“Tiktok is an intermediary as defined under Section 2 (1) (w) of the Information Technology Act, 2000. TikTok does not generate content is hosted on the platform,” said Bytedance in its response to 21 questions raised by MEITY in July about TikTok and Helo’s policies and practices. TikTok is an intermediary under Section 79 of the IT Act, 2000, and with all requirements under the Intermediaries Guidelines Rules, 2011, said Bytedance. In fact, both TikTok and Helo are also compliant with Section 8 and 9 of the draft amendments to the Intermediary Rules 2018, that require takedown of unlawful content within 24 hours, and proactive monitoring of content.

In July, RSS affiliate Swadeshi Jagran Manch, had written to the PMO in July, raising issues around TikTok. The PMO had told MEITY to “keep a close watch” on TikTok. MEITY had sent TikTok/Bytedance a list of 21 questions on data collection, its intermediary status, and steps to protect children, among other things. MEITY disclosed via RTI the questions it had sent to Bytedance/TikTok, and the company’s response to the questions. Here is what the RTI revealed:

What data do TikTok and Helo collect? Both TikTok and Helo collect personal and non-personal data about users, on the basis of consent and full disclosure. Data collected is guided by i) purpose limitation: only information necessary for functioning of the platform is collected, and ii) transparency: apps disclose the data being collected in their terms of use and privacy policy. This makes both platforms compliant with Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data and Information) Rules, 2011.

“The following information is collected:

  • user name, email address (if provided), phone number (if provided), profile information(such as profile photos and introduction), content users post or provide such as videos, comments, messages, contacts to find friends.
  • Information users choose to share from their social networks such as their profile information, age, and friends list
  • Technical information that is collected such as login history, IP address, general settings and privacy settings, device model, device system, network type, app version, identifier for advertising purposes, and location information.
  • Behavioural information such as browsing activity to predict what content users are likely to engage with.
  • Information from third parties such as from advertisers and other social networks.
  • Information obtained through surveys, participations in challenges, sweepstakes and contests.”

Where does Bytedance store data? Will data be shared with a foreign government, third-party, or private party? Data of Indian users collected on TikTok and Helo is stored in US and Singapore. Bytedance doesn’t transfer this data to any governments “except in response to valid requests from Indian regulatory and government agencies”. TikTok and Helo generate revenue through ads, and hence data about the platforms is shared with advertisers and service vendors. This data is either de-identified or anonymized.

TikTok is working on localising data: Bytedance is taking “a significant step” towards establishing a high-capacity data centre in India within 18 months.

How does Bytedance define Helo? “Helo is a politically neutral entertainment and online content sharing platform. We pride ourselves on being India’s leading news aggregation and news sharing platform operating in approximately 15 regional languages.” All content on Helo is user-generated or sourced from third-party media organisations.

Bytedance’s response to ‘morphed’ policital ads on Helo during elections: Bytedance “categorically” denied that money was paid on Helo’s behalf for floating political ads, it said this was a case of “ill-informed reporting” by news organisations. It’s worth noting that Facebook had taken down 11,000 political ads by Helo during the Lok Sabha elections, and disclosed this removal in its political ads library.

  • The ‘morphed’ ads were news articles by Helo users: Bytedance said that certain political news articles posted by Helo users were advertised on Facebook via Helo’s automated ad tools. Such ads on third-party platforms are a common digital marketing practice among technology companies, Bytedance said. Bytedance/Helo didn’t create the content, instead user-generated content already in public domain were picked up by automated ad tools. Bytedance reiterated to MEITY that there were fewer than 1000 impressions/views of this content, as per Facebook.
  • Helo took the content down once it was informed: As soon as Helo was informed that the content was politically sensitive or objectionable, they were removed; and the app’s “internal algorithms and tools were adjusted and recalibrated to examine such content more effectively”.
  • Bytedance stopped serving paid political ads during elections: After this, Bytedance “made a conscious decision” to not serve any paid political ads in India during elections “to ensure that there could be not even the perception of any interference whatsoever with the Indian electoral system through our Platforms”. Again, Bytedance reminded the government that other platforms “both solicited and continued to accept large volumes of digital political advertisements during this time” and that a majority of them did not even receive pre-certification from the ECI’s media certification and monitoring committees (MCMC) as is required under electoral law.

What is TikTok’s Age Gate feature? Does it restrict users below 18 years? Will it apply to already registered users? TikTok has an age gate of 13 years, it requires an in-app prompt asking users to self-declare their age. It’s meant to permit only users above 13 years on the app.

Why does TikTok have an age-gate of 13 years in India, when people achieve adulthood at 18 years in India? Other jurisdictions have identified 13 years as an appropriate age gate. The US federal law Children’s Online Privacy Protection Act (COPPA), the EU’s GDPR, and Canada’s PIPEDA, and the UK’s Information Commissioner’s Office (ICO) all set the minimum age threshold for processing of children’s data without parental consent at 13 years. Google and Apple app stores have similar restrictions for childen below 13 years.

No such regulation currently exists in India, but Bytedance implemented the Age Gate to be “in-line with international standards of child protection”. Even in India, the Justice Srikrishna Committee Report acknowledged 13 years as a appropriate legal threshold:

“We are aware that from the perspective of the full, autonomous development of the child, the age of 18 may appear too high”. Given that there is some uncertainty around what should be the appropriate age to qualify as a child in this context, the law should at the very least include a principle that the determination of the “best interests of the child” would vary depending on the age bracket that the child belongs to.
Justice Srikrishna Report (quoted in communication with MEITY)

Bytedance submitted that setting the age limit at 13 years allows online platforms and lawmakers the liberty to distinguish between the rules that should be set in place for a child of 5 years, as against a child of 15 years. Besides, YouTube and Facebook apply the same minimum threshold of 13 years to their platforms, including in India.

Does TikTok have a mechanism to identify users registered with fake information or age? TikTok is rated 12+ in the App Store and Google Play so that parents can block their child from downloading the app.

On FTC’s fine on TikTok on child privacy issues: do those changes apply to the TikTok app available in India? The FTC settlement was for Musical.ly, which Bytedance later acquired in December 2017 and merged with TikTok in August 2018. The FTC investigation’s into Musical.ly had started in December 2016 (before it was acquired was Bytedance), for non-compliance with the US Children’s Online Privacy Protection Act. Bytedance overhauled Musical.ly’s US operations to be compliant with the law. Besides, the settlement involved only a civil penalty, there was no punitive action, Bytedance said.

Despite there being no obligation in law to do so, we subsequently also voluntarily extended the age gate functionality to the Indian market, and are now in the process of rolling this out to our entire user base in order to segregate users on the basis of age. It may be noted that we are the first major global intermediary platform in India to do so. . .

. . . All of the observations made by the FTC emerge out of specific obligations under the COPPA Act, none of which exist currently in the Indian context.

What about the UK ICO’s investigation into TikTok? In February 2019, TikTok received inquiries from the UK Information Commissioner’s Office which indicated that the FTC settlement had attracted ICO’s attention regarding TikTok’s practices and policies around under-age users. The inquiries generally relate to data collection, data processing, age safety mechanisms and other statistical information on the platform. TikTok has submitted responses. Presently, there are no charges, or violation of any law found against TikTok.

TikTok claims to be an intermediary. MEITY asked it to show its compliance with each rule in the IT (Intermediary Rules) 2011, and other applicable Indian laws.

1. Bytedance said that both TikTok and Helo are in full compliance with Section 79 of the IT Act 2000 and with Intermediary Guidelines. “Tiktok is an intermediary as defined under Section 2 (1) (w) of the Information Technology Act, 2000. TikTok does not generate content is hosted on the platform.” TikTok is compliant with all Intermediaries Guidelines Rules 2011 under the IT Act, which include due diligence requirement, Community Guidelines requirement, information takedown, among others. TikTok is also compliant with the following rules under the IT Act:

  • Reasonable security practices and procedures and sensitive personal information under IT Rules, 2011
  • Procedure and Safeguards for Interception, Monitoring and Decryption of Information, under IT Rules, 2009
  • Procedure and Safeguards for Blocking for Access of Information by Public, under IT Rules, 2009

2. TikTok and Helo are also compliant with Section 8 and 9 of the draft amendments of the Intermediary Rules 2018, that require takedown of unlawful content within 24 hours, and proactive monitoring and takedown of content.

Chief Nodal Officer Anuj Bhatia is TikTok’s designated officer to receive interception requests, for blocking requests, and is also the grievance officer.

Does TikTok use influencers? Would it still be an intermediary?

MEITY’s specific question to Bytedance was “Does TikTok use the services of ‘Influencers’? In such case, TikTok will not be an intermediary.”

1. TikTok is a passive host, and is an intermediary: TikTok does not pay users to create content, does not interfere with or control the content creation, its only a passive host and enabler. Since TikTok only carries out functions such as receiving, storing, and transmitting information on behalf of users, it remains an intermediary under the Section 2(1)(w) of the IT Act.

2. TikTok has some users who promote the platform, but it has Safe Harbour: “TikTok does engage with certain users who can promote the platform”, and teach other users on “how to get the most value out of the tools available on the platform”, but such marketing activities to encourage usage of TikTok does not result in:

  • initiation of any transmission
  • selection of the receiver of a transmission, and
  • modification of the information in a transmission,

TikTok’s function is limited to providing access to the platform, and hence its entitled to safe harbor under Section 79.

How many employees and offices does TikTok have in India? TikTok’s India team has over 1,000 people, consisting of over 450 full-time employees, over 250 contractors and about a 500 people working with its vendors. It has offices in Delhi NCR, Mumbai, Bangalore and Kolkata. The company expects to have over 2000 people in India by the end of 2019, and 5000 employees by the end of 2020.

Bytedance’s content moderation team: Bytedance said it has 1,000 people in India, including contractors and vendors, moderating content across approximately 15 languages. Bytedance plans to expand this to 3,000 people by 2020.

To what extent is artificial intelligence and human intervention used for content moderation? How much content has been removed? TikTok uses a combination of machine learning tools and several rounds of human moderation Machine models identify pornographic and violent content, and send these videos of human moderators. TikTok takes under 3 hours on average to remove flagged content.

Which are TikTok’s 10 top markets? TikTok’s top market by user base is India, where it had 200 million registered and 120 million active users as of June 2019. Its second largest market is USA, then Indonesia. This is followed by Pakistan, Vietnam, Turkey, Thailand, Japan, Russia, and Egypt.

The minimum age as specified in the terms of use is 13 years in all these markets, with an exception of 14 years in Indonesia.

How many user complaints has TikTok received? Does TikTok publish any transparency report? Between TikTok’s launch in India (in January 2017) and July 2019:

  • 1.6 million (1,684,573) videos were reported, of which 134,844 videos were removed
  • 700,257 accounts were reported, of which 181,926 accounts were permanently banned

Currently, TikTok does not publish a transparency report of content take down requests from law enforcement agencies specifically for the Indian market. But the company is working to “implement such [a] transparency mechanism”.

What kind of information have law enforcement agencies sought from TikTok?  Bytedance has received 127 requests from law enforcement agencies between January and mid-July 2019. Law enforcement agencies in India have sought user details like registered mobile number, email id, other social media accounts associated with TikTok, IP addresses tagged to activities of users.

Does TikTok offer its Filter comments feature for languages apart from Hindi and English? TikTok’s “Filter Comments” is in Hindi, Tamil, Malayalam, Kannada, Telugu, Gujarati, Marathi, Sanskrit, Odia, Bengali, Kashmiri, Punjabi.

On the assertion that there’s obscene content on TikTok: 

MEITY to Bytedance: “Please explicitly confirm your policy on the same and the preventive/corrective measures taken by TikTok to ensure that such contents (violating section 67/67A/67B of the IT Act 2000) does not appear on the platform”.

The assertion that there is a lot of obscene content on TikTok is “incorrect, and highly exaggerated”. TikTok has a zero-tolerance policy towards content that violates its community guidelines, and only 0.00006% of videos available on the platform have been reported by users. TikTok reiterated its safety and reporting features, which include age-gate, in-app reporting, a grievance officer, among others. It has also removed 6 million videos in India for violation of its community guidelines and other laws.

Bytedance reminded MEITY that in under Sections 67, 67A & 67B of the IT Act, an intermediary’s liability is triggered only if the platform fails to meet due diligence requirements under Section 79 and Information Technology (Intermediary Guidelines) Rules, 2011, which is contingent upon ‘actual knowledge’ of any obscene content on the platform.

Response to allegation that TikTok and Helo have become “a hub for anti-national activities”: Like all social media platforms, there’s a possibility of “certain types of objectionable content being uploaded by users” but the company said it has a zero-tolerance policy for content that is unlawful and violates community guidelines.

Our Platforms are not a forum for any action leading to the polarization of society by amplifying political and controversial content.

Does TikTok have any default mechanism to prevent download of users’ videos? TikTok incorporates “privacy by design”; it allows users to disable downloading of their content, this feature is intended to prevent further spread of a user’s videos to other platforms, thereby preventing misuse, abuse, violation of IPR, or invasion of privacy. TikTok also offers “private accounts” which ensures that all videos on their account cannot be downloaded; users can also choose to restrict downloads on specific videos.

What is TikTok’s Restricted Mode? Why is its password valid for only 30 days? Restricted mode is a password-based feature that allows parents to limit content that may be inappropriate for minors. The parents can set a password, this will be valid for 30 days. The 30-days password reset is meant for user convenience, TikTok implemented this after feedback from users that they had forgotten or lost their password, and found it difficult to unlock the restricted mode.

Accordingly, the password auto-resets every 30 days, thereby allowing continued engagement and control of the adult supervising the usage of TikTok by children / minors. Such a feature also ensures that the integrity of the password is maintained over a period of time and compels the adult supervising the minor to regularly monitor their child’s activity.

Does TikTok’s ‘Risk Warning Tag’ appear immediately after video uploads? ‘Risk warning tags’ is intended for users to flag risky content that is legally inappropriate, violates community guidelines, or encourages unsafe activity. Risk warnings tags warn users of the nature of the content before they view it. They are added when such content is (i) detected as risky by our automated systems, (ii) flagged as risky by our moderation teams, or (iii) reported as risky by our users. Such content is excluded from the feed of all users under ‘restricted mode’, thereby excluding minors from such content.