TikTok data collection could reveal what floor a user is on, cybersecurity firm says

The Australian-US cybersecurity company that last year revealed the extent of TikTok’s data collection says the social media company has increased what location information it collects to include altitude, which could tell it what floor of a building a user is on.

Last year Internet 2.0 released a study on the data TikTok attempts to collect on user devices, which includes contact lists and calendars, and its scanning of hard drives and geolocating devices on an hourly basis.

At the time TikTok described the report as “baseless” and said it was no different to the data other social media apps seek.

After the report a number of western countries, including Australia, banned the app from government-issued devices amid fears about whether the Chinese government could access data under national security law.

The director of Internet 2.0, David Robinson, on Thursday told a Senate committee hearing on foreign influence on social media that TikTok had never directly addressed the issues his firm had raised in the report.

Sign up for Guardian Australia’s free morning and afternoon email newsletters for your daily news roundup

“[TikTok] have never come back to us and argued the points about the data and their source code,” he said. “So it’s their word against the source code.

“They’ve called us names. They said we don’t understand what the code is. But they’ve never come back and qualified or quantify their position.”

He said the company had undertaken another analysis of the updated source code and discovered that in addition to latitude and longitude data from a user’s device, the app was now seeking altitude information.

“So if you’re in a high-rise building, they can tell what floor you’re on now,” Robinson said. “And that wasn’t previously in their code last year.”

A spokesperson for TikTok rejected the claim, saying GPS data was not collected in Australia, and only collected overseas where users enabled it.

“We do not collect GPS location data from users in Australia, nor do we seek permission for this,” they said. “To clarify, in other regions where a user has enabled and grants access to location services, TikTok collects this information based on device GPS data.”

The spokesperson said Internet 2.0 admits their analysis is “not conclusive and doesn’t include a detailed source code review, which they admit is the best way to assess data collection practices”.

Sign up to Guardian Australia's Afternoon Update

Our Australian afternoon update email breaks down the key national and international stories of the day and why they matter