TikTok rejects end-to-end encryption in direct messages

TikTok will not protect users’ direct messages with end-to-end encryption (E2EE) because it does not believe it is a secure measure for them, compared to the stance taken by rival services such as Meta and X.

The technology firm does not believe that end-to-end encryption is the way to protect users of its social network, since it prevents the police and the company’s own security teams from accessing the messages.

This is a deliberate decision that differentiates it from its rivals and with which it aims to protect its users, especially young people, as he explained to the BBC recently, after attending a TikTok information session.

This technology guarantees that only the sender and receiver of a message access its content. Services such as WhatsApp, Facebook Messenger, Signal,

TikTok’s decision raises questions. On the one hand, it is a social network of Chinese origin, belonging to ByteDance, which has sometimes led to questioning the role that the Asian country’s data protection laws play in the privacy of users in other parts of the world.

On the other hand, by refusing to impose E2EE as other social networks and messaging services have done, third parties can access the content of the messages, something that poses risks, even if it seeks to combat the bullying and harassment that occurs on these channels.

ENCRYPTED MESSAGES DURING SHIPPING AND STORAGE

In statements to Europa Press, the company has confirmed this position regarding E2EE, but has clarified that it is not new, but that they have remained faithful to this approach from the beginning.

On the contrary, to protect direct messages, it explains that they are encrypted during their sending and storage, although they use E2EE technology. This allows maintaining a balance between privacy and security.

With this approach, authorized employees have the ability to access direct messages in certain cases, such as if they must comply with a legal request, such as law enforcement requests, and for moderation purposes if they receive a complaint from users.

Likewise, the company has recalled the Clover initiative, whereby the data of European users is stored in a data center located in Ireland and Norway under European regulations on data protection, and with the supervision of an independent security provider.