Over the past year, thousands of TikTok employees have scrambled to move the company’s stores of information about its US users to data centers inside the US, and to restrict access to that data abroad. The effort, which is ongoing, is known internally as “Project Texas.” According to seven current and former TikTok employees, it represents the company’s response to concerns from regulators that the Chinese government could use the app, owned by the Chinese corporation ByteDance, to access sensitive information about US citizens.
The heart of Project Texas has been the creation of US-specific clones of TikTok’s internal systems. Some of these systems are tracking and analytics tools, like the ones that employees use to monitor content virality, while others affect what users see, like the recommendation algorithm that powers TikTok’s popular “For You” page. The new US-specific systems, including all US user data, will be hosted in data centers owned by Oracle, TikTok’s “trusted technology partner.” (The project name is a nod to Oracle’s headquarters in Austin.) New controls will restrict access to the systems to a new US-based team, called US Tech Services (USTS). Once Project Texas is complete, TikTok plans to replicate it in Europe.
One critical part of Project Texas has not yet been decided: how much control Beijing will have over the USTS team. Today, USTS employees report to middle managers in the United States, who report to a ByteDance executive in China. But the company is discussing legal models to restrict Chinese managers’ access to USTS information, according to two people familiar with the discussions.
TikTok declined to answer a detailed set of questions from BuzzFeed News about Project Texas. Company spokesperson Maureen Shanahan instead offered a statement: “TikTok is committed to protecting the privacy and security of our community. User data is stored in data centers in the US and Singapore, and we continue to invest in data security as part of our overall work to keep our users and their information safe.”
Shanahan declined to comment on TikTok’s discussions about creating a separate data governance entity, and on the fact that the USTS team reports to a ByteDance employee.
Project Texas comes at a critical time in TikTok’s short history. TikTok was the world’s most-visited website in 2021, overtaking YouTube in US watch time and Facebook in app downloads for the first time. (Disclosure: In a previous life, I held policy positions at Facebook and Spotify.) But ever since TikTok became popular in the US, it has been fighting the perception that its Chinese ownership makes it dangerous. In 2019, the Committee for Foreign Investment in the United States (CFIUS) began investigating whether TikTok posed a risk to national security, and the US Navy and Army banned TikTok from soldiers’ work phones. In August 2020, President Donald Trump announced that he would ban the app if it was not sold to a US company. As US tech giants Oracle and Microsoft explored a deal to buy TikTok from ByteDance, the Chinese government reclassified TikTok’s algorithm as a “sensitive technology” potentially ineligible for sale to a US company.
Despite this complication, a tentative deal was reached between Oracle and ByteDance, but the sale was put on hold in February 2021 after Trump left office. Reuters earlier reported that TikTok and Oracle are nearing a deal for the US tech company to store all American user data, and that access to that data would be limited to a specific team. The Biden administration is currently in the process of developing new regulations for apps that could enable foreign governments to obtain US citizen data.
Senator Marsha Blackburn, however, said she will be concerned as long as “product developers and key decision makers are based out of the PRC. TikTok is saying what they think will help them escape scrutiny from lawmakers, but that won’t happen as long as they remain the arm of the CCP.”
Fears that China could use TikTok to access US citizens’ data or shape US civic discourse are not unfounded. In 2019, the Guardian reported that TikTok had censored videos on topics of Chinese political importance. TikTok had nearly 40 million US users at the time. In February 2021, the company agreed to pay $92 million to settle a class action lawsuit alleging it had transferred US user data to servers in China.
Since the CFIUS investigation began, ByteDance has separated teams working on TikTok from those working on Douyin, the app’s mainland China equivalent, and considered creating a new “management board” and a US headquarters. In November 2021, TikTok’s CEO Shou Zi Chew stepped down from his role as ByteDance’s CFO (a job he had held while also running TikTok). But to date, no action by the company has changed the core relationship between the companies: ByteDance still owns and controls TikTok today.
