TikTok unlawfully tracks shopping habits and use of dating apps?
noyb.eu205 points by doener 14 hours ago
205 points by doener 14 hours ago
I guess it's pretty much impossible to stop these companies from gathering data, there's too much money in it, it's too easy to implement, and there's no cohesive force to stop them. I'm wondering whether a crowdfunded effort to feed fake data into these systems would work so we overwhelm them and make their plans a bit more difficult.
"The only winning move is not to play."
If you look at these systems that same way some people look at casinos - places specifically designed to take your money - you realize there isn't a way to change them nor improve your overall experience with them. You just don't go inside. I'm kinda hoping that it becomes the trend in the next few decades to completely abandon these algorithm-driven data-hoarding attention-stealing apps. I've been calling it "digital hygiene", personally.
I used to be highly addicted to scrolling. Tiktok, reddit, instagram, everything. It nearly cost me my relationship and I swore it off ever since. I’ve been offline those apps for a few months now, and have never felt better. Cant believe what i was allowing to happen to my attention!
Its the endless shortform videos. The brain was not meant to switch contexts every 20 seconds for 3 hours straight. I replaced most of my screens with e ink, and only allow myself to scroll through text based sites and rss feeds
Interesting concept. I'd like to hear more about your process. What e-ink screen(s?) are you using? Any good text based websites to recommend?
On my desk I have 2 monitors, one normal 24" and one dasung paperlike. If I need to watch a video or do work that needs high refresh, I just switch to the other monitor. One side benefit of this is you can't use your computers in the dark anymore, you have to turn on the lights like you're reading a book. This does wonders for your eyes.
The e ink screen I use the most is a boox 10.3 tablet. It does have internet and can run android apps. So I can read rss feeds, hacker news, manga, ect. I don't do any "serious" work on it and don't sign in with my main google/apple accounts. The build quality for the price is superb, and its the first eink device I've had that feels premium like an ipad. Its also super thin and the battery lasts me ~2 months on a charge.
As far as fun text based websites, you're already on the best one :) But I also have a million RSS feeds that I read to get the news.
Not who you asked, but personally I'm using an Onyx Boox Palma, which is a phone-sized Android device with an e-ink screen. I have Readwise's Reader on it, which doubles as "read later" and RSS feed reader, and works offline. Pretty happy with the workflow overall - I use it extensively when travelling and having time to waste (e.g. waiting at an airport or while on the plane/train).
Note about Onyx, they're kind of violating GPL by refusing to publish source code. Also, their Android devices are a bit special and you have to jump through a couple of small hoops at set up to be able to use Google Play (nothing special or complicated).
It's important to highlight that while it's phone-sized, it's not a phone and doesn't have a modem
Youtube: There are a few long-form creators I watch, maybe 4 hours a month of content. Besides that, viewing history is off, no apps, browser extensions block mostly everything (comments, suggestions, etc.)
Instagram: I have a 15 minute daily timer, because I sometimes post, and I sometimes receive DMs.
Reddit: Fully blocked, I think I ublocked everything.
Tiktok: I won't even download it ever again. It has an algorithm like no other for sucking me in. Dangerously addictive.
Facebook? Deleted it completely around 2013, so no idea what's going on there.
For those that are subscribed to Youtube channels: no need to have account. Youtube has RSS.
IMHO, the account is esp. useful for one thing: selecting explicitly which channels you want to block - if you do this over some time, then you see that YouTube content is by far not unlimited, acutally rather limited if you select only really interesting things for you :-))
How's the dating scene where you are? Whatever bubble I'm in, in the US, while I could not be on Instagram, that would be making things harder on myself.
I totally get this sentiment and I think it applies equally to the actual dating apps, these apps are all garbage fires that you don't really want in your life, but they do have utility if you want to date.
So an idea I've been thinking about lately, is that evolution didn't produce humans that were wired to date forever. These app publishers undoubtedly would prefer that you keep using their apps until you die, so they're happy to see you also keep dating until you die. But that shouldn't really be how things go and it's not how most of us are wired. Most humans throughout history went through a brief courtship period and then they settled down with someone, even if that person wasn't perfect.
The app has utility in that courtship period, but the activity itself is meant to be temporary, possibly even brief, and ultimately give way to something else. The app publisher has an incentive to make you forget that.
I’m curious what you mean by this. Most of the guys I know treat their Instagram accounts like their LinkedIn accounts: It has enough information and occasional updates with major life changes, but they don’t actively engage with it all the time. Just let it exist and respond to any messages if they come in. Would that work, or are you saying the dating scene in your area requires some type of active constant engagement with Instagram?
No, that really wouldn't.
Instagram is a tool to help women manage their fan club of orbiters and get validation from them on demand (which is what makes so addictive for women). It might look like "hey there's all these hot women here if i hang out here i will get dates with them" but that's the mirage.
Hmm in our community it's also a way to connect when you meet someone at parties, that doesn't expose too many details like your real name or phone number.
Why were you scrolling, what were you scrolling for? Were you trying to fill some void? :D
I do scroll on Instagram, but it was mainly to share some reels with my girlfriend, no other purpose. It was not addiction. I tend to forget to check hers (which she does not like so I try not to), and when I check hers, I look at some reels to send back, then I close the app.
I did scroll on Facebook when I started using it recently, and it might be leaning towards the addiction side, but I stopped myself from doing it because it is a waste of time and I realized everyone is arguing there, and their arguments are horrendous. I feel like were I to read it all day it would dumb me down.
But yeah, I think the best move is to not play at all. Use Facebook only when you absolutely must. Same with anything else. If you have Discord, you may use it for discussions, whether technical or not, but it can be just as addictive as the other website.
This is so true. I can't signal boost it enough.
I'm also a recovering social media addict, it was a slow and painstaking transition but the benefits in terms of attention, concentration and attitude have been profound. The main metric for me was going from almost 5 hours a day of phone time 2-3 years ago, to about 1 hour today. Of course the socials still snuck in on other devices but that was the main thing which killed the poison at its root and then eventually all the offshoots withered.
The apps condition you to come back through a feedback loop. Once I broke the feedback loop enough times the whole idea of going into one of these apps or sites and watching my life disappear into it started to feel revolting, like I just knew it was going to make my day worse not better, then the hold was gone.
The next battle I see on my horizon is that I sometimes watch 20-30 minutes of YouTube subscriptions in the morning with my coffee. There's some good content, but sooner or later Google's going to try and kill my ad blocker and probably look for new ways to creep that time up into hours instead of minutes. I know it's coming and I'm ready to die on this hill rather than lose my morning. I will do absolutely anything to continue blocking ads, up to and including saying goodbye to YouTube, to Google, to a web browser, putting only TUI interfaces on my TV, anything.
My favorite small act of defiance this year was purchasing a $120 deluxe hardcover edition of the Lord of the Rings trilogy - that's a great work I enjoy enough that I'm happy to read it many times over the course of my life, it improves my attention span instead of worsening it, and it won't show me a single ad ever. So I figured in terms of recreation, it's one of the best investments I could make. Perhaps several of such omnibuses on a shelf next to a comfortable armchair is the best defense against Big Tech.
> I've been calling it "digital hygiene", personally.
Don't forget mental hygiene. Letting these apps have access to your brain causes legitimate brain damage in the same way smoking causes lung damage.
They're not identical concepts, but I've been bringing up "dopamine hygiene" a lot lately and it seems to resonate with people.
Given that these companies tend to converge on addiction as their business model, I think there's a lot of overlap.
It seems an absurd amount of people misuse the term dopamine, I found this video https://youtu.be/x6_Ukic1tRM?t=1297 (in Polish, but there are subtitles and dubs). If you want to continue to spread "manipulative disinformation", by all means, some people have to be evil, but just be clear that it is pseudoscience up front.
It's a pet peeve of mine as well and I'm happy to see there being a pushback against it.
it is possible through legislation. slap them with the fine equal to their two previous years ebita combined and all this stops within an hour. of course not like people that need to pass a legislation aren’t bought for a fraction of that.
these things are why frequent comments on HN that go “this company is not using our data for training, it is in ToS etc…” makes me literally LOL.
Please spend 5 seconds thinking about this. It isn't impossible, it isn't earnestly valuable now that gambling has taken ad fraud's throne (guess what the throne is for), and fake data doesn't work.
Faking data is a good method, but has issues it seems.
Moxie tried that with GoogleSharing system back in the day.
Not really sure what the biggest downsides were, but it was discontinued.
American legal system will curb stomp any tiny company on the other side of the world if they dare to draw an outline of Mickey Mouse, and you're saying that this same nation can't stop big abusive companies?
The big companies simply gives the predisent of the USA a made-up peace prize or a gold Rolex and get exempted.
I didn't realize how big a loophole existed in the American legal system until this current president. It's basically entirely up to the president which federal laws get enforced, and against whom. Congress is entirely powerless, unless they can get 67 senators to convict during impeachment. It's the only lever they have.
Participating in the extraction economy is certainly a choice.
Young people complain about being worse off than their parents. Sure, the income gap has exploded, and there are many factors that are making things worse, but what exacerbates this is our complacency.
First, people are just more miserable in general because everyone on social media seems to be living the "Miata life", to quote "Workaholics".
Do you see any starter homes being built? I don't. All I see is starter mansions. Everyone thinks they are entitled to one at 26, while THEIR parents lived in a starter home until they could afford something bigger, at 45.
Secondly, and it's more to the point - spending money has never been easier. Want. Click. Get. Within hours. All this tech revenue is coming from somewhere.
What was the last time you audited your subscriptions? How much do you spend per year? If you watch two shows and a couple of movies on a streaming service, is it really worth the $240 per year? Do you listen to 12 books per year to justify the $180 Audible subscription just to break with the a la carte price? And so on. This stuff adds up. But, sure, it's CONVENIENT. These companies are counting on your laziness.
Become a responsible consumer, refuse to participate in being a product. Yes, I know, it takes effort and focus, but it's not like we do no have the power to walk away.
In the attention economy you have to vote with your attention.
Block, ignore, disengage from, and scorn any software or service that behaves this way.
Make fun of your friends when they use these apps and use peer pressure to dissuade them from using them. These services need to be uncool.
Be the change you want to see. Research alternatives. Provide alternatives. Make alternatives easier, better, and cooler.
Choose principles over convenience and encourage your peers to do the same.
Earlier this year I downloaded TikTok once, I needed to access some very niche videos and couldn't watch them without getting an account. I never added anybody, and I never associated with any other socials, but somehow I started getting emails from TikTok that one of my NEIGHBORS were viewing my profile! Even used their full name. I deleted the account and uninstalled the app.
I had a creepy one like this happen to me with Linkedin. I sold my uncle's guitar on craigslist using a throwaway gmail address to a guy with a very unique, rhyming name that I would never forget (ie - Gerald Herald). Immediately after he left with the guitar linkedin suggests I add him to my professional network. I never logged in to linkedin from that gmail, never looked this guy up, don't have linkedin app installed on my phone, literally met him for 60 seconds to get cash and hand over a guitar. It still weirds me out.
Did you both have location on? Were you both connected to the same wifi?
Did he do any research on you beforehand?
Did you and him both search the same guitar model, in the same days, while in the same area?
This is because when you click a shared TikTok link, your account and the sharer's accounts are associated in a social graph. The sharer will see your account as a suggested friend and vice versa.
No sharing link needed. Before I deleted my Facebook account more than a decade ago, it was already suggesting random people I met once IRL and are at least two hops away in terms of existing FB relationships. I had very few friends (~20 IIRC).
Id suggest FB & co also uses location tracking & proximity to expand their social graph continuosly? Most people just dont care about these privacy settings, and if you have a vast number of users, it doesnt matter if ther are 10% "techsavy people" because the mass is just big enough to create profiles on which you then easily can compute/guess other connections & joints in the social graph.
Yes, that’s my assumption, although IIRC I never gave FB location permissions, so it might be temporarily sharing an IP address by being on the same WiFi or something. Come to think of it they had access to WiFi SSIDs as well in the early days even when location permissions were off.
yt-dlp will allow you to download individual videos and even entire channels.
TikTok knows where you are and where they are. Easy connection to make.
Do you have to share your location with it? I don't use it but similar apps like Instagram don't have my location permission.
I uninstalled it after about half an hour of use when it became clear the app kept pushing me to watch videos with Andrew Tate (with him on the top half of the screen and random racing games on the bottom half). It’s dystopian.
Pretty sure TikTok and Instagram are sharing data somehow as well. My feeds are near identical.
I don't know, maybe they are colluding, but it is funny to default to that assumption over both platforms just delivering you the same content because you have the same behavior across both apps.
Notably, this started happening the day that I made my TikTok account public. My Instagram feed began to be a copy of my TikTok feed. The exact same videos. Even after changing my Tiktok back to private and deleting all of my followers, the feeds are still identical, every single day. My behavior is not. On Instagram, I follow and interact with very different accounts than on TikTok. It seems to me that Instagram is buying or accessing TikTok's data, and it is not through advertising providers, because the identical content is coming directly from Instagram/TikTok and not promoted ads.
There are three possibilities though. One is Instagram copying TikTok, without their knowledge, the other is Instagram copying your TikTok feed with their knowledge but not their blessing, and finally Instagram copying your TikTok feed with TikTok's knowledge and their blessing. If we take a look at http://TikTok.com/robots.txt, it seems if you make your TikTok public, TikTok is happy to let Instagram take a look at it (but not a number of AI crawlers). What Instagram does with it is up to them, but it's in robots.txt.
The simplest explanation would be that Instagram crawled my TikTok's account's followers and is curating my Instagram reels based on that point in time.
However that's not what happened, because my "following list" is restricted to be viewable by "only me", even though my account was public. "Public" just means that you can view my videos without me accepting a follower request. And I don't have any videos anyway.
So I can only deduce that setting it to "public" flipped some bit in either Instagram or TikTok's backend to where now they both are sharing the same or very similar data to curate my feeds.
In the book "careless people" it is highlighted that Facebook embedded spyware in their app which tracked other apps that were installed/used on the phone. This allowed them to figure out that so many of their users were installing WhatsApp, and enabled the legendary WhatsApp purchase. It is very much possible that Instagram is reading some sort of temporary files created by TikTok and extracts data using this method.
Facebook/Meta has a proven track record of fetching all data from your phone, even when abusing security vulnerabilities to do so. And the clowns at Apple can't even fix RCEs in their network-exposed applications, I'm not convinced the separation between apps is flawless.
They don't have to collude, the third party advertisers that collate and provide shadow profiles do that work for them.
The advertisers don't get the raw data feeds necessary to do that.
What raw data do you mean? They get so much data, it's hard for me to imagine anything that might be missing relevant to this context to be honest.
Not sure if they're explicitly sharing data, but there does seem to be something that's sharing data across the platforms. When I buy something from Tiktok, the ads for the same thing shows up on my instagram almost instantly. Doesn't necessarily mean they're directly sharing data of course, could be a third party too. But as a consumer that has very little difference for me.
If you buy something from Tiktok, you presumably visit the merchant's website, which almost surely will have chosen to have a tracking pixel that sends data to FB (Instagram). You can read a bit about how tracking pixels work here: https://jvns.ca/blog/how-tracking-pixels-work/
In this case it's not Tiktok and Instagram that are sharing data with each other, but the product website that is choosing to share data with both of them.
It's because you are the exact target demographic consumer for that product, and it's visible in your behavior patterns when using your apps combined with what they know about you (age, sex, location, demographics, etc.)
Much more likely an explicit retargeting ad network that doesn't realise they already bought it.
Retargeting has been a thing for like 15 plus years now. Visit website for knives, ad network tracking cookie notes that down, same ad network later serves you ads for the same knives. Or some convoluted data sharing network that has the same outcome these days.
It's not much more likely. People don't realize but demographic targeting works really well. When you are a certain age, certain gender, living in a certain area, with a few other inferred characteristics, you're very likely to be talking about, thinking about, and buying a small set of product types
I think the OP knows best what happened to them, so I will leave it up to them to decide. But to get targeted for a product you just looked feels like pretty standard retargetting.
I don't disagree with your point that demographics can be very good and sometimes uncanny, that aspect I agree with. It is just the timing that leads me to believe it is retargetting.
Why would two competing apps share data with each other?
Facebook has a track record of abusing security vulnerabilities to snoop up information about other apps installed on your phone. It might be as simple as Instagram reading leftover temp files created by the TikTok app.
If two profit-seeking organizations can profit more from collaborating, why wouldn't they? Increasing profit is not zero-sum.
> TikTok was only able to receive this information with the help of the Israeli data company AppsFlyer and Grindr itself.
So basically, the TikTok app is not spying on your dating apps - your dating apps are willingly selling your information to them, through intermediaries.
This means uninstalling tiktok won’t help. And worse, many other companies are getting your dating info too.
Grindr had a big data "leak" in 2024.[1] Not a "leak", really, just ordinary reselling of people's gay and HIV status. In 2025, a data broker who resold Grindr data also had a big breach. That wasn't Grindr-specific - it included Temple Run, Subway Surfers, Tinder, Grindr, MyFitnessPal, Candy Crush, Truecaller, 9GAG, Microsoft 365, and others. But not TikTok, because TikTok monetizes that info themselves.
[1] https://thehill.com/business/4614940-grindr-sold-hiv-status-...
[2] https://www.pcmag.com/news/major-data-broker-leak-might-have...
Flagged - headlines ending with "?" should be banned.
I wonder if that "fake permissions" Android sandboxing thing from like a decade ago still works.
The right to lie to apps should be part of the new tech Magna Carta
I hate to sound like a those pesky Kagi supporters, but that is built into Graphene OS.
It's not, though. If you deny location permissions the app will still know and pester you to enable. Same with other sensitive permissions with the exception of internet.
Thats a shame, I used to be able to pass fake location data through on an app by app basis using an Xposded module. That was probably 10 years ago though.
This has been a thing for rooted devices for a long time with faking senstive data on android Although i wouldnt root any sensitive devices nowadays
Pi-Hole only works when the tracking / ad scripts are hosted from different domains than the actual content.
Don't worry, when you blackhole the entire tiktok domain, you'll still be able to use grindr.
Or did you still want to be able to view tiktok?
Sorry. Can't help you there. Or can I? https://www.torproject.org/download/ or https://chromewebstore.google.com/detail/proton-vpn-fast-sec...
TikTok will de-anonymize you and connect you back to the ad networks in days, speaking as someone who tried really, really hard to not get it to do that.
They probably have the most sophisticated fingerprinting ever created.
Yep! And luckily Tor Browser works pretty hard at defending against that. It even goes so far as to box the rendered page resolution so it cannot be connected to the same resolution as your main browser.
But you can take first steps by using a simple dns proxy to make things more difficult.
I don't mean that, I mean behavior. The algorithm that is TikTok is running a test fingerprinting you with every video shown. It's like stylometry on steroids.
Honestly that probably makes it easier to fingerprint you. How many people do you think actually use Tor? Instead of needing to identify you from millions of users, now they just need to identify you from the five or so Tor users
> Don't worry, when you blackhole the entire tiktok domain, you'll still be able to use grindr.
Grindr can still sell your data.
It was a response to same-origin tracking. I didn’t claim grindr would not sell your data.
People deserve privacy even if they aren't tech savvy enough to use pi-hole, even when they aren't on a network they control, even if they don't know their privacy is under attack.
Highly recommend people check out this simple alternative. It's like a better, modern dnsmasq.
Setting up a whole-home adblocking solution takes a few minutes with pi hole, and it's got a very functional web interface for actions such as unblocking specific sites for specific systems on your network.
That dns proxy looks intriguing but looks like quite a bit different from the simplicity of pi hole.
dnsproxy is a single binary that does everything, very simple.
My nontechnical wife isn't going to care it's a single binary when I remove the PiHole web interface that she's used to using on the odd occasion she needs to disable blocked for a bit (for example).
If you want to find which apps are the worst at this use GrapheneOS. Amazon flat out REFUSES to work unless it has unfettered access to everything.
This isn’t likely to be a good indicator. Essentially only the network permission and any fingerprint is necessary for the tracking in this accusation; the idea is not that TikTok were spying on Grindr on the device, but that a device fingerprinting firm who broker both TikTok and Grindr data were able to correlate the user.
I (UK based) have pfblocker-ng running at the perimeter with quite a lot of blocking. My browser FF has uBlock Origin and Privacy Badger too.
Amazon works fine.
I suspect they work along the rather practical lines of: if we can snag your data we will but if you want to block our efforts at predation but want to spend out, we are fine with that too.
Amazon absolutely will not refuse your money and they are jolly good at extracting it.
Fair enough, it does make sense that they will maximise their profits where they can, I'm just saying that it (the app not the website) refuses to work unless you provide it a full scope of literally every permission available. Maybe it has more to do with attestation, and verifying that you are not a scammer, than stealing and selling data?
What does the app give you that the website doesn't? I've never tried it as the website works just fine.
The headline is misleading. The TikTok app isn’t doing the tracking. The dating app providers are selling their user’s data. TikTok is one of the companies buying it.
Technical protections on your phone aren’t going to stop anything if you’re using apps that sell your data from their servers out the back door.
The whole permission thing is broken. They are too broad and nobody understands what they really mean. I would also like to see a log of when and how an app uses granted permissions.
Doesn't grapheneos have the same permission model as stock android? The only thing it adds is internet access and sensors (eg. gyroscope) access. What extra stuff is amazon asking for?
Ironically amazon.com works perfectly with javascript disabled. One of the few major sites that still do in my experience.
Call me an old fashion capitalist but I have a certain respect for businesses still willing to engage in a simple exchange of money for goods and services.
The only websites that are allowed to run apps on my phone are financial institutions.
All other websites are just websites.
This was Steve Jobs' original vision for the iPhone, before he relented and launched the App Store. Maybe it was the correct one.
And probably much more than that.
This seems to be the "original sin" of the current Internet "platform" paradigm.
Companies always track data and major social media companies and online search engines ALWAYS keep track of user search history. That data is often sold or used to find out what you are searching about and what brands you like. I guess it IS impossible to stop these big brands :-)
Very likely all other social media are doing it. Not to dimish the harm done by Tiktok but sadly it’s an industry wide phenomenon. Shouln’t forget about surveilance, misinformation, election rigginng and so on.
I'll post some inside baseball:
Almost everyone in ecom is running every ad network integration they can, no matter the source of traffic.
So if you click a Facebook ad, load a website, enter your information/checkout ALL of your information goes to every other network they integrate with.
You might never use TikTok, you might have every Facebook domain blacklisted, but when you clicked on a Google search "result" (ad) and checked out everything about your order was sent to meta/tiktok/applovin/400 other "networks" via S2S APIs.
Until this is made illegal, the incentive structure will ALWAYS push marketing departments to do this.
I'm already low-consumption, but my personal boycott of any site using shopify, which straight up has all integrations in their js you can inspect, has lowered my consumption even further. I've been emailing stores asking them to switch to bigcommerce, or whatever, and stop sharing their customers' data. Never get answers, though I never expect any.
Switching over to another ecommerce provider is a massive undertaking. It’s like if someone asked you to move your residence because the smoke from your bbq hurts their lungs
It is made illegal. As the post notes, you need to (1) give notice and (2) data collected needs to be made available in a user access request and (3) deleted irrevocably on request. You must have a legitimate reason to process and store this data (scattershot forwarding to everyone is a prima facie violation). Unless you comply with all of these, you are in violation.
I assume TikTok and similar apps are always doing this stuff.
The thing I'm curious about is whether the GDPR / DSB complaints are likely to have any result. Is that likely to just result in some cost of business fines and TikTok goes on with life? Or could those complaints bring about substantial repercussions?
The expected result is that the complaints will rot in the queue for years and eventually either closed on a technicality or result in a token fine. That's the reality of GDPR "enforcement".
That earnest congressional testimony by the CEO looks pretty bad at this point. Either he was lying or doesn’t know anything about how his company works.
Some state needs to pass an explicit consent law, since consent is too hard of a concept for Silicon Valley and other startups to understand.
Great job from noyb.
It's sad that the gdpr is now being watered down, especially the protection of these specially protected data points.
I don't think any app or service can hold a candle to the data harvesting of dating apps. Social media knows your likes and dislikes, but dating apps knows your deepest desires and wants.
>Article 9.2 (d) processing is carried out in the course of its legitimate activities
TikTok has a legitimate activity of personalizing the feed of users to make it as relevant as possible.