← All report cards · Registry

Built from public records and checked 2026-10-22. Not an audit of TikTok. How scores are made · spotted a mistake? Tell us.
C
Websites high jurisdiction risk

TikTok

Short-video platform · Score 65/100 · Last checked 2026-10-22

The short version

Different TikTok companies run the service by region. Check which one your account is under before relying on its policy.

Built from: public records, checked 2026-10-22.

Score breakdown

Security record69
Documented incidents and safeguards (public record, not a technical test)
Data jurisdiction28
Which laws and governments can reach your data
Ownership transparency72
How plainly the owner can be traced
Third-party exposure92
Documented analytics, advertising and attribution partners

Who owns it

TikTok→TikTok Pte. Ltd. (outside the US, EU and UK); TikTok USDS Joint Venture LLC (US)→ByteDance Ltd.

Parent based in: 🇨🇳 China

Laws that can apply: PIPL, National Intelligence Law, Data Security Law

Where your data can go

WhoCountryWhy they are involved
Oracle🇺🇸 United States Hosts US user data and the recommendation algorithm in its US cloud; also holds 15% of the US joint venture
NCC Group🇬🇧 United Kingdom Independent overseer of TikTok's European data-security gateways (Project Clover)

Jurisdictions touched: 🇨🇳 China · 🇺🇸 United States · 🇬🇧 United Kingdom

What the public record says

highIrish regulator fined TikTok €530 million over EEA data transfers to China

The Data Protection Commission found GDPR infringements on transfers (€485m) and transparency (€45m) and ordered corrective measures. Source

mediumSecond Irish inquiry after TikTok disclosed EEA data stored in China

In July 2025 the DPC opened a new inquiry after TikTok told it that limited EEA user data had been stored on servers in China. Source

good to knowUS service moved into a majority-American joint venture

TikTok says TikTok USDS Joint Venture LLC was formed in January 2026; Silver Lake, Oracle and MGX hold 15% each and ByteDance 19.9%. Source

Sources

Ownership, locations and data partners come from the company's own pages and filings where they exist. Last checked 2026-10-22.