May 31, 2024
Australia’s privacy commissioner is facing questions over the credibility of her preliminary inquiry into TikTok after she told Senate estimates her office had not conducted testing of the social media app and instead relied heavily on information from the company before deciding to close its inquiry.
The Office of the Australian Information Commissioner earlier this week wrapped up its inquiry into TikTok, finding that despite “unacceptable” data harvesting practices, there was “no clear and obvious breach of Australian privacy law”.
The watchdog had opened the inquiry following reporting by this masthead that the TikTok app harvests users’ data including email addresses and mobile phone numbers, often without informed consent, through a tool known as a “pixel” found on many websites.
Tests run by this masthead found TikTok’s pixel scrapes a user’s email address and mobile phone information across some of Australia’s most-visited websites, including Kmart and Sportsbet, often taking the information even before a user has clicked “I agree” or “I consent” on an online form.
Some of the nation’s largest brands including Network Ten, BeyondBlue, Western Sydney University, Bunnings and Vodafone removed the pixel from their websites following the reporting.
Marketers often use tracking pixels for legitimate purposes, including re-targeting campaigns and to deliver more relevant ads that follow users across websites. Tech giants such as Meta (owner of Facebook and Instagram) and Google also have their own tracking pixels.
Yet the tests found that TikTok’s tool is more aggressive than its rivals in the way it scrapes information.
Facing a Senate estimates hearing on Wednesday night, Privacy Commissioner Carly Kind said her office had not conducted similar tests before deciding to close its inquiry. An inquiry is the step before a formal investigation is initiated.
“By its very nature, when we initiate preliminary inquiries, we’re doing so on the basis of requesting information from the relevant entities. We’re not doing a forensic examination of the technology at hand,” Kind said. “So we haven’t done that level of analysis in this case.
“We were basing our inquiries on information provided by TikTok.”
Liberal senator James Paterson is calling for the commissioner to release its correspondence with TikTok.
“The privacy commissioner’s answers in Senate estimates did not fill me with confidence that these serious privacy breaches were thoroughly investigated,” Paterson told this masthead.
“In fact, it seems the only people who had input into this inquiry was TikTok, a company who have repeatedly lied in the past about their misconduct.
“As a bare minimum, the privacy commissioner should urgently release all correspondence with TikTok so we can see how they defended conduct the commissioner has admitted is ‘harmful, invasive, and corrosive of online privacy’.”
The privacy commissioner’s office was contacted for further comment.
TikTok declined to comment. It has previously denied the pixel breaches Australia’s privacy laws.
“Pixel usage, which is voluntary for our advertising clients to adopt, is an industry-wide tool used to improve the effectiveness of advertising services. Our use of this tool is compliant with all current Australian privacy laws and regulations, and we dismiss any suggestion otherwise,” it said.
In closing the inquiry, the commissioner called for urgent reform of Australia’s Privacy Act, including the introduction of a “fair and reasonable” test that could examine whether any impact on privacy is proportionate to the benefit gained.
This masthead’s initial reporting was sparked by a client bulletin from marketing firm Civic Data, which had issued a warning to its clients recommending they remove the TikTok pixel from their websites on privacy grounds.
Kind told Senate estimates on Wednesday night that she was unsure whether Civic Data had been formally engaged as part of the watchdog’s TikTok inquiry.
“I spoke to them in general terms about pixels, as part of my efforts to maintain an up-to-date understanding of the ecosystem,” she said.
Paterson said he was concerned that the claims of privacy breaches had not been adequately investigated.
“You’ve primarily relied on TikTok, you haven’t checked the websites, it doesn’t sound like you’ve engaged with the people who blew the whistle,” he said to Kind on Wednesday night.
“How did you arrive at the conclusion then it was no different from any other social media company, if you haven’t done a forensic examination of the practices?”
Civic Data managing partner Chris Brinkworth said that “the privacy commissioner, Senator Paterson and Civic Data are all on a unity ticket that the new privacy regime being released shortly is urgently needed to protect Australian consumers and provide certainty for Australian businesses”.
