Employers and businesses are in limbo on how to prepare for a post-TikTok world after Congress passed legislation giving the social media app’s Chinese owner nine months to either sell the company or be banned throughout the country. TikTok’s parent company, ByteDance, has been clear that a sale is not on the table and pushed back by filing a May 7 lawsuit claiming the law is unconstitutional. However things play out, businesses need to prepare as the privacy and national security concerns underscoring the ban are not going away even if TikTok remains. Here are three steps you can take to prepare for the TikTok ban – and three additional things to consider even if the ban goes bust.

The Path to the Ban

While the push for a TikTok ban has been years in the making, the details of that path are less important than the why. As a starting point, it is important to address an unsaid reality: social media apps are not the product – the users of social media apps are the product. Many social media apps use tracking technology in order to build profiles on their users, which can then be used to better target advertising. The tracking is not necessarily limited to time on the app. Cookies and pixels put on third-party websites are widespread, allowing social media companies to track individuals across different websites.

TikTok is not alone in this practice. However, TikTok’s Chinese ownership presents additional complexities. The United States, to date, has few laws that limit the transfer of American data oversees. As a result, there are concerns that data can flow to foreign countries (including China) where it can be used for malicious activities, such as espionage, intrusive surveillance, scams, blackmail, intimidation of political opponents, and curbing dissent.

China’s Personal Information Protection Law limits the outbound transfers of data that are in China – including data that originated outside of China but was transferred to China. In many situations, international transfers of data out of China must be assessed by the Cyberspace Administration of China (CAC), which essentially gives the CAC almost unrestricted authority to access and review data it deems important.

To address these concerns, TikTok launched Project Texas, which ByteDance claims would prevent U.S. users’ data from leaving the US or being accessed by its employees in China. Former TikTok employees have cast doubt on the effectiveness of these measures. They claim that data from the U.S. is still going to employees in China.

While the TikTok ban passed Congress and was signed into law by President Biden, there is no guarantee it will go into effect. Montana tried to ban TikTok across the state, and a federal court halted the law in part because it likely violated the First Amendment. It is possible the federal ban could face a similar fate.

Your Next Steps for If the TikTok Ban is Upheld

While TikTok will not disappear overnight, it is worth considering what employers and businesses should do to plan for the ban.

1. Save Your Data

If you have videos or content that your business may need in the future, including to meet legal preservation or retention obligations, download it now:

• Open your profile
• Select “Settings and privacy”
• Select “Account”
• Select “Download your data”

If you use platforms other than TikTok, this is a good reminder to make sure your business saves copies of anything posted to social media that your business needs to keep. Even without an app ban, you could lose everything on a social media account if it is ever compromised.

2. Start Looking into Your Alternatives

If TikTok is banned, where will you go next for your social media needs? To make this determination, you need to know for what purposes you are currently using TikTok and what value it adds.

• If you are just using it for data analytics, there are myriad of alternatives.
• If you are using TikTok to link to videos on your website, you may turn to Instagram and YouTube.
• If you are using TikTok for recruitment, you may consider using LinkedIn, Indeed, or similar platforms.
• If a lot of your first contact with clients comes through TikTok, it may not be so easy to find a replacement – predicting what technology will be popular in a year or two can be dicey. Start to evaluate your alternatives and set them up today so that you can determine what will work for your business.

3. Do Not Permit Employees to Use TikTok for Work Once the Ban is in Effect

It is not a secret that users can work around geographic bans through the use of virtual private networks (VPNs). Doubtless, some people will continue to use TikTok through such tactics. While the actions of your employees on their personal time on their personal devices is up to them, you should not ask or require employees to circumvent the law for your business. Not only does this open you up to liability from employees, but it also may be considered an unfair business practice.

Even if the Ban Fails, It May Be Time to Reevaluate Your Relationship with TikTok (and Social Media)

If the TikTok ban is defeated in court, that does not mean that TikTok is risk-free to use. When using social media in general (and TikTok in particular), here are some considerations for all businesses:

1. Obtain Employee Releases

If you are going to post photographs or videos of your employees on social media or as part of a marketing campaign, it is a best practice that you obtain a signed release to use their image and likeness. While this is a state-specific issue, all persons (including employees) can have a “right of publicity” – that is, the right to control how their likeness is used commercially. You need to make sure that any release you provide is broad enough to cover use on TikTok.

2. Mitigate Against the Surge in Litigation

The last few years have seen an uptick in privacy litigation involving the use of pixels and cookies under various state statutes. One argument we have seen from plaintiffs in these lawsuits is that the provision of personal data to TikTok – because of the claims they spy on Americans – makes the alleged violations worse. While tracking technology always carries with it the risk of privacy litigation if proper protections are not in place, we may start to see a TikTok premium on such lawsuits. In addition to the steps we discuss here, businesses with the TikTok pixel on their website should consider updating their cookie banners or consent process to indicate that data may be transferred to China and obtain opt-in consent.

3. Comply with Consumer Privacy Laws.

As a general matter, consumer privacy laws tend to require that the businesses which collect the data undertake reasonable security measures to protect the data. While what this means may differ state-by-state, it is worth considering whether your use of social media may implicate the consumer privacy laws in the states where you operate.

Moreover, many of the states with consumer privacy laws require a data privacy assessment for certain uses of consumer data. The use of the TikTok pixel alone may trigger this requirement in several states as a form of “selling” or “targeted advertising.” If you are required to conduct an assessment, the concerns about China’s use of data should be part of it.