TikTok users across the United States now face a privacy policy that explicitly permits the platform to collect precise GPS location data and immigration status, two categories of personal information that carry serious implications for how that data can be used, shared, or sold. The policy change, which references a separate Consumer Health Data Privacy Policy tied to Washington state law, arrives against a backdrop of ongoing scrutiny over TikTok’s data practices and its parent company ByteDance’s access to American user information. For the tens of millions of people who open TikTok daily, the update redraws the boundaries of what the app knows about them and where that knowledge can travel.
How Washington’s health data law shaped TikTok’s disclosure
The connection between a social media app and health data law may seem unlikely, but Washington’s My Health My Data Act, codified as Chapter 19.373, defines “consumer health data” broadly enough to sweep in location information and demographic details when they can be linked to a person’s health status or condition. Under the statute, any entity that collects, shares, or sells consumer health data must publish a separate Consumer Health Data Privacy Policy and obtain affirmative consent before processing that information. TikTok’s U.S. privacy policy now references exactly this type of separate policy, a structural choice that aligns with the statute’s requirements.
The practical effect is that precise location coordinates and immigration status, once collected, can qualify as consumer health data if they are combined with other signals that relate to a user’s physical or mental condition. A user’s GPS coordinates near a clinic, paired with browsing behavior on the platform, could cross that threshold. Immigration status, meanwhile, can shape access to healthcare programs, making it relevant under the law’s expansive definition. TikTok’s decision to disclose these collection categories satisfies the notice requirement, but the statute does not restrict what the company does with the same data for purposes that fall outside the health data definition.
This is where the tension sits. The law demands transparency and consent for health-related uses, yet it leaves a wide lane for the same GPS coordinates or immigration details to feed advertising algorithms, content recommendation engines, or internal analytics without triggering the same consent obligations. TikTok’s policy structure appears calibrated to meet Washington’s rules while preserving flexibility for non-health downstream uses that the statute does not govern.
TikTok’s shifting stance on location tracking
The current policy language stands in contrast to TikTok’s public position earlier in 2022. When reports surfaced that ByteDance employees had accessed U.S. user data, TikTok publicly denied that data had been used to track or target American citizens. At that time, the company pushed back against claims that precise GPS data was being exploited for surveillance or profiling purposes. The denial was categorical: TikTok said it was not using location data in the ways critics alleged.
The updated privacy policy tells a different story, at least in terms of what TikTok now reserves the right to do. By explicitly listing precise location and immigration status as collectible data points, the company has moved from denial to disclosure. Whether the underlying data practices changed or the company simply chose to be more transparent about existing collection is not clear from the available record. What is clear is that the gap between the 2022 denial and the current policy language raises questions about what shifted internally and why.
The timing also matters. Federal lawmakers have spent months pressing TikTok on its data handling, and multiple states have moved to restrict the app on government devices. Against that pressure, a policy update that broadens disclosed collection categories could serve two purposes: it satisfies regulators who demand clear notice, and it locks in legal permission to collect data that the company may have already been gathering without explicit user awareness. For users, the change underscores how quickly a platform can expand the scope of its data collection simply by revising policy language.
What regulators expect and what the law leaves open
Washington’s attorney general has published guidance on what compliance with the My Health My Data Act looks like in practice. According to the state attorney general, companies must make their Consumer Health Data Privacy Policies clearly linked and accessible to users. The guidance stresses that these policies cannot be buried in dense legal text or hidden behind multiple clicks. The expectation is that a person using an app like TikTok can find, read, and understand what health-related data is being collected before they consent.
The attorney general’s office frames these requirements as a way to give users control over sensitive personal information that previously fell outside standard privacy rules. Location data and demographic details like immigration status were not traditionally treated as health information, but the Act recognizes that these data points become sensitive when they reveal something about a person’s health circumstances. A user’s repeated presence near a substance abuse facility, for example, could function as a health indicator even if the app never asks a direct health question.
The unresolved gap is enforcement. No public record of complaints or enforcement actions tied specifically to TikTok’s consumer health data practices under the Act has surfaced. The attorney general’s guidance sets expectations, but without documented enforcement, the practical consequences for noncompliance remain theoretical. Users are left to rely on company assurances and policy text, rather than tested legal outcomes, to understand how their most sensitive information is actually being handled.
That uncertainty is compounded by the law’s focus on health-related uses of data. If TikTok uses precise location to infer visits to clinics or pharmacies, the My Health My Data Act clearly applies. But if the same GPS coordinates are used to measure foot traffic near a shopping district or to serve location-based ads unrelated to health, the protections may not attach. Immigration status presents a similar ambiguity: it can influence eligibility for public health programs, yet it can also be used for broader profiling, segmentation, or risk scoring that falls outside the statute’s core concerns.
Implications for users and the wider privacy debate
For individual users, the most immediate consequence of TikTok’s policy shift is informational rather than operational. The app now tells people, in clearer terms, that it may collect precise location and immigration status. That knowledge can inform decisions about whether to enable location services, what details to share in profiles or messages, and how to weigh the benefits of the platform against the risks of expanded data collection. But notice alone does not change the underlying power imbalance between a global platform and its users.
The policy update also feeds into a broader national debate over whether existing privacy laws are adequate for apps that blend entertainment, social networking, and data-driven advertising. Washington’s law is among the more aggressive state-level efforts to treat health-adjacent data as sensitive, yet even it leaves room for extensive tracking and profiling outside a narrow health context. Other states may look to this model as they consider their own rules, and TikTok’s approach could become a template for how large platforms comply while preserving broad discretion over data use.
In the absence of a comprehensive federal privacy statute, state laws like Washington’s create a patchwork of obligations that companies must navigate. TikTok’s explicit reference to a Consumer Health Data Privacy Policy suggests that it is building compliance mechanisms state by state, rather than adopting a single, highest-standard approach nationwide. That strategy may minimize legal risk in specific jurisdictions while leaving users elsewhere with fewer protections and less clarity about how their information is treated.
Ultimately, TikTok’s decision to formally acknowledge the collection of precise location data and immigration status crystallizes a trend that extends beyond any one app: the steady expansion of what companies claim the right to gather about their users. Washington’s My Health My Data Act nudges that expansion into the open by demanding separate disclosures and consent for health-related uses, but it does not fully resolve how far platforms can go in monetizing or analyzing the same data for other purposes. Until regulators test the limits of these laws in concrete cases, and until companies offer more granular controls over sensitive categories like location and immigration status, users will continue to shoulder much of the risk without a clear view of how their digital footprints are being traced.
More from Morning Overview
*This article was researched with the help of AI, with human editors creating the final content.
