Governing Chinese technologies: TikTok, foreign interference, and technological sovereignty

1 Introduction

The Chinese social media app TikTok has rapidly grown in popularity to become one of the leading social media platforms globally, especially among young users. This popularity has been met with increasing scrutiny from nations such as the United States (US), United Kingdom (UK), Australia, and in the European Union (EU) due to concerns of individual privacy, foreign interference, and cyber security. Most of these concerns stem from TikTok’s relationship with the Chinese Communist Party (CCP) and TikTok’s corporate links to the China-based ByteDance via their Cayman Islands-based parent company. These concerns reached a critical point in August 2020 when the Trump administration issued a divestiture order to TikTok, and the company began searching for US buyers. Subsequently, in March 2023 TikTok CEO Shou Zi Chew appeared in front of the US House Energy and Commerce Committee, where he met intense questioning from US Members of Congress (Clayton, 2023).

This Committee hearing followed concerns about the risks of TikTok, leading to a ban on US federal government employees from having TikTok on their work devices in December 2022 (Ingram, 2022). Likewise, in March 2023, the EU implemented a ban on government devices (McCallum, 2023), as did the UK in March 2023 (Sabbagh, 2023) and Australia in April 2023 (Dreyfus, 2023). A series of other countries followed suit, including the other two Five Eyes countries New Zealand (Neilson, 2023) and Canada (Treasury Board of Canada Secretariat, 2023), as well as several others, like India, that banned the app altogether (Kumar & Thussu, 2023). Since the 1980s, global technological engagement with China, and in turn the Chinese Communist Party (CCP), has grown, propelling the nation to the forefront of the international economic landscape despite well documented human rights concerns. China has become a global technology power, with Chinese technology companies leading the way in new technology developments such as 5G, Artificial Intelligence (AI), and electric batteries (Gaida et al., 2023). China’s significant technology advancements have challenged the dominance of Western (and mostly US) technology firms (see Gray, 2021). The US, Australia, and China have engaged in retaliatory measures, imposing tariffs, export controls, and investment restrictions (Roberts & Lamp, 2021). In this article, we focus on the US, Australia, the UK, and the EU that provide a rich geopolitical cross-section to compare and contrast national (and regional) approaches to TikTok adoption as an example of a popular Chinese technology. We focus on these jurisdictions as they share strategic interests and are engaged in various intelligence and security alliances. Moreover, the rise of Chinese technology is challenging Western, especially US, hegemony in social media and digital platforms with geopolitical consequences (Gray, 2021). We also selected the US, UK, Australia, and the EU for examination given that each has introduced varying measures to counter and/or regulate TikTok within their respective jurisdictions, the nuances of which have been made public through policy documents and statements made to the media by political representatives.

There is a longer history of geopolitical tensions to consider that extends beyond the social media platform of TikTok to other Chinese technologies. For example, over twenty countries globally, including Australia and the US, have banned the use of Huawei 5G technology due to security and privacy concerns (Roberts & Lamp, 2021). Likewise, in Australia, Chinese-made technologies have featured in concerns over national security and foreign interference, including Australian government audits into Chinese-made CCTV surveillance cameras installed in government buildings and drones (Bernot & Walsh, 2023). Australian politicians and the Australian Security Intelligence Organisation (ASIO) have raised concerns that China-made cameras pose foreign interference, espionage, and national security risks (Belot, 2023), leading to the removal of these cameras from government offices (Bagshaw, 2023).

There is limited literature that examines the geopolitical dimensions to responses to TikTok comparatively (see Gray, 2021) and specifically across the domains of foreign interference and technological and digital sovereignty. This article addresses this imbalance by examining how the US, Australia, the UK, and the EU have responded to TikTok in each respective jurisdiction. These country-(and regional) level case studies reveal high-profile investigations into foreign interference threats and formal responses to manage the perceived risks of TikTok (Table 1). While the US, Australia, and the UK are in close geopolitical coalition under the auspices of the trilateral AUKUS alliance and the wider Five Eyes intelligence alliance (in addition to New Zealand and Canada), the EU has world-leading data protection regulation, the Digital Services Act (DSA) that aims to regulate Very Large Online Platforms (VLOPs) and search engines (VLOSEs) (European Commission, 2023a), and at the time of writing is introducing new measures to regulate Artificial Intelligence (i.e. the EU AI Act). The EU also has taken a strong stance on issues of technological sovereignty (and against the US) and is included to provide further comparative perspectives outside the AUKUS alliance. The EU rights-based approach is an interesting comparator given its protectionist and rights based approaches to safeguarding citizen data.

2 Aims and approach

We examine responses to TikTok in the US, UK, Australia, and the EU through the conceptual lenses of technological sovereignty and foreign interference, through analysis of relevant law, policy, and public statements made by officials, to document and understand responses to Chinese technologies, specifically TikTok, as a leading Chinese social media platform. The article proceeds across four steps. First, we examine TikTok and its corporate structures, and connections with the CCP. Second, we introduce the framing of foreign interference and technological sovereignty. Third, we examine jurisdictional responses to TikTok considering their policies and positions in relation to foreign interference and technological sovereignty. Fourth, and finally, we discuss the implications of these findings and consider how foreign interference and technological sovereignty inform the governance of TikTok, and in turn what this may mean for global internet governance as applied to Very Large Online Platforms (VLOPs).

2.1 TikTok: corporate structure, data security, and political influence

Chinese companies that internationalise often face dual pressure to comply with Chinese regulations domestically and national data protection scrutiny in other countries (Jia & Ruan, 2020). However, the growth of Chinese companies internationally is often linked with national security risks that can also mask national economic interests, especially when they challenge US hegemony with geopolitical consequences (Bernot, 2022; Gray, 2021). The surveillance capabilities of Chinese technologies and service providers have contributed to the complexity of this dynamic. This is because data and cyber security is significant from a geopolitical perspective (Gray, 2021) and, as we argue in this paper, is closely connected to notions of technological sovereignty and foreign interference, which is referred to by defence and national security actors as the “grey zone” domain of national security operations, where traditional distinctions such as legal/illegal, ethical/unethical, and intrusive/non-intrusive may not apply clearly (Hribar et al., 2014).

In recent years, TikTok has exponentially risen in popularity, especially among young people. Between 2018 and 2022, the TikTok user base expanded by, on average, 340 million new active members each year (Buchholz, 2022). Its trajectory of growth reached a significant milestone when it surpassed one billion users in 2019, a feat attributed to the “digital boom” ignited by the Covid-19 pandemic (Jaipong, 2023). In 2021, TikTok surpassed Instagram’s users, solidifying its position as a leading international social media platform (Buchholz, 2022).

This growth was narrated by two interconnected discourses that centred on risks to data security and political influence. For example, in their submission to the Australian Parliament, Lee and associates (2023) build a taxonomy of the severity and likelihood of these concerns, including Chinese censorship, data harvesting, narrative control (i.e. mis/dis information), privacy violations, political interference, surveillance, and intelligence operations.

TikTok’s Cayman-headquartered corporate structure ties it to a China-based company Bytedance, that complies with Chinese censorship regulations (Jia & Ruan, 2020). Bytedance is strategically based in the Cayman Islands and owns both the China-based version of TikTok—Douyin (抖音)—as well as the international versions of the app. Due to this corporate structure, the Chinese government has the potential to access user data for Chinese state surveillance purposes (Bernot & Smith, 2023). However, TikTok (as the international facing version of the app, compared to the Chinese local version Douyin) is more compliant with the data protection guidelines driven by local legislation, as opposed to the domestic version of the app that tend to prioritise national security over individual rights to privacy (e.g. via increased in-app surveillance) (Jia & Ruan, 2020). In a March 2023 US congressional hearing, House Energy and Commerce Chair Cathy McMorris Rodgers opened the hearing by stating that “TikTok surveils us all and the Chinese Communist Party is able to use this as a tool to manipulate America as a whole” (The Department of Energy and Commerce, 2023). These concerns are central to the geopolitical and technological clash between the US, UK, Australia, the EU, and China, leading to concerns about national security, technological sovereignty, foreign interference, social media dominance, trade practices, and privacy.

2.2 Technological sovereignty and foreign interference

Technological sovereignty (sometimes referred to as digital, data, or cyber sovereignty, and often in interchangeable ways) has various and distinct meanings depending on the context in which it is used. We adopt the term technological sovereignty as it encompasses a broader range of technologies, with digital technologies being a subset of those. Couture and Toupin (2019, p. 295) define technological sovereignty as “some form of collective control on digital content and/or infrastructures”. The concept of technological or digital sovereignty has been applied as a way towards individual and community ownership, control, and access to data (see for example, Mann et al., 2020a; and Pohle & Thiel, 2020). This notion is also linked to Indigenous and First Nations movements such as the Indigenous Data Sovereignty movement (Kukutai & Taylor, 2016).

The concept of technological sovereignty has been deployed by nation states and regions in the context of data localisation and security (see, for example, Bellanova et al., 2022). We focus on technological sovereignty as applied to nation states and consistent with historical conceptions of sovereignty as the authority within and over a specific territorial jurisdiction: “sovereignty is linked to the idea that states are autonomous and independent from each other: within their own boundaries, they are free to choose their own form of government and one state does not have the right to intervene in the internal affairs of another” (Krasner, 2001, p. 2).

Technological innovation, transnational/foreign surveillance, access to and control over data are forms of strategic and geopolitical advantage for nation states. The fear is that nation states and regions are losing control over technologies and data with consequences for their economies and national security. There have also been increasing attempts to assert and defend discrete forms of technological sovereignty, such as controls over 5G mobile communications as introduced above (da Ponte et al., 2023), cloud computing (Irion, 2013), and the transmission and (local versus cloud) storage of data. In addition, varied technological, political, diplomatic, legal, and regulatory approaches have been adopted to assert technological sovereignty, which range from technological (i.e. new undersea cables, encryption, and localised data storage) to non-technical (i.e. domestic industry support, international codes of conduct, and data protection laws) (Maurer et al., 2015, p. 1).

Arguments for technological sovereignty are motivated by several interconnected geopolitical, economic, national, and (cyber) security considerations. It has been argued in the EU that “a new approach to cybersecurity is emerging, in which the non-EU private sector can be perceived as much of a threat as foreign powers, and from whom digital sovereignty must be secured” (Farrand & Carrapico, 2022, p. 435). The Digital Single Market and recognition of the power of US technology companies and associated storage of data in the US (Fleming, 2021) contributes to these processes, in contrast with the visions of technological sovereignty in the US, Australia, and the UK that are directed at preventing or limiting foreign interference (Table 1).

Data localisation navigates a thin line between sovereignty and protectionism. The internet is said to be splintering and fragmenting due to a variety of reasons, including differing national interests and broader geopolitical dynamics. This phenomenon is referred to as the “splinternet” or “internet balkanisation.” Data localisation can restrict international data flows by dictating “where and how [data] may be stored, processed or transferred” (Fraser, 2016, p. 359). While the splinternet threatens to reduce economic benefits of globalisation (Bauer et al., 2014), it is also increasingly considered in the context of technological sovereignty and national economic benefit. For example, India’s approach to a nationwide ban of TikTok reflects a determined approach to sovereignty via data localisation strategies (Kumar & Thussu, 2023). Whether or not data balkanisation would limit foreign surveillance activities is also not clear (Fraser, 2016, pp. 364–365).

Another important concept to consider, and which is related to geopolitical tensions, is the notion of foreign interference. Foreign interference has gained international importance in the wake of cyberattacks (Tuffley, 2023), harassment of overseas diasporas and political dissidents, dis/misinformation campaigns (Ryan et al., 2020), and attempts to influence political decision-making as well as elections (Lemke & Habegger, 2022). There is a continuum between foreign influence and unlawful foreign interference, in which states seek to gain influence in a transparent manner (such as diplomacy), compared to covert and coercive forms of interference (Mansted, 2021). Defining interference is difficult and policymakers face the challenge of striking a balance between a definition that is overly broad, potentially impeding freedom of expression and political engagement, and one that is too narrow to address emerging and evolving forms of behaviour that could hinder their broader international strategic interests (Berzina & Soula, 2020).

We define foreign interference as:

activities conducted by or on behalf of a foreign power or state-level actor that are coercive, corrupting, deceptive, clandestine, or manipulative, with the intent to undermine the sovereignty (technological or otherwise), values, national interests, democratic institutions, and public confidence of a targeted country. Foreign interference poses a threat to technological sovereignty by manipulating or infiltrating a nation's technological infrastructure, compromising data integrity, and eroding control over information, thereby undermining the nation's ability to govern its digital space independently and posing risks to issues such as national security and privacy. Technological sovereignty involves a nation's control over its technologies and digital spaces to mitigate foreign interference and safeguard national interests.

Increased government and national security powers have been introduced to tackle foreign influence in political institutions (Chubb, 2023) and higher education (Cooney-O’Donoghue, 2023). Berzina and Soula (2020) discuss how the European Commission under President Ursula von der Leyen seeks to protect democratic systems and institutions from “external interference”, including laws to combat disinformation (Berzina & Soula, 2020), and foreign interference in elections (Henschke et al., 2020; Ringhand, 2021). Further research emphasises information warfare (Dowling, 2021, p. 384) and disinformation campaigns, which have often been driven by Russia (Lemke & Habegger, 2022). There is a lack of research on how responses to foreign interference specifically focus on the management of risks arising from social media platforms, and how they may compare internationally.

Critics argue that TikTok can collect and harvest vast amounts of data on citizens, which the Chinese government could covertly access, enabling espionage and the surveillance of government buildings, officials, or those with access to sensitive or classified information (Tuffley, 2023). For example, at present there is a US federal investigation into the tracking of Wall Street Journal’s journalists that were reporting critically on TikTok (Gurman, 2023). Further, it has been argued that TikTok threatens democracy by promoting disinformation and pro-CCP narratives, while censoring information that challenges pro-CCP narratives (Ryan et al., 2020). Likewise, the FBI has expressed concern that TikTok could be used by the CCP to conduct data operations and traditional espionage, influence operations, and control devices via its software (Martina et al., 2023).

These interrelated concerns about technological sovereignty and foreign interference have prompted varying responses in the US, UK, Australia, and the EU, leading to the implementation of stricter regulations or outright bans, enhanced cybersecurity measures, and increased scrutiny of foreign investments and political activities to safeguard national sovereignty and democratic processes (Henschke et al., 2020; Ringhand, 2021; Table 1). These responses reflect a strong focus on activities carried out by foreign states that appear coercive, corrupting, deceptive, clandestine, and contrary to another nation’s values, sovereignty, and the sanctity of its democratic institutions.

Table 1 below summarises the definitions and conceptualisation of technological sovereignty and foreign interference across the four jurisdictions analysed in this article.

Table 1: Definitions and conceptualisations of foreign interference and technological sovereignty in the AUKUS countries and the EU

3 Jurisdictional responses to restricting Chinese technologies and TikTok

3.1 United States

Since 2020, TikTok’s presence in the US has been caught between discussions about geopolitical power, divestiture pressures, data security, foreign interference, and platform governance. The US approach to banning the sale of and forcing divestment from TikTok has been built on an ad hoc assortment of available laws and regulations that is tightly linked with preserving its political and economic interests of the US. The Committee on Foreign Investment (CFIUS) — an agency that reviews mergers, acquisitions, and other transactions that may have national security implications — was leveraged by the Trump administration in evaluating TikTok privacy risks after it acquired a US-based company Musical.ly in November 2017 (Feder, 2021). Previous CFIUS orders had set precedents in relation to data security and national security concerns: in 2019, Beijing Kunlun Tech Co. Ltd. was ordered to divest from the LGBTQI+ dating app Grindr due to access to sensitive personal information, and another Chinese company was ordered to divest ownership interest from a company PatientsLikeMe that allowed people with similar medical conditions to locate each other (Feder, 2021). CFIUS provided a divestiture recommendation for TikTok to limit national security risks, which was the basis for the Trump administration to issue an executive order (List, 2022). This decision carried few details and has been widely critiqued as an overstretch of CFIUS’ ever-expanding remit.

On 6 August 2020, Trump issued an executive order indicating how mobile applications developed and owned by Chinese companies continue “to threaten the national security, foreign policy, and economy of the United States”; Trump argued that all transactions of persons with TikTok need to be banned due to a “national emergency with respect to the information and communications technology and services supply chain” (Executive Office of the President, 2022). For Trump, TikTok was a technological representation of Chinese economic competition and dominance in the US, which became a strategy of his Presidency (Ashbee & Hurst, 2021). Trump’s executive order was rejected as a threat to national security by US courts analysing both the Constitution and federal statutes to establish what does and does not constitute a national security emergency (Chander, 2023).

TikTok proceeded to partner with the computer technology company Oracle to locally hold US user data via an initiative called “Project Texas.” This arrangement enabled US TikTok data to “communicate with the global TikTok service in controlled and monitored ways” (TikTok, n.d.). This form of data localisation can be viewed as part of a national technological and digital sovereignty strategy, whether articulated explicitly or more formally via regulatory actions (Kumar & Thussu, 2023). Additionally, TikTok opened “Transparency and Accountability Centers” digitally and in Los Angeles, considered an attempt to avoid a domestic ban (Grandinetti, 2021).

Prior to a 2023 Congressional hearing, the Biden administration continued with the hard stance of divestiture or TikTok running the risk of a nationwide ban in case of divestiture refusal. During the 2023 Congressional Hearing, TikTok’s representative was presented with numerous questions about concerns over privacy, data harvesting, inappropriate content (for children), and the relationship of ByteDance and TikTok with the CCP. At the time of writing, a final decision on TikTok’s operations in the US is pending.

Data transfer and misuse concerns have been observed by the US media which has fuelled political and regulatory action. One of the most important investigative stories was published by BuzzFeed reporters in June 2022 based on 80 internal TikTok meetings (Baker-White, 2022a). The story built on 14 statements from nine TikTok employees and revealed that select staff at ByteDance in China were able to access US user data between September 2021 and January 2022. The story cites TikTok’s Trust and Safety department’s employee saying that “everything is seen in China” and a TikTok director referring to a “master admin” who “has access to everything.” BuzzFeed’s story triggered the March 2023 Congressional hearing (Energy and Commerce Committee & Chew, 2023).

In October 2022, Forbes reported that ByteDance’s Internal Audit team planned to use location information to surveil individuals, in contravention of an executive order signed by Biden one month earlier that emphasised the risk of the potential for foreign-owned companies to undertake “surveillance, tracing, tracking, and targeting of individuals or groups of individuals, with potential adverse impacts on national security” (Baker-White, 2022b). In December 2022, Forbes disclosed that three journalists were targeted for surveillance who previously worked for BuzzFeed on critical technology stories. These reports were linked with TikTok’s employee attempts to use location data to match the location of the journalists with potential sources that may be leaking TikTok’s information. Surveillance of journalists has deleterious consequences to the operation of a free press, also weakening democracy (Harkin & Mann, 2023). TikTok’s response centred on the function of internal audit to uncover potential misconduct (Baker-White, 2022b), but in December it admitted that journalist surveillance was “misconduct of certain individuals, who are no longer employed at ByteDance” (Baker-White, 2022c).

3.2 United Kingdom

TikTok is a matter of concern for UK policymakers. BuzzFeed’s reporting resulted in a shift in articulating data transfer concerns. Previously TikTok was asked to confirm or deny data “transfer” issues that were usually met with statements such as the one offered by a TikTok executive Theo Bertram during UK parliamentary committee hearing in September 2020: “No employee in China can access TikTok data in the way that you are suggesting on behalf of the CCP to carry out mass surveillance” (Bertram, cited in Ryan, 2022). BuzzFeed’s reporting revealed that, “the location in which any data is stored is immaterial if it can be readily accessed from China” (Ryan, 2022).

In early 2023, the Cabinet Office Ministers ordered a security review by a cabinet committee. Additionally, at the request of the security minister Tom Tugendhat, the National Cyber Security Centre (NCSC) of GCHQ, was involved with the review of TikTok’s cybersecurity (Corfield, 2023). NCSC met TikTok representatives in February 2023 and concluded its investigation using a risk-based evaluation of TikTok’s threat level (Corfield, 2023). In April 2023, the Director of the NCSC Richard Browne pinpointed the source of the concerns with data on publicly owned government devices, rather than individual risks, and signalled that this move is consistent with EU countries and the European Commission (Boland, 2023). NCSC’s technical app evaluation did not reveal threats, but data access by TikTok employees in China implied a degree of risk of covert data access by China’s intelligence agencies. This prompted the NCSC to recommend a risk-based approach (Boland, 2023).

In March 2023, TikTok was banned from all parliamentary devices through a joint decision by the commissions of both the House of Commons and Lords based on cybersecurity concerns around sensitive government information, but there was no commentary on the exact reasons (Hern, 2023). UK Prime Minister Rishi Sunak stated he will take “whatever steps are necessary” to protect Britain’s security, as TikTok raises fear about national security concerns (Milmo & Crerar, 2023). Sunak also signalled strategic alignment with its allies: “We look at what our allies are doing” (Maclellan, 2023).

The UK’s approach to TikTok has formed part of its broader response to foreign interference and national security, to mitigate the risks related to foreign state-sponsored disinformation campaigns through social media applications (see Home Office, 2023). The UK has been focused on cybersecurity and data governance, and its responses to TikTok’s ties with the Chinese government have referenced the US approach.

3.3 Australia

Australia has responded to concerns about foreign interference, national security, and TikTok’s relationship with the CCP by taking measures to protect government information and combat the spread of misinformation. The Australian response has also been largely aligned with and informed by the earlier responses to TikTok in the US and UK.

In April 2023, Australia’s Attorney General, Mark Dreyfus, announced a ban on TikTok on government devices due to concerns that the CCP could gain access to the information of government employees. Dreyfus stated: “After receiving advice from intelligence and security agencies, today I authorised … a mandatory direction under the Protective Security Policy Framework to prohibit the TikTok app on devices issued by Commonwealth departments and agencies” (Dreyfus, 2023).

The Australian government is concerned about social media platforms promoting prejudice and hate, facilitating harassment, and dividing society. The Senate Select Committee on Foreign Interference through Social Media report in 2021 called for greater regulation of social media platforms to combat misinformation during democratic elections. Minister for Cyber Security Claire O’Neil has highlighted the challenges that arise from the use of technology companies based in countries with authoritarian regimes. In 2022, she noted: “It’s not just about TikTok. […] The fact that we’ve got millions of Australians accessing an app where the usage of their data is questionable is very much a modern security challenge for the country, and no country in the world has found the easy solution for managing this” (Galloway, 2022). It should be noted that the Australian Competition and Consumer Commission (2019) has undertaken an inquiry into digital platforms more broadly, with a focus on media dominance in the creation of news and journalism, although highlighting many privacy concerns, and which has triggered a review into the federal Privacy Act 1988 (Cth) that is ongoing.

Liberal National Party (Opposition) Senator James Paterson has been an advocate for greater restrictions on TikTok (Gailberger, 2022). Following the release of the BuzzFeed story in June 2022, Paterson submitted a formal letter to TikTok in July to inquire if Australian’s data was also accessible in China. TikTok stated the Australian’s data was stored in Singapore and the US, and access to that data is minimised and limited only to people who need the data “to do their jobs,” confirming China-based access (Paterson, 2022). Paterson highlighted the risks of popular apps that collect sensitive information about users based in authoritarian countries requiring Australian government protection from potential data breaches and foreign interference (Paterson, 2023). In July 2023, Paterson led a series of Senate hearings on foreign interference via social media, during which the Senate also questioned representatives of TikTok Australia, revealing that the Australian TikTok managers had tried to obfuscate journalistic surveillance (Al-Nashar, 2023a) and that TikTok’s China-based employees also had the ability to change the algorithm (Mason, 2023). The hearings also found that despite complaints having been lodged and foreign interference having been criminalised since 2018, the Australian Federal Police had only charged two people reporting difficulty of definitively establishing foreign actor involvement (Al-Nashar, 2023b).

At the time of writing, the Australian Office of Information is investigating TikTok’s use of tracking pixels. The Attorney-General Mark Dreyfus has publicly stated that such activities are “particularly alarming given TikTok is beholden to the Chinese Communist Party and is required under China’s intelligence laws to share information” (as cited in the ABC, 2023). At present, and following the ACCC Digital Platforms Inquiry introduced above, the Privacy Act 1988 (Cth) is currently undergoing reform.

3.4 European Union

The European Union (EU) General Data Protection Regulation (GDPR) is considered the global or gold standard for data protection regulation (although there are debates about this, see, for example, Mantelero, 2021). It also has introduced a range of measures to regulate Very Large Online Platforms and Search Engines via the Digital Services Act (DSA), and is leading the regulation of Artificial Intelligence with the introduction of the AI Act. Contrasting with the other national case studies above, the EU has primarily attempted to challenge the dominance of US platforms (for example, via the DSA), rather than specifically target or ban Chinese platforms, with the view to promote and protect technological sovereignty. At the EU level, only one top-down decision involved the ban of TikTok on government devices in February 2023, with some member states questioning the reasons behind the decision. The EU Commission’s Corporate Management Board cited cybersecurity concerns and potential vulnerabilities (European Commission, 2023b) to justify this measure. Other EU responses to TikTok have been reliant on the rights-based laws that the European Commission uses to regulate all Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs) (European Commission, 2023a).

A key distinction in platform regulation in the EU can be contrasted with the approach in the US, UK, and Australia. In 2022, the European Parliament and Council agreed to adopt the Digital Services Act (DSA) that came into effect in November 2022 and “regulates the obligations of digital services, including marketplaces, that act as intermediaries in their role of connecting consumers with goods, services, and content” (European Commission, 2024). This measure attempts to preserve and protect the Digital Single Market with individual member states’ regulating online platforms, including non-EU actors operating within the European market (Cini & Czulno, 2022). US-based companies, including the “Big Five” (Google, Amazon, Meta, Microsoft, and Apple) were the focal point of these policy discussions because they store over 90% of “all the data in the Western world” (Fleming, 2021). On 13 April 2023, the Irish Data Protection Authority issued the largest GDPR fine of €1.2 billion to date to Meta for transfers on personal data to the US (European Data Protection Board, 2023).TikTok’s governance has been an inevitable by-product of these new regulatory obligations and oversight structures that placed primary governance focus on US-based companies, potentially due to US technological hegemony and associated geopolitical concerns (Gray, 2021).

The DSA mandates companies with more than 45 million users to comply with additional data security regulations and moves the regulatory mandate away from the supervision of individual member states to direct regulatory supervision by the European Commission (European Commission, 2023c). As a company with over 125 million users in the European Union, TikTok is under direct oversight by the European Commission. The EU has mediated complaints by member countries made against TikTok across several areas of concerns, ranging from consumer rights to cybersecurity.

Disinformation and misinformation also affected TikTok via a Code of Practice on Disinformation (herein, the Code). The Code uses the term “disinformation” to include information influence operations and interference by foreign actors (European Commission, 2022a). Hate speech removal on TikTok is monitored by the EU Commission’s evaluation on the Code of Conduct on Countering Illegal Hate Speech Online, which TikTok joined as a signatory (Reynders, 2021). In 2022, TikTok was reportedly the only company to increase notice-and-action results from 82.5% in 2021 to 91.7% in 2022 (European Commission, 2022b).

Overall, the EU Commission uses a range of legal and regulatory measures—some mandated and some voluntary—to govern TikTok. During a public hearing in the European Parliament in May 2023, several members questioned the overnight decision that did not explicitly state cybersecurity concerns by noting that they did not want to “trust blindly” and felt “infantilised” (Goujard et al., 2023). Foreign interference is regulated via the Code of Practice on Disinformation that can launch investigations and result in fines.

4 Discussion and implications: politicisation or protection?

The AUKUS and EU examples show that TikTok raises similar national security, foreign interference, and privacy concerns in each jurisdiction we consider in this article. Since 2020, TikTok’s representatives have evoked the language of “technological neutrality” and in doing so attempted to evade transparent communication about TikTok’s data collection, access and use, a tactic that has historically been used by both Chinese and non-Chinese technology companies (Bernot, 2022). TikTok’s reluctance to provide transparent answers about data governance has not been well received due to China’s authoritarian nature, and the absence of trust, particularly among Australia, the UK, and the US, which stems from broader and historical geopolitical tensions. In this context, the EU’s conceptualisation of technological sovereignty threats and strategies to manage them is unique.

The specific responses to TikTok within each jurisdiction are shaped by the policy and regulatory tools available within each jurisdiction, and are also dependent on notions of foreign interference and technological sovereignty (as per Table 1). The US federal and state government actors have been aggressively pursuing various pathways to banning TikTok, efforts that culminated in the 2023 Congressional Hearing. Efforts to strengthen US privacy legislation voiced during the Hearing did not come to fruition, and TikTok representatives are now scheduled to appear in the US Senate on child sex exploitation in early 2024, along with Meta, Snap, and Discord (Shepardson, 2023).

The responses to TikTok in the US are similar to those in the UK and Australia which is perhaps unsurprising given that they operate in numerous strategic intelligence and military alliances (i.e. ANZUS, AUKUS and the Five Eyes). As our analysis has demonstrated, the responses of the AUKUS countries to TikTok were politicised as evidenced by scare campaigns, moral panics, xenophobic overtones, and knee-jerk political reactions described in the national examples presented above. This can be compared with the EU approach, which has tended to be rights-driven with a focus on challenging US dominance and regulating all VLOPs, rather than specific concerns about China, and reflects a more protectionist approach to internet governance, underpinned by the right to data protection (Charter of Fundamental Rights, 2012, Article 8) and protecting the digital single market.The responses to TikTok in each jurisdiction are also shaped by the conception of technological sovereignty. In the US, this loosely encompasses issues of economic and national security (Gray, 2021; Slawotsky, 2021; Table 1), broadly positioning China’s technical progress as a threat to its own technological hegemony (Schüller & Schüler-Zhou, 2020).

Concerns over foreign interference have been highly salient in Australia, driven by China’s threat to domestic security, and as we have demonstrated in this article, TikTok now forms an important element. In this way, Australia may be influenced by the US’ securitised framing and approach, with China presented as a threat to domestic security. This means that technological sovereignty as conceived in this context primarily seeks to mitigate security threats, rather than prioritising rights to data protection and privacy more broadly (Mann et al., 2018). It is worth noting that rights-based approaches are absent, underdeveloped, or unenforceable in some of the AUKUS countries’ legal frameworks (especially Australia which lacks comprehensive human rights protections at the federal level) (see for example, Mann et al., 2020b). However, as mentioned above, there are currently investigations into TikTok and wider reform processes of the Privacy Act 1988 (Cth) currently underway, although at this stage it is not clear what the outcome of this investigation will be, nor how effective reforms to the Privacy Act 1988 (Cth) will be in regulating TikTok. It is important to consider that the US largely has a near-monopoly on the Western world’s data (Fleming, 2021) and Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs) (European Commission, 2023a). This may help understand why the focus on national security and economic interests present in the US, UK and Australia’s conceptualisation of technological sovereignty was not as strongly emphasised in the EU.

These findings also connect to research that has identified that the US prioritises the socio-economic benefits of data economies over privacy risks and consequently adopts a market-based approach to governance (Guay & Birch, 2022). This differs from the EU, that tends to focus on privacy rights and data protection using an ex-ante and state-market model and also focuses on protecting the EU digital market, primarily from US hegemony and technological dominance. The EU has presented one possible alternative in positioning itself as a state that seeks to protect citizens and its wider digital markets, rather than attack specific platforms connected to geopolitically non-allied governments. This highlights the importance of considering geopolitical dimensions when analysing regulatory responses to social media platforms. Indeed, the EU conceptualisation of technological sovereignty differs in that it is more concerned with the dominance of US technology companies and the protection of EU citizens’ data. Bellanova et al. (2022, p. 337) explain that digital sovereignty has both direct and indirect implications for European security: “the EU attempts to develop and control digital infrastructures (sovereignty over the digital), as well as the use of digital tools for European security governance (sovereignty through the digital)”. The President of the EU has identified digital policy as one of the key political priorities of her 2019–2024 term in office and pledged that the EU will achieve “technological sovereignty” in critical areas (Madiega, 2020). This is consistent with the broader EU approach to technological sovereignty that concerns the region’s ability to exercise control over data and digital assets while being technologically independent of foreign suppliers, as shown in Table 1 (see also, Bellanova et al., 2022). This is also evident through the EU’s moves to construct new supervisory infrastructure for 19 Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs), all of which are non-EU owned (European Commission, 2023a). Such policies will undoubtedly have important implications for internet governance and policy internationally and the concepts of technological sovereignty and foreign interference in wider geopolitical contexts can assist with understanding and critiquing such developments.

In this article, we have shown how the concepts of technological sovereignty and foreign interference interact with Chinese technologies and platforms, as well as the regulatory responses introduced by a small sample of Western nation states to assert and protect their technological sovereignty. We argue that it is important to consider wider geopolitical tensions and strategic interests as these shape the responses that states (or regions) seek to adopt. Through this analysis we have shown that the US is more prone to attack particular platforms connected to geopolitically non-allied governments (such as China) both because of national security concerns and threatened national economic interests; the EU, on the other hand, aims to position itself as a state that seeks to protect citizens and the wider digital market through a regime that attempts to create technological independence, and largely from the US. These findings connect to recent research on the divergent socio-technical imaginaries of personal data in the US and the EU, which identified that the US prioritises the socio-economic benefits of data economies over privacy risks and adopting a post hoc and market-based approach (Guay & Birch, 2022). This differs from the EU that focuses on privacy rights and data protection using an ex-ante and state-market model (Guay & Birch, 2022). The UK and Australia fall somewhere in the middle, speaking to both the need to strengthen their regulatory regimes as well as address national security threats, following the US lead. These socio-technical imaginaries and conceptions of personal data and the value that is ascribed to it are also relevant to consider because they have implications for regulation and policy as introduced to respond to risks and threats to technological sovereignty. We acknowledge that our focus is limited to Western jurisdictions and geopolitical dimensions between Western allies and China and further research into such dynamics is important to understand variations in approaches to internet governance.

5 Conclusion

In this article we have shown that AUKUS countries presented a political narrative focused on the threats presented by China and TikTok’s links with the CCP. This, however, might be occurring at the risk of overshadowing other foreign interference risks, including the risks posed by Western social media companies. We also emphasise that framing foreign interference threats as solely originating in China creates a policy blind spot, including that of mis-/disinformation and election interference, for example, the Facebook/Cambridge Analytica case illustrated how a US-based company can engage in harvesting user profiles for election manipulation (Manokha, 2018). This is not to say that CCP’s capability to have foreign interference influence should be taken lightly. For example, the CCP has been found to engage in information operations on social media (Ryan et al., 2020). The various responses to TikTok analysed in this article suggest that approaches to internet governance should adopt a more holistic and rights-based approach to regulation and policy. A “whack-a-mole” approach (Bennett Moses, 2023) to banning or blocking individual platforms and directed at specific countries or platforms considered to present a threat to technological sovereignty will not suffice as a long-term solution that protects citizens and their personal data as such approaches are founded in wider geopolitical attempts to assert and maintain international power and dominance over the internet. Although the EU has its own investments by combatting US technology dominance with regulatory power as evidenced by the EU single digital market, the EU approach presents a less politicised alternative by adopting a rights-based protective framework through, for example, the DSA and GDPR. Finally, these findings present an opportunity to critically reflect on notions of technological sovereignty which focus on the wins and losses of nation states and frame data as a resource for exploitation for national benefit, geopolitical advantage, and corporate extraction. They also show how the concepts of technological sovereignty and foreign interference can be helpful in understanding and problematising regulatory responses.