New Research Shows That TikTok Browser Tracks Users’ Keystrokes

TikTok, owned by Chinese internet company ByteDance, stated that Mr. Krause’s report was “incorrect” and misleading and that the feature was intended for “debugging troubleshooting, performance monitoring.”

TikTok stated that “Contrary to the claims of the report,” they do not collect keystrokes or text inputs via this code.

28-year-old Mr. Krause stated that he couldn’t determine if keystrokes were being actively tracked and if this data was being sent over to TikTok.

This research could raise questions about TikTok in America.

Government officials have examined whether the app could compromise U.S. national security by sharing data about Americans with China. Even though Washington had stopped discussing the app under the Biden administration in recent months, new concerns have emerged after disclosures by BuzzFeed News about TikTok’s data practices as well as its ties to China.

In-app browsers are sometimes used by apps to protect users from malicious websites or make browsing online easier with auto-filling text. While Instagram and Facebook can track information such as what websites a user visited, what they highlighted, and what buttons they pressed on a site, TikTok uses code to track every character entered by users.

Meta, the parent company of Instagram and Facebook, declined to comment.

Mr. Krause stated that he did the research on TikTok on Apple’s iOS operating systems and noted that keystroke tracking would only be performed within the in-app browser.

TikTok is like many other apps. It offers very few opportunities for users to leave its service. Instead of redirecting users to mobile web browsers such as Safari or Chrome, TikTok displays an in-app browser when they click on links or ads embedded within other users’ profiles. These are the times when people enter important information such as passwords or credit card numbers.

In a CNN interview in July, Michael Beckerman (a TikTok policy executive) denied that the company logs keystrokes. However, he acknowledged that they monitor their typing patterns to protect against fraud.

Krause stated that he was concerned about the tools’ “very similar architectures” which could be used to track keystroke content.

He said, “The problem is that they have the infrastructure to do this stuff.”