TikTok, the short-form video app that’s been downloaded 1.5 billion times, is one of the most exciting and goofiest places on the internet, and possibly the only truly fun social media network in 2019. It is also based in China — and that’s the part that has some users, and now, politicians, concerned.

Over the past year and a half, TikTok, where under-60-second videos often feature bizarre memes, inside jokes, and bite-sized sketch comedy, has become the defining social media app of Gen Z, not only in the US but around the world in places like India and Europe. Though it originated as Musical.ly, a nearly identical app known mostly for lip-synching and popular with pre-teens, in 2017 the Chinese internet company ByteDance bought the app and relaunched it as TikTok, with all Musical.ly accounts migrating over to TikTok in August 2018. ByteDance is now the world’s largest startup, estimated to be valued at $78 billion.

german occupation of belgium, 1914 pic.twitter.com/nPmuUjCSk4 — nadia (@nadiajaferey) October 25, 2019

The short history of TikTok is both culturally plentiful — memes like VSCO girls and “OK boomer” have penetrated the mainstream, and becoming “TikTok famous” is now a common goal for high schoolers — and controversial. The company has faced child data privacy fines by the FTC and has been linked to several deaths in India; it has been accused of banning certain content, both politically sensitive and not.

Now, it faces potentially major threats thanks to its ties to China: one in the form of a national security review by the US government, and another in a lawsuit brought by a college student alleging her data had been transferred to two Chinese servers. Here’s the latest on what’s happening, and why it matters.

Why is the US government investigating TikTok?

US politicians’ concern over TikTok began with an investigation the Guardian published on September 25, which revealed leaked documents that showed TikTok instructing its moderators to censor videos that mentioned topics sensitive to the Communist Party of China: Tiananmen Square, Tibetan independence, and the religious group Falun Gong, for instance. The Guardian’s investigation came after the Washington Post noted that a search for Hong Kong-related topics on TikTok showed virtually zero content about the ongoing and widely publicized pro-democracy protests, which were a major topic on other social media sites at the time.

In early October, Sen. Marco Rubio (R-FL) called for a formal investigation into whether TikTok poses a national security risk. “These Chinese-owned apps are increasingly being used to censor content and silence open discussion on topics deemed sensitive by the Chinese Government and Community Party,” Rubio wrote in a letter addressed to US Department of Treasury Secretary Steven Mnuchin. “The Chinese government’s nefarious efforts to censor information inside free societies around the world cannot be accepted and pose serious long-term challenges to the US and our allies.”

Later that month, two senators from both political parties, Chuck Schumer (D-NY) and Tom Cotton (R-AR), followed suit, calling for a “rigorous assessment” of the potential national security risks of TikTok by US intelligence officials. Their memo expressed concern that it could be a target of foreign influence campaigns like those during the 2016 election, and noted that Chinese companies are required to adhere to Chinese law, which grants the government much greater access than the US to the data belonging to private companies.

“Security experts have voiced concerns that China’s vague patchwork of intelligence, national security, and cybersecurity laws compel Chinese companies to support and cooperate with intelligence work controlled by the Chinese Communist Party,” read the letter, addressed to acting Director of National Intelligence Joseph Maguire. “Without an independent judiciary to review requests made by the Chinese government for data or other actions, there is no legal mechanism for Chinese companies to appeal if they disagree with a request.”

The public pressure worked: On November 1, Reuters reported that the federal Committee on Foreign Investment in the United States (CFIUS), which investigates potential national security implications of foreign acquisitions of US companies, would be launching a review of ByteDance’s near $1 billion acquisition of Musical.ly. Specifics of the investigation are unknown, though one person familiar with the matter told the New York Times that the US government had evidence of TikTok sending US user data to China.

TikTok has pushed back against these allegations. In late October it published a blog post stating that it keeps all US user data in the United States, with a backup server in Singapore, and that none of it is subject to Chinese law. “Let us be very clear: TikTok does not remove content based on sensitivities related to China,” it read. “We have never been asked by the Chinese government to remove any content and we would not do so if asked. Period. Our US moderation team, which is led out of California, reviews content for adherence to our US policies – just like other US companies in our space.”

A TikTok spokesperson gave the following statement to Vox: “TikTok has made it clear that we have no higher priority than earning the trust of users and regulators in the US. Part of that includes working with Congress and we are committed to doing so. At the start of 2019 TikTok US brought in a country general manager and a US Head of Trust and Safety who have autonomy over moderation policies. It does not restrict videos based on political content.”

To explain the curious relative lack of political content on the app, TikTok has said it’s because its audience uses it for positive and joyful entertainment rather than politics. In India, however, that’s made explicit: When asked whether criticism of Indian Prime Minister Narendra Modi would be allowed to be prominently featured on the app, TikTok’s operations manager in India responded with a definitive “No.”

Regarding TikTok’s former moderation guidelines, a TikTok spokesperson said in a statement to Vox, “In TikTok’s early days it took a blunt approach to moderation in an attempt to keep the content on the platform light and fun. As TikTok started taking off in new markets, we recognized that this was not the correct approach and began working to empower local teams.”

Part 2: Introducing Neptune and Venus pic.twitter.com/wy7WrAVNNC — Keats (@keatsdidit) November 28, 2019

TikTok’s questionable moderation directives faced further scrutiny in November when it suspended a 17-year-old New Jersey student named Feroza Aziz for posting a three-part video about the Chinese oppression of its Uighur Muslim population. TikTok claimed it did not suspend Aziz’s account for its content, and said her videos were removed “due to a human moderation error.”

The same month, a TikTok whistleblower leaked moderation guidelines to the German publication Netzpolitik that showed moderators are instructed to label any political content as either “not recommended” or “not for feed,” meaning they will not show up on TikTok’s main “For You” page, or will be more difficult to discover in its search fields. As the Washington Post notes, “the changes still give the lie to TikTok’s insistence that ‘political sensitivities’ do not factor into its decisions.”

Why is it a problem that TikTok’s parent company is based in China?

Over the summer, when an app with old age and gender swap filters went viral, many worried that because it was based in Russia, the user data it collected could be used for nefarious purposes. As Kaitlyn Tiffany noted for Vox, though, these concerns were both somewhat valid and overblown — with a touch of xenophobia for good measure. People worried about an app based in another country should be worried about pretty much all of the apps they use, after all: Many of them do things like track your location and analyze metadata in your photos. How to find out what the internet knows about you, at this point, is an almost sisyphean task.

With TikTok, though, there are a few big concerns: One of the more problematic implications is a 2017 Chinese law, which requires Chinese companies to comply with government intelligence operations if asked. That means that companies based in China have little recourse to decline should the government request to access data.

The second is what the Chinese Communist Party might do with that data. Samantha Hoffman, an analyst at the Australian Strategic Policy Institute told The Verge that “The [Communist] Party of China collects bulk data overseas and then uses it to help with things that relate to state security like propaganda and identifying public sentiment to understand how people feel about a particular issue,” she said. “It’s about controlling the media environment globally. Once you have control, you can use it to influence and shape the conversation.”

Beyond launching false information campaigns like those implemented by Russia during the 2016 election, which Sens. Schumer and Cotton referenced in their letter, China wields great control over what its citizens can and cannot access online. With US user data, it could censor what Americans access, too.

“The Chinese government has a history of gaining control over nodes in the information system,” added Sarah Cook, a senior research analyst for China, Hong Kong, and Taiwan at Freedom House. “They don’t always mobilize them right away to harm freedom of expression, until something threatening happens and then they do. It seems clear TikTok is censoring information related to the Hong Kong protests, but at the same time, even if it’s not happening that much now, it’s really only a matter of time before it does.”

What will happen now?

The US government’s review isn’t the only threat to TikTok stemming from its ties to China. On December 2, the Daily Beast reported that US college student Misty Hong had filed a class-action lawsuit against TikTok for allegedly transferring her private data to servers in China. Data included users’ locations, ages, private messages, phone numbers, contacts, genders, browsing histories, cellphone serial numbers, and IP addresses. Though a previous version of TikTok’s privacy policy stated that user data could be sent to China, the suit alleges that the company did so after that policy changed.

Legal documents did not show evidence of the data transfers that Hong describes, according to CNBC, and it’s unclear how much weight the allegations carry. Hong claims that she downloaded the app in the spring of 2019 but never made an account — instead, she says the app automatically created one for her, using her phone number and creating a file of videos that she never posted, including a scan of her face.

She then says TikTok transferred that information to two servers in China, bugly.qq.com and umeng.com, the former of which is owned by Tencent, which also owns the Chinese social network WeChat. The latter is owned by Chinese e-commerce monolith Alibaba. Hong’s suit also says that TikTok uses source code from the Chinese tech company Baidu and Chinese advertising company Igexin, which in 2017 was discovered to be allowing spyware on more than 500 Android apps.

The more pressing matter is surely CFIUS’s investigation, which may come down to how successfully TikTok can distance itself from ByteDance’s Chinese operations, which it has already started doing: In the third quarter of 2019, ByteDance separated TikTok’s product, business development, marketing, and legal teams. Still, it’s possible that the CFIUS review could force ByteDance to sell off TikTok.

This wouldn’t be unprecedented: The gay hookup app Grindr was sold to a Chinese company called Kunlun in 2016, and in March 2019 CFIUS determined that its ownership of the US company caused a national security risk. In May, Kunlun agreed to sell Grindr by June 2020.

CFIUS’s interest in reviewing Chinese acquisitions of American companies is relatively new; as The Verge notes, it began cracking down specifically on tech companies with sensitive user data, at the same time as tensions between the US and China play out over Trump’s trade war.

In the meantime, TikTok users concerned about their data can review the app’s privacy policy by clicking here. There’s nothing wildly unique about its policy versus similar video or social media apps, though you should know that some TikTok users have been surprised to see their own videos show up in ads for the app without being notified (or paid, obviously). When other companies like Facebook and Snapchat have used real people’s content, it has done so with consent. According to the terms of service, though, TikTok has full legal rights to use your work “in any format and on any platform.”

The question, of course, is where that data is going once TikTok has it, and whether the Chinese government wields any control over the content that overseas users see on the app. TikTok moderators censor all kinds of content, both political and otherwise — it’s whether it does so with the express direction of one of the world’s most powerful governments that matters.

This story has been updated with an extended statement from TikTok.

Open Sourced is made possible by Omidyar Network. All Open Sourced content is editorially independent and produced by our journalists.

Support Vox’s explanatory journalism

Every day at Vox, we aim to answer your most important questions and provide you, and our audience around the world, with information that has the power to save lives. Our mission has never been more vital than it is in this moment: to empower you through understanding. Vox’s work is reaching more people than ever, but our distinctive brand of explanatory journalism takes resources — particularly during a pandemic and an economic downturn. Your financial contribution will not constitute a donation, but it will enable our staff to continue to offer free articles, videos, and podcasts at the quality and volume that this moment requires. Please consider making a contribution to Vox today.