TikTok Lacks End-to-End Encryption for Direct Messages, Confirms BBC Report

A new investigation from the BBC has confirmed TikTok does not implement end-to-end encryption (E2EE) for its private direct messaging feature, putting the platform at odds with nearly all of its major tech competitors that have adopted the privacy-focused security standard.

Meta Platforms already uses end-to-end encryption for core services including Facebook and WhatsApp, while the protection is also built into Signal, Apple’s default in-device messaging, Google’s native messaging tools, and Snapchat.

End-to-end encryption works by locking message content so that only the participants in a conversation can unlock and read their exchanged messages. Platforms that use the framework argue it is a critical safeguard for user privacy, as it blocks even the company itself and law enforcement agencies from accessing the private content users send.

During conversations with the BBC, however, TikTok explained its decision to forgo full end-to-end encryption, arguing the tool would enable harm against users and allow illegal content to be shared without any way for the company to investigate abusive activity.

Instead of E2EE, TikTok uses standard encryption, which permits a small group of authorized company employees to access user direct messages when required. TikTok says this access is typically granted only in specific scenarios, such as when law enforcement officials submit an official request for data.

TikTok’s overall data security practices have faced ongoing global scrutiny for years, tied to its parent company, China-based ByteDance. In January 2024, TikTok transferred ownership of its US operations to a standalone American subsidiary, backed by high-profile US investors including Oracle founder Larry Ellison, as part of a deal to ease US regulatory concerns.

Fast Company has reached out to TikTok for additional confirmation and comment on its current encryption policies. We will update this article if we receive a response from the company.