker. Finally, the big one happened. The judge ruled for the FTC in the Kochava case, upholding unfairness as grounds for banning the aggregation and sale of large amounts of consumer data, regardless of whether the corporation disclosed it was doing so. Once a judge interpreted the FTC Act’s provision against unfair and deceptive practices to mean that mass collection, processing, and sale of sensitive data is unlawful, then the precedent became real, and corporate America had to shift behavior. Basically, a judge said, yeah, that old FTC law that says ‘unfair and deceptive practices’ are illegal does actually apply to sleazy uses of data, not just lying about how sleazy you are.
While antitrust cases are an endless slog, consumer protection ones aren’t. And the FTC consumer protection enforcers have been busy, filing a flood of data-related cases over the past few years, going after the sharing of medical data, fertility data, location data, and so forth, including cases against Avast, GoodRx, PreMom, BetterHelp, and Flo Health. The FTC has used the traditional deception prong, but it has also used unfairness. There are also FTC consent decrees against YouTube, Twitter, and yes, TikTok, any of which could be re-opened by this FTC should they find a violation. What this flurry of action amounts to is what Gizmodo noted last year:
Then there’s another FTC consumer protection claim against Meta/Facebook, one of the biggest data hounds on the internet, in which the FTC simply banned Facebook from engaging in targeted advertising to children after the corporation violated its consent agreement with the commission. That’s being litigated, and Meta is slowly losing.
Antitrust, of course, is still a thing. The FTC has a big suit against Facebook filed in 2020, seeking to break apart Instagram and WhatsApp, and it has one against Amazon, which is oriented around how Amazon uses business data to orchestrate economy-wide price increases. But consumer protection moves much faster.
The sea change in privacy isn’t about one agency pulling one specific lever, but a whole set of agencies pulling lots of levers. For instance, the Antitrust Division has two antitrust lawsuits against Google, one of which went to trial last year and would restructure the way they organize search and search data, and the other of which is going to trial in September, which would organize how the search giant intermediates data and money in advertising markets.
The Consumer Financial Protection Bureau has taken action to address shoddy data practices of financial firms, and is investigating data brokers. It is also considering rules mandating that data brokers selling certain types of consumer data involving payment history, income, and criminal records be regulated as “consumer reporting agencies” under the Fair Credit Reporting Act, which would “trigger requirements for ensuring accuracy and handling disputes of inaccurate information, as well as prohibit misuse.” Then, today, Director Rohit Chopra gave a speech on mandating banks share your bank account data if you want to change bank accounts, noting that they are communicating with criminal authorities when big banks exchange data to thwart competition.
The Health and Human Services Department is fighting with hospitals over stopping them from sharing web browsing data with Google, and the National Security Council recently issued an executive order on data security barring data brokers from selling sensitive personal data - which includes genomic data, biometric data, personal health data, geolocation data, financial data, and certain kinds of personal identifiers - to brokers who enable "exploitation by countries of concern." I follow some agencies more than others, so there’s a lot of actions on data I’m no doubt missing. And a lot of agencies have a similar ‘unfair and deceptive’ statute in their specific area, modeled on that of the FTC and drawing on similar precedent (which now includes Kochava).
Is that enough? Of course not. As just one example, auto makers are selling driving data to insurers under false pretenses, leading to unexpected hikes in insurance prices. (Though to be fair, I wouldn’t be surprised to see crackdowns on that kind of behavior.) But conversely, is it really the case that privacy, data, and social media firms are completely unregulated in the United States? Absolutely not.
So why, if there’s so much happening, do people constantly bemoan the lack of a privacy law in the United States? One reason, clearly, is that legislation would help. But the truth is, there’s a large set of academics, compliance officials, and activists who have organized themselves around the issue of ‘privacy’ and ‘data’ without defining what the actual problem is. (And many of them know little about, say, advertising, which offers the most lucrative use of data.)
Here are a series of questions that make the point. When I go into a store and the clerk knows my name, they have my personal data. Is that a violation of my privacy? No. If Amazon has data on what products my firm sells and uses it to charge me higher fees, is that a violation of my privacy? Sort of, but it’s really just unfair exploitation of market power. If Google puts trackers on the Wall Street Journal’s website and then targets WSJ readers on YouTube with ads, thereby taking advantage of the Wall Street Journal’s work, is that a violation of privacy? Eh, maybe, but privacy is besides the point. Finally, if a neighbor is leering into my window, is that a violation of my privacy? Yes, with no data invasiveness required!
In other words, as with many big abstract questions, the concepts of privacy and/or data are a topic, not a problem. I’ve used this metaphor before, it’s a bit like saying wheels are something we need to tackle, because wheels are in cars, in airplanes, in toys, and in industrial machinery, therefore we need wheel rules now! That’s not wholly fair, there is some coherence to privacy, but there’s a lot more coherence to the ‘privacy advocacy community’ than there is to the problem. And that community has little incentive to clearly define the problem they want to solve, because that would require discussing specific markets and pricing and advertising, and that’s a bit tougher than abstractions. It’s much easier to say ‘Privacy is totally unregulated!’ or ‘We’re doing NOTHING to regulate social media!’ Even if neither is true.
But when you get down to it, mass data collection is mostly driven by advertising. So the legal actions undertaken by Biden across the board are restructuring how data brokers operate and how ad markets work.
BIG is a reader-supported newsletter focused on the politics of monopoly and finance. This is journalism that reveals how power works, so please consider a paid subscription. Lies are free, the truth costs a few bucks. You can subscribe by clicking here.
The TikTok Problem
And this discussion brings me back to what started this musing in the first place, which is the proposal to shift the ownership of TikTok. One irony of this debate is that the emergence of TikTok is a very good lesson in the risks of poor antitrust enforcement in America. Indeed, the reason TikTok exists is because we allowed Facebook to kill Vine, a remarkably similar video sharing product started years earlier by Twitter.
But we are where we are, and today China controls a key communications platform globally in the U.S. Many of TikTok’s strategic choices mimic those of U.S. tech platforms, and vice versa, as does its business model of an addictive endless feed and surveillance advertising. It’s not a coincidence that all of these actions on privacy, antitrust, and consumer protection are happening at the same time as a proposal to force the divestment of TikTok from Chinese control. Indeed, *all* of these actions, and the vehement debates in Congress over the past four years over privacy and antitrust, are part of recognizing that key social infrastructure must be governed, and not just governed by anyone, but governed by we the people.
There is a long anti-monopoly tradition in America, and we’re using it aggressively to address domestic dominant firms. But this tradition is not limited to antitrust. It includes public utility rules, such as the prohibition of foreign control of platforms in the United States, which we had with everything from the radio to railroads. (Ironically it was the WTO in the 1990s that started chipping away at such rules.) These public utility ownership and control prohibitions have been especially stringent when comes to hostile nation-states. This tradition is one reason I think that First Amendment arguments are silly. (If you want a longer way to understand that view, my essay on the NetChoice case at the Supreme Court goes through a lot of the same issues.)
Still, why, you might ask, do I think the Chinese government actually controls TikTok? Well for one thing, the Chinese government says it will not allow a divestment of the American branch of TikTok. And that doesn’t make sense unless the Chinese government exercises some level of control over the video sharing service. So I think we have to assume it does. There’s also a really easy test of whether there’s bad intent vis-a-vis TikTok. Just pass this bill. If the Chinese government is willing to torch hundreds of billions of dollars to thwart a divestment of TikTok, then clearly it wants to control TikTok for non-monetary reasons.
If a nation-state is opaque, authoritarian, and doesn’t allow foreign journalists, they don’t get the benefit of the doubt on intentions when it comes to whether private firms are in fact private, especially when the state ideology is collectivist. There’s also pretty good evidence of problems here. In 2019, the Guardian published internal documents from TikTok showing how the video sharing service censors videos that Beijing doesn’t like, such as mentions of Tiananmen Square, and there is strong circumstantial evidence of bad faith, such as TikTok spying on Buzzfeed and Financial Times journalists in an internal leak investigation. The app also seems to have a bias against certain, well, types of speech.
Broadly, the Chinese government and the United States are in a hostile posture towards one another, with the PRC explicitly seeking to control how people worldwide, including here, discuss the Chinese government. So having Chinese government ownership or control of key U.S. infrastructure is just not acceptable, because it means that Chinese government officials are structuring American behavior in America. Additionally, with the rise of services like ChatGPT, it has become clear that the ability to process large scale data sets is a key input for a whole host of new products and services, and it’s unwise to allow broad population-wide granular data about Americans to be held by a nation-state with such different ideological aims.
It’s also worth noting that China doesn’t let American platforms in China, and requires data localization. And I do not object to China keeping U.S. platforms out of China, I think that’s smart of them, considering they oppose the idea of free expression by their public. But we should similarly govern ourselves, since we do support the idea of free expression by our public. And that means changing ownership of TikTok.
What Now? Who Buys TikTok?
Another objection to the TikTok divestment strategy is that it will strengthen existing incumbents. But I don’t think it’s likely that either Meta or Google would be allowed to buy TikTok. Facebook Reels, YouTube Shorts, and TikTok are three main rivals in video sharing services. Moving from three firms to two in nearly any market is illegal, so I doubt Facebook would dare propose it in such a high profile market.
Putting together $100B or whatever it costs to buy TikTok is a big endeavor, and I don't know that it could be done in six months. But already, Bobby Kotick of Activision has said he’s putting together an investment group, and so has former Trump Treasury Secretary Steve Mnuchin. It’s preliminary talks right now, and more bidders might emerge. What’s useful about the Mnuchin news is that it brings out the real objection that many progressives have to the divestment of TikTok. Here’s Mehdi Hasan, a former MSNBC anchor and aggressive partisan, making the point a lot of left-wingers have made.
Hasan has two concerns. First, he distrusts the other domestic political faction, basically seeking someone who has some shared political values to control this platform. Second, he worries that TikTok’s operations will change to harm the existing user base. Young people, as well as a host of businesses and political operatives on the Democratic side, use TikTok a lot to both watch videos and make and share videos, and they have come to depend on it. The concern is that a change in ownership, or an outright ban if China refuses to allow a divestment, will harm them by forcing a change in behavior they would not wish.
There’s some merit to his worries. Concerns over manipulation of the public are a premise behind prohibitions on foreign control, as well as character requirements for broadcast licenses by Federal Communications Commission and election laws involving broadcast media. But the partisan nature of executive leadership simply cannot be a key factor in how we think about this problem, certainly not above concern over foreign ownership of platforms. All people have biases, but more importantly, all executives with access to the amount of capital necessary to buy and run a platform are going to prioritize their own profits above any political bias. Importantly, this is not true about China, because nation-states prioritize geopolitical ambitions over profits.
But in terms of whether changes will hurt creators and users, well, TikTok already has changed its algorithm in ways that harm creators, abruptly and often. All the big platforms do this; Meta, for instance, is in the process of destroying the news globally because they have decided it’s strategically more profitable to eliminate the sharing of traditionally reported news on their sites. So this concern is just another way of saying that dependence on a dominant platform that can shift its algorithm at will is dangerous. The solution here is breaking up the existing holding companies like Meta and YouTube into separate corporations so there are more independent platforms, and putting forward stronger public utility rules. But one bedrock public utility rule must be that the guy who runs a big platform in America has to be subject to American law.
All that said, I have no idea if this bill will move through the Senate. I’m not optimistic, if for no other reason that very little moves through the Senate these days. But it is pretty useful to have this debate, because it’s quite clarifying. And if we do manage to force a divestment of TikTok, it’s going to show in a very overt way that democratic governments can structure markets to prioritize the sovereignty of their own people. And that opens the door to a lot more governance.
UPDATE on March 17: Laurel has a great observation in the comments on other actions taken by the administration on privacy.
- SEC recently enacted new rules requiring public companies to "disclose risk management and governance information in relation to cybersecurity, including board proficiency and oversight of cybersecurity risk" in their 10-k/20-f filings and also quick reporting of data breaches. https://www.thomsonreuters.com/en-us/posts/government/sec-cybersecurity-rules/
- FCC recently took action against some cell providers for using easily hackable default passwords, and also revamped its data breach rules for the first time in 16 years https://www.natlawreview.com/article/fcc-cpni-certification-and-privacy-rules-update It's also working more closely with state agencies and that may lead to more rulemaking https://www.wiley.law/alert-FCC-Expands-Privacy-and-Data-Protection-Work-with-States-to-Increase-Investigations
- In 2023, CISA & FEMA launched a joint "first-of-its-kind cybersecurity grant program specifically for state, local and territorial governments across the country" https://www.cisa.gov/news-events/news/cisa-releases-2023-year-review-showcasing-efforts-protect-critical-infrastructure
- In 2022, Congress enacted a strict data breach reporting law for "critical infrastructure" industries https://www.cisa.gov/news-events/news/circia-one-year-look-behind-scenes
- Biden had an executive order on cybersecurity in 2021 that kicked off a lot of this https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/
- Since 2018, an interagency committee called CFIUS that reviews foreign investments/transactions has been ramping up scrutiny of deals involving significant foreign control of critical infrastructure or sensitive data. https://www.whitecase.com/insight-alert/cfius-finalizes-new-firrma-regulations CFIUS has stopped and even unwound deals in a variety of sectors in the last few years. This is something that startup financings or acquisitions involving foreign investors have to think about pretty routinely now when they're structuring deals. he National Venture Capital Association revised its model templates a few years ago to include language specifically addressing CFIUS.
Thanks for reading! Your tips make this newsletter what it is, so please send me tips on weird monopolies, stories I’ve missed, or other thoughts. And if you liked this issue of BIG, you can sign up here for more issues, a newsletter on how to restore fair commerce, innovation, and democracy. Consider becoming a paying subscriber to support this work, or if you are a paying subscriber, giving a gift subscription to a friend, colleague, or family member. If you really liked it, read my book, Goliath: The 100-Year War Between Monopoly Power and Democracy.
cheers,
Matt Stoller
P.S. One really important point of legitimacy for antitrust enforcers is whether the public knows who they are. And there was just a neat test showing that we’re succeeding. In 2022, there was an episode of Jeopardy where the seal of the FTC was a clue, and none of the contestants could answer because none of them knew what the Federal Trade Commission was. Tonight, Lina Khan was a clue on Jeopardy, and a contestant guessed correctly immediately, with several buzzing in.
Yes, this is a weird litmus test, but hey, you’re reading a newsletter about monopolies. So deal with it.
My understanding is that the issue with the bill is not divestiture of TikTok to a US entity but that it also conveys new power to the executive branch, i.e., whoever is president, to declare any future similar entity a national security threat at their whim and shut them down unilaterally without congressional buy in.
As always, Matt, you nail it. It is so important that the Biden administration is moving simultaneously on several fronts. The world of social media is changing so rapidly with so many profound impacts on our lives, especially young voters, that our freedoms may be sucked out of us through the little screens in our hands if we do not find someway to eliminate rampant misinformation.