Privacy analysis of Tiktok’s app and website

Interesting although I'm having trouble unpacking GDPR discussion from what the app actually does on a granular level and what that could mean for privacy. GDPR is not exactly how I think of those things.

As more time passes I begin to fundamentally believe the modern Internet isn't compatible with the GDPR or privacy as a whole.

Simply the act of enabling JS within the browser is enough to have your privacy violated in thousands of different ways and data sucked up by everyone who wants it.

Simply by installing an app on your smart phone you invite SDK's that are happy to report back all the information the OS freely allows access to because why not? Data storage is cheap and collecting that data is free of charge.

But yes, data about children is collected in the millions, and the truth is there is no possible law that can prevent this from happening because it will happen anyway. One example: If FB detects a baby photo you upload, should it be deleted? I mean that baby cannot possibly consent, and you'd have thought the GDPR or some law meant uploading baby photos is impossible, but that's not the case, FB/Google WILL perform facial recognition on that baby.

Your data will be processed, used, sold and manipulated for as long as you generate it.

The GDPR helps, a little, in some ways, but it's really had very very little effect overall (apart from some damn annoying "we respect your privacy" pop-ups on websites).

If the GDPR was serious, it wouldn't be possible to collect this data at the OS level, like, at all, JS would return nothing, Android apps would return nothing (or fake data, at least).

But the GDPR is not serious, at least in some ways.

> The GDPR helps, a little, in some ways, but it's really had very very little effect overall (apart from some damn annoying "we respect your privacy" pop-ups on websites).

That's because—as far as I can tell—the EU has not become serious about enforcing the law. At least not yet.

It is absolutely possible to pass a law that says "you can't track people", and that's what the GDPR does. It has a semi-loophole for people who explicitly provide knowing consent to be tracked, but there are several big caveats—it must be opt in, you can't trick people to opting in, and you can't punish people who don't opt in. (And really, after all of those caveats, what percentage of your userbase will agree to be tracked?)

Unless there's some aspect of GDPR which I don't understand—and please educate me if there is!—95% of the "cookie notices" currently on the web are obvious GDPR violations.

The GDPR IS the legislation, at least, I thought so.

If you're serious about this, the network shouldn't be making these requests unless you've explicitly allowed it (meaning the request is blocked at the network/OS level).

"Tracking" is not a property of any particular network connection, it the act of correlation in the back end.