TikTok says it cooperates with law enforcement while respecting user rights, under internal procedures
TikTok states that, in line with its human rights statement, it is committed to cooperating with law enforcement while respecting users’ privacy, freedom of expression and other rights. Beyond these Guidelines it keeps internal policies and procedures for handling law enforcement requests, which it says are informed by legal and human rights standards and are meant to limit adverse human rights impacts while allowing it to comply with legitimate, valid legal requests from law enforcement (including regulatory authorities, where relevant) to disclose user data. It says it rejects requests that go against those policies and procedures. The internal procedures themselves are not set out here.
Supporting quotations
In line with our [human rights statement](https://www.tiktok.com/safety/en/policies-and-engagement/upholding-human-rights), TikTok is committed to cooperating with law enforcement while respecting the privacy, freedom of expression, and other rights of its users. To achieve this, in addition to these Guidelines, TikTok has internal policies and procedures governing how TikTok handles and responds to law enforcement requests. These procedures are informed by legal and human rights standards and have been developed in a way that seeks to limit adverse human rights impacts, while enabling TikTok to comply with legitimate, valid legal requests from law enforcement (including regulatory authorities, where relevant) to disclose user data.
We reject requests which go against our policies and procedures.
Qualifications & exceptions
Compliance is described as with legitimate, valid legal requests; requests that go against TikTok’s policies and procedures are rejected.
Not stated here
The linked human rights statement and the internal policies and procedures are not supplied here; what they require is unknown from this source.
Sharing & Disclosure · Restriction or exception
TikTok will not respond to requests from non-law enforcement officials or through informal channels
TikTok states it will not respond to requests for user data that come from people who are not law enforcement officials, or that are sent through informal channels such as personal email addresses.
Supporting quotations
TikTok will not respond to requests for user data sent by non-law enforcement officials or when they are sent through informal channels (such as personal email addresses).
Sharing & Disclosure · Company practice
Subscriber information TikTok may hold and disclose on a valid request
TikTok says it may hold subscriber information that can be the subject of a valid law enforcement request: the TikTok username, an email address and phone number (each depending on how the user signed up), the account creation date, the IP address at account creation, and device information. “May hold” does not state that every item exists for every account.
Supporting quotations
TikTok may hold the following user data, which can be the subject of a valid law enforcement request:
Subscriber information
TikTok username
Email address (depending on user’s sign-up method)
Phone number (depending on user’s sign-up method)
Account creation date
IP address at account creation
Device information
Qualifications & exceptions
Email address and phone number are held depending on the user’s sign-up method.
Disclosure is tied to a valid law enforcement request.
Sharing & Disclosure · Company practice
Log-in and log-out IP addresses TikTok may hold
Among the data TikTok says it may hold and that can be requested is log-in / log-out data, namely the IP addresses of account log-ins and log-outs.
Supporting quotations
TikTok may hold the following user data, which can be the subject of a valid law enforcement request:
Log-in / log-out data
IP address of account log-ins/log-outs
Sharing & Disclosure · Company practice
Non-content interaction data: interaction IP logs for a specified period and video creation times
TikTok lists interaction data (non-content) as a category it may hold: IP address logs for interactions, which it says are available for a specified period only, and the time and date a video was created. The length of that period is not stated.
Supporting quotations
TikTok may hold the following user data, which can be the subject of a valid law enforcement request:
Interaction data (non-content)
IP address logs for interactions (for a specified period only)
Video creation time/date
Qualifications & exceptions
Interaction IP logs are available for a specified period only.
Not stated here
The specified period for interaction IP logs is not stated in this source.
Sharing & Disclosure · Company practice
Content data: videos, comments and direct message content
TikTok lists content data it may hold and that can be requested: video content, comments and direct message content. Elsewhere in this section TikTok says content data requests generally require a domestic court or judicial order, warrant or equivalent.
Supporting quotations
TikTok may hold the following user data, which can be the subject of a valid law enforcement request:
Content data
Video content
Comments
Direct message content
This is in particular the case for requests relating to content data (which generally require a domestic court / judicial order, warrant or equivalent).
Qualifications & exceptions
Content data requests generally require a domestic court / judicial order, warrant or equivalent.
Sharing & Disclosure · Company practice
Transaction data: payment information and gifts
TikTok lists transaction data it may hold and that can be requested: payment information, such as debit or credit card information, and gifts received or sent.
Supporting quotations
TikTok may hold the following user data, which can be the subject of a valid law enforcement request:
Transaction data
Payment information, such as debit/credit card information
Gift received/sent
Sharing & Disclosure · Restriction or exception
Requests must name the data type and legal basis; unmet legal requirements mean no disclosure
Each request must clearly specify the type of data sought and the legal basis for requesting it. If a request does not meet the applicable legal requirements for that data, as listed in Section 3 (which requires a signed, dated request on law enforcement letterhead that cites the legal process authorising the request), the data will not be disclosed. This applies in particular to content data, which generally requires a domestic court or judicial order, warrant or equivalent.
Supporting quotations
Each request must clearly specify the type of data requested and the legal basis for requesting it. If the request does not meet the applicable legal requirements for the requested data (as listed in Section 3 below), the data will not be disclosed. This is in particular the case for requests relating to content data (which generally require a domestic court / judicial order, warrant or equivalent).
Each request must be signed, dated, sent on law enforcement letterhead and include the following information:
Relevant legal process: The request should clearly specify the legal process (i.e. citing the relevant article or section of an Act / Statute / Code), which authorizes law enforcement to request and collect information for the purposes of prevention, detection or investigation of criminal offences.
Qualifications & exceptions
Content data generally requires a domestic court / judicial order, warrant or equivalent.
The applicable legal requirements are those listed in Section 3 of these Guidelines.
The data sought and a date range must be specified; overly broad requests are refused
The request should clearly specify the scope of the data requested; overly broad requests will be refused. For historic data, the request must give a date (and if possible a time) or a date range relevant to the request.
Supporting quotations
Data requested: The request should clearly specify the scope of the data requested. Overly broad requests will be refused.
Date range: The request must specify a date (and, if possible, a time), or a date range as relevant to the request (for historic data only).
Qualifications & exceptions
The date-range requirement is stated for historic data only.
Sharing & Disclosure · Company commitment
TikTok notifies users of disclosures where required by law, with three exceptions
Where the law requires it, TikTok will notify users when it discloses their data to law enforcement. It may withhold that notice where notice is prohibited under applicable law, would jeopardise an investigation, and/or would put individuals at risk of harm. Notification is therefore not promised in every case: it is tied to a legal requirement and subject to these exceptions.
Supporting quotations
Where required by law, we will notify TikTok users if we disclose their data to law enforcement. We may not provide such notice where it: (a) is prohibited under applicable law; (b) would jeopardize an investigation; and/or (c) would put individuals at risk of harm.
Qualifications & exceptions
Notice is given where required by law, not in every case.
Notice may be withheld if prohibited by law, if it would jeopardise an investigation, or if it would put individuals at risk of harm.
Sharing & Disclosure · Restriction or exception
Vague preservation requests are not actioned; disclosure of preserved data needs the Section 1 and 3 requirements
Overly broad or unspecific preservation requests will not be actioned. Preservation alone does not produce disclosure: to obtain the preserved data, the requester must meet the requirements of Sections 1 and 3, meaning a request addressed to the correct TikTok entity for the user’s location (U.S.-located users being referred to the separate U.S. version), submitted through the webform in English or with a translation, and signed, dated, on letterhead with the Section 3 contents.
Supporting quotations
Overly broad or unspecific preservation requests will not be actioned. To seek disclosure of preserved data, the requirements set out in Sections 1 and 3 of these Guidelines will apply.
First, requests must be addressed to the correct TikTok entity*. This is based on the location of the relevant user as follows:
Note: For requests for data of users located in the United States, refer to the U.S. version of the [TikTok Law Enforcement Guidelines](http://usdsjv.tiktok.com/law-enforcement-guidelines).
Second, requests must be submitted to our webform: [www.tiktok.com/legal/report/lawenforcementrequest](https://www.tiktok.com/legal/report/lawenforcementrequest) with any attachments (for example, official warrant, court order, or other documentation supporting the request) in PDF format (word format will not be accepted).
All requests to TikTok and any supporting documents (including orders, warrants, and/or subpoenas or equivalent) must be provided in English or with a translation.
Each request must be signed, dated, sent on law enforcement letterhead and include the following information:
Qualifications & exceptions
Preservation does not itself authorise disclosure; a separate request meeting Sections 1 and 3 is required.
Not stated here
The U.S. version of the Guidelines and the webform page are separately linked and not supplied here; the entity list Section 1 announces is absent from the stored text.
In an emergency TikTok may disclose data needed to prevent imminent harm, judged case by case
TikTok has processes for emergency requests, which it evaluates case by case. If, as part of an emergency request, it receives information that in its own assessment is sufficient to establish a good-faith belief that there is an emergency involving imminent harm or the risk of death or serious physical injury to a person, it may provide the user data necessary to prevent that harm, as permitted by applicable law. This is a discretionary disclosure (“may provide”), limited to the data necessary to prevent the harm.
Supporting quotations
TikTok has processes in place to handle emergency requests. Such requests are evaluated on a case-by-case basis: if as part of an emergency request we receive information that is sufficient in our assessment to establish a good faith belief that there is an emergency involving imminent harm or the risk of death or serious physical injury to a person, we may provide user data necessary to prevent that harm, as permitted by applicable law.
Qualifications & exceptions
Disclosure depends on TikTok’s own assessment of a good faith belief in imminent harm or risk of death or serious physical injury.
Limited to user data necessary to prevent that harm, and to what applicable law permits.
A dedicated, trained response team assesses every request case by case before any disclosure
Restating its commitment to cooperate with law enforcement while respecting users’ privacy, freedom of expression and other rights under internal, rights-informed procedures, TikTok says that every request it receives undergoes a case-by-case assessment by its dedicated law enforcement response team before any user data is disclosed. The team is described as trained to evaluate such requests and as regularly conducting outreach to explain TikTok’s disclosure requirements.
Supporting quotations
TikTok is committed to cooperating with law enforcement while respecting the privacy, freedom of expression, and other rights of our users. To achieve this, in addition to these Guidelines, TikTok has internal policies and procedures governing how TikTok handles and responds to law enforcement requests. These procedures are informed by legal and human rights standards and have been developed in a way that seeks to limit adverse human rights impacts, while enabling TikTok to comply with legitimate, valid legal requests from law enforcement to disclose user data.
All requests received undergo a case-by-case assessment by TikTok’s dedicated law enforcement response team before any user data is disclosed. This team is trained to evaluate requests from law enforcement authorities and frequently engages in outreach to communicate TikTok’s requirements for disclosing user data to law enforcement authorities.
Not stated here
The internal policies and procedures are not supplied here; what the assessment examines is unknown beyond the requirements stated in this text.
Sharing & Disclosure · Company commitment
Disclosure requirements are those in Sections 1 and 3, grounded in local law and human-rights commitments
TikTok says its requirements for disclosing user data to law enforcement are set out in the Guidelines, particularly Sections 1 (addressing the correct entity) and 3 (the signed, dated, letterhead request with its listed contents). It describes these as reflecting its internal policies and procedures, applicable legal requirements and its commitment to international human rights including the International Bill of Human Rights. Because laws differ by country, it says the rules on when data can legally be disclosed also vary to some extent, while its global commitments to freedom of expression and privacy remain.
Supporting quotations
TikTok’s requirements for disclosing user data to law enforcement authorities are clearly set out in our [Law Enforcement Guidelines](https://www.tiktok.com/safety/en/tools-and-guides/tiktok-law-enforcement-guidelines) (in particular see Sections 1 and 3). These requirements reflect our internal policies and procedures for handling requests from law enforcement authorities, and are based on applicable legal requirements and our commitment to international human rights, including the International Bill of Human Rights. Because the applicable laws vary from one country to another, the rules on when data can legally be disclosed will also vary to some extent and our internal policies and procedures reflect this while at the same time reflecting our global commitments to freedom of expression and privacy.
First, requests must be addressed to the correct TikTok entity*. This is based on the location of the relevant user as follows:
Each request must be signed, dated, sent on law enforcement letterhead and include the following information:
Qualifications & exceptions
Disclosure rules vary to some extent by country because applicable laws vary.
Not stated here
The International Bill of Human Rights and the internal policies are external to this source and not supplied here; the Section 1 entity list is absent from the stored text.
Sharing & Disclosure · Restriction or exception
TikTok may reject requests that miss its requirements, most commonly for four reasons
TikTok may reject law enforcement data requests that do not meet the Guidelines’ requirements. The most common examples it gives are requests not addressed to the correct TikTok entity; requests that do not specify the legal process authorising the request; requests that do not state the type of offence under investigation, its circumstances and its connection to TikTok; and overly broad requests, such as for “all user data” or with no date range.
Supporting quotations
TikTok may reject data requests from law enforcement authorities where they do not meet the requirements that are clearly set out in our Law Enforcement Guidelines. The most common examples are as follows:
Requests that are not addressed to the correct TikTok entity;
Requests that do not specify the legal process which authorizes law enforcement to request and collect information;
Requests that do not indicate the type of offence(s) under investigation, the circumstances of the offence(s) and in what way it/they are connected to TikTok; and
Overly broad requests for “all user data” or where there are no date ranges indicated.
Besides rejecting, TikTok may narrow requests, ask for more information or require MLAT
In accordance with applicable law, and apart from rejecting non-compliant requests, TikTok says it will seek to narrow the scope of requests (by volume of data, number of users and/or time period), ask for further supporting information (particularly the legal process and the offence type), or tell the requesting authority that a request through the Mutual Legal Assistance Treaty (MLAT) process is necessary to obtain the data.
Supporting quotations
Aside from rejecting requests from law enforcement authorities that are not made in accordance with the relevant legal processes and requirements, TikTok will in accordance with applicable law:
Seek to narrow the scope of data requests in terms of the volume of data requested, the number of users they relate to and/or the time period to which they relate;
Ask for further information in support of the request (in particular, for details of the relevant legal process and/or the type of offence(s) under investigation); or
Communicate to the requesting law enforcement authorities that a request via the Mutual Legal Assistance Treaty (“MLAT”) process is necessary to obtain disclosure of the requested data.
Qualifications & exceptions
Each measure is stated as taken in accordance with applicable law.
Sharing & Disclosure · Permission or license
In an emergency TikTok may disclose data without formal legal process; the FAQ cites Section 5
The FAQ says TikTok may disclose user data without a formal legal request based on valid legal process in emergency circumstances: where it is satisfied there is an emergency involving imminent harm or risk of death or serious physical injury to a person, it may provide the user data necessary to prevent that harm, as permitted by applicable law. The FAQ attributes this to Section 5 of the Guidelines; in this stored text the emergency-request rule appears under the heading numbered 6, while Section 5 covers preservation requests. The Section 6 text contains the matching rule and is anchored here.
Supporting quotations
TikTok may disclose user data without receiving a formal legal request (based on valid legal process) in the following cases:
Emergency circumstances: As explained in Section 5 of our Law Enforcement Guidelines, where satisfied there is an emergency involving imminent harm or risk of death or serious physical injury to a person, we may provide user data necessary to prevent that harm, as permitted by applicable law.
TikTok has processes in place to handle emergency requests. Such requests are evaluated on a case-by-case basis: if as part of an emergency request we receive information that is sufficient in our assessment to establish a good faith belief that there is an emergency involving imminent harm or the risk of death or serious physical injury to a person, we may provide user data necessary to prevent that harm, as permitted by applicable law.
Qualifications & exceptions
Disclosure is discretionary (“may provide”), limited to data necessary to prevent the harm, and subject to applicable law.
Not stated here
Whether the FAQ’s “Section 5” citation is a numbering error or refers to a different numbering of the Guidelines cannot be determined from this source; the substantive rule matches the section numbered 6 here.
TikTok proactively reports some user data where legally obliged, such as to NCMEC
Outside formal legal requests, TikTok says that in limited circumstances, including where it is under legal obligations, it reports certain user data to law enforcement authorities or designated bodies. Its examples are reporting suspected child exploitation to the U.S. National Center for Missing and Exploited Children (NCMEC) for child-safeguarding purposes and reporting suspicious financial transactions to relevant authorities.
Supporting quotations
TikTok may disclose user data without receiving a formal legal request (based on valid legal process) in the following cases:
Proactive reports obligations: In limited circumstances, including where TikTok is subject to legal obligations, TikTok reports certain user data either to law enforcement authorities or to designated bodies. Examples include reporting suspected child exploitation to the U.S. National Center for Missing and Exploited Children (“NCMEC”) for child safeguarding purposes and reporting suspicious financial transactions to relevant authorities.
Qualifications & exceptions
Described as limited circumstances, including where TikTok is subject to legal obligations.
Not stated here
Which data is reported and under which legal obligations is not stated in this source.
All emergency disclosure requests are assessed case by case by the response team on their particular circumstances. TikTok lists examples that may constitute an emergency: child safety and exploitation cases, missing persons, suicide and self-injury scenarios, imminent threats of violence including terrorism, and natural or man-made disasters such as fires, floods or earthquakes. The list is illustrative (“some examples that may constitute an emergency”), not a closed definition.
Supporting quotations
All emergency disclosure requests undergo a case-by-case assessment and each request will be evaluated by our law enforcement response team based on its particular circumstances. However, the following are some examples that may constitute an emergency:
Cases of child safety and exploitation;
Missing persons;
Suicide and self-injury scenarios;
Imminent threats of violence (including terrorism); or
Natural or man-made disaster situations (such as fires, floods, earthquakes, etc).
Qualifications & exceptions
Examples only; each request is still evaluated on its own circumstances.
Sharing & Disclosure · Company practice
Any country’s authorities may ask, but disclosure rules depend on user, requester location and data type
Law enforcement authorities in any country can submit a request to TikTok, but the requirements for disclosure vary with the location of the user, the location of the requesting authority and, in some cases, the type of data requested. In certain circumstances TikTok will tell an authority that a request through the Mutual Legal Assistance Treaty (MLAT) process is necessary to obtain the data. TikTok says it publishes Transparency Reports with the number of requests received from each country.
Supporting quotations
While law enforcement authorities in any country can submit a request to TikTok, the requirements for data disclosure will vary depending on the location of the user, the location of the requesting law enforcement authority and, in certain cases, the type of data requested. In certain circumstances, TikTok will communicate to a law enforcement authority that a request via the Mutual Legal Assistance Treaty process (known as “MLAT”) is necessary to obtain disclosure of the requested data. TikTok publishes Transparency Reports with information on the number of requests received from each country.
Qualifications & exceptions
Requirements vary by user location, requester location and, in certain cases, data type.
Not stated here
The Transparency Reports are not supplied here; their contents are unknown from this source.
Sharing & Disclosure · Procedure
Follow-up requests after a TikTok Cybertip to NCMEC must still meet the Guidelines; quote the report number
If law enforcement has received a Cybertip report that TikTok made to NCMEC and now wants further user data for an investigation, that request must meet the requirements in the Guidelines and the FAQ like any other. TikTok asks that the request state the report number NCMEC assigned to the Cybertip so it can process it more efficiently.
Supporting quotations
If law enforcement has received a Cybertip report made by TikTok to NCMEC, and is now requesting further user data in connection with an investigation, the request must meet the requirements set out in our [Law Enforcement Guidelines](https://www.tiktok.com/safety/en/tools-and-guides/tiktok-law-enforcement-guidelines) and these Law Enforcement FAQS. To help us more efficiently process your request, please specify in your request the report number assigned to the Cybertip report by NCMEC.
Not stated here
The linked Guidelines address is this same page; any other version of the Guidelines is not supplied here.