Everyone Is Doing It

I have never installed TikTok. I simply never got around to it, and then my career made the decision for me. Utilities and critical infrastructure organizations, the kind I've spent most of my career protecting, started banning the app from corporate devices years ago, well ahead of any federal law requiring it. By the time I might have downloaded it out of personal curiosity, it had already been filed away in my head under "things I don't put on a device that touches sensitive networks." So this is the first article in this series where I'm writing about a product I have never personally used, and I think that's worth admitting up front, because it means something different than the previous five articles. Those were confessions. This one is closer to a case file.

That distinction turns out to matter, because it's easy to write about TikTok, or LinkedIn, or the data brokers I'm about to introduce you to, as though they're separate problems from Google and Facebook and Apple. They aren't. They're the same problem wearing different clothes, at a scale that should make the "one bad actor" framing collapse entirely. That collapse is what this article is actually about.

TikTok: The Fix Nobody Asked Whether It Fixed Anything

For years, the TikTok story was simple to summarize and impossible to resolve: a wildly popular app owned by a Chinese company, ByteDance, subject to Chinese national security law that can compel Chinese companies to cooperate with state intelligence work. Congress passed a law in 2024 requiring ByteDance to divest the app or see it banned outright in the U.S. The Supreme Court upheld that law in January 2025. The app briefly went dark for American users. Then a series of executive orders delayed enforcement while a deal was negotiated, for over a year, in the particular way these things get negotiated: publicly uncertain, privately mostly settled.

That deal closed on January 22, 2026. TikTok's U.S. operations were restructured into a new entity, TikTok USDS Joint Venture LLC, majority-owned by American investors. Oracle, the private equity firm Silver Lake, and the Abu Dhabi-based fund MGX hold the largest combined stake, with Oracle also serving as the security partner responsible for auditing the whole arrangement. ByteDance kept a minority stake, reported at 19.9 percent, a number that isn't an accident. It sits just under the threshold the 2024 law set for what counts as foreign control. The recommendation algorithm is being retrained on U.S. user data, inside Oracle's U.S. cloud infrastructure, rather than running on whatever ByteDance built it on before.

Notice what kind of problem this solves. It solves a governance and ownership problem. Who ultimately controls the corporate entity, who could theoretically be compelled to hand something over. It does not, on its own, solve a data collection problem, because the deal was never really about how much data TikTok gathers or what its app does on your device. Those were separate questions, and they were mostly settled before the ownership question ever came up.

Go back to 2022, well before any of this deal-making, and you'll find a security researcher named Felix Krause publishing an analysis showing that TikTok's in-app browser, the one that opens when you tap a link inside the app rather than launching your actual browser, injected JavaScript code capable of tracking every keystroke and tap on third-party websites rendered inside it. TikTok called the findings incorrect and misleading, and said the code existed for debugging and performance monitoring rather than for collecting what people typed. Krause published the code publicly and stood by his read of it. A separate 2022 technical analysis by the security firm Internet 2.0 concluded that TikTok's permission requests were, in the firm's words, excessive and not necessary for the app to function.

Nothing about the January 2026 ownership deal touches any of that. The permission model, if it was excessive before, is presumably still whatever it was. What changed is who's accountable for it on paper, and who has the contractual authority to audit it going forward, which is genuinely useful, but it is not the same thing as the underlying behavior having been examined and fixed. We've seen this exact shape of non-solution before in this series: a control gets added at the level people can see and verify, while the actual mechanism underneath continues doing whatever it was already doing.

LinkedIn: Too Boring to Suspect

Nobody feels surveilled by LinkedIn. That's precisely what makes it worth a section here. Facebook feels invasive because the whole point of the product is your social life. LinkedIn feels like a filing cabinet: your resume, your job history, some mild professional back-patting in the form of endorsements. It doesn't feel like the kind of place where anything alarming could be happening, because the content itself is so mind-numbingly unremarkable.

Two things happened recently that complicate that impression. The first: LinkedIn, owned by Microsoft, announced in September 2025 that starting November 3 of that year, member data (profile information, feed activity, ad engagement) would be shared with Microsoft and its affiliates for AI training. The mechanism was opt-out rather than opt-in, meaning your data was included by default unless you found the setting and turned it off, and even turning it off didn't retroactively remove anything already absorbed. A California lawsuit filed in January 2025 had separately alleged that LinkedIn shared Premium subscribers' private messages specifically for AI training purposes; that suit was voluntarily dismissed later that year after LinkedIn presented evidence it hadn't done that particular thing with private messages. LinkedIn's own account is that the broader profile and activity data sharing continues; the private-message allegation specifically did not hold up under scrutiny.

It's important to note that the private-message claim was contested and the suit was dropped, not proven. The broader pattern (years of professional history, much of it uploaded because a job depended on it, feeding a system by default that you have to actively discover and disable) is not contested. That part is simply how the setting works.

The second thing is less publicized and, in some ways, more interesting from where I sit. LinkedIn Recruiter (the paid tool that, per industry surveys, something like 94 percent of recruiters actually use) shows an entirely different version of your profile than the one you see when you log in. It includes filters most job seekers have never heard of: years in your current company, years in your current role, used by recruiters to screen out candidates who change jobs frequently, before a human ever looks at a resume. You supplied that career history to build a professional presence. It's being used, on the other side of a wall you can't see over, to make a judgment about you that you have no visibility into and no chance to contest.

That's the shape of "more invasive than you'd assume." Not a dramatic leak. A perfectly ordinary business tool, built from data you volunteered for one purpose, doing something adjacent and consequential that you were never told about.

The Companies You've Never Heard Of

Everything in this series so far has been about a company whose name you know. Windows. Google. Facebook. Apple. TikTok. LinkedIn. That's about to change, and it's the most important shift in the whole series, because the companies in this section are the ones actually built for the job of knowing everything about you, and almost nobody outside my field has ever heard their names.

Data brokers are businesses that collect and sell personal information about people they have no direct relationship with. You've never signed up for an account with Acxiom. You've never clicked "I agree" on a terms of service document from Experian's marketing division, or CoreLogic, or LexisNexis, or Epsilon, or a dozen others. They have you anyway, assembled from public records, purchase histories, loyalty programs, app permissions, and data purchased from other brokers in a supply chain most people never think to ask about.

Acxiom, historically one of the largest players in this space, was at one point running over twenty thousand servers processing an estimated fifty trillion data transactions a year, maintaining profiles on roughly 190 million people. The security researcher and writer Bruce Schneier once catalogued some of the categories Acxiom sorted people into: things like "potential inheritor," or "household with a diabetic focus." Not demographics in the conventional sense. Inferences about the shape of your life, sold as a product to whoever wants to reach people who look like you.

The clearest illustration of actual, concrete harm from this industry isn't hypothetical, and it isn't old news. In 2022, the FTC sued a location-data broker called Kochava for selling precise geolocation data pulled from hundreds of millions of mobile devices: data granular enough to trace a specific phone's visits to reproductive health clinics, places of worship, domestic violence shelters, and addiction recovery centers. Almost none of that data came from anyone knowingly agreeing to share their location with Kochava. It arrived through a much quieter path: developers embedded Kochava's tracking code inside ordinary apps, often bundled in for advertising or analytics purposes, and when someone granted a weather app or a mobile game permission to see their location, that permission cascaded straight into Kochava's data pipeline. Nobody read a privacy policy carefully enough to understand that a company in Idaho would end up holding a timestamped map of their movements.

That case reached a settlement in February 2026 (just months before I sat down to write this), barring Kochava from selling sensitive location data without a person's affirmative, informed consent. It's a real result. It's also one company, in an industry made up of dozens of functionally similar businesses that weren't named in that particular lawsuit and aren't bound by that particular settlement.

There is an encouraging, albeit rare, regulatory response taking shape. California's Delete Act now requires data brokers to register annually with the state, and as of 2026 the state stood up something called DROP (the Delete Request and Opt-Out Platform) that lets a California resident submit a single deletion request intended to reach every registered broker at once, rather than fighting each company individually. Enforcement only fully began in August 2026, and it is, for now, a California-only mechanism in a country that still has no comprehensive federal privacy law. But it is the first meaningful crack of actual teeth this industry has faced. I'll take it as a start, while noting that a start is what it is.

The Chickens

Somewhere in the drafting of this series, I came across an analogy for the social media and advertising economy that I liked enough to want to close this article with it. I don't know who first wrote it. I couldn't find an original source. The framing has stuck with me since I found it, and I think it belongs here more than anywhere else in the series, because this is the article where the pattern finally becomes undeniable.

The idea is that the social media and advertising ecosystem runs as a three-tier arrangement. The platforms are the farmers: they own the coop, set the rules, and collect what the operation produces. The advertisers are the customers, paying for access to what's inside. And the users are the chickens: the ones actually generating the value, through posts and clicks and attention and location pings and endorsements and resumes, feeding an operation that was built to convert exactly that activity into something sellable.

You are not the customer in this arrangement, on TikTok or LinkedIn or Facebook or anywhere else in this series. You were never quite the product either, not literally: the actual product is the access to you, packaged and sold to whoever's buying. What you are is the thing that keeps the entire operation fed, day after day, mostly without noticing you're doing it.

I titled this article "Everyone Is Doing It" because that's the honest, unglamorous truth of where this series has arrived. It is not five or six companies behaving badly. It's TikTok under new American ownership still running the same app. It's LinkedIn, which nobody suspects of anything, quietly training AI on your career history by default. It's dozens of data brokers whose names you'll forget by tomorrow, one of whom just got caught selling a map of who visits abortion clinics. Different logos, different mechanisms, identical underlying arrangement. The business model isn't a few companies exploiting a loophole. The business model is the whole coop.

In the next article, I want to look at the legal architecture that makes all of this technically voluntary: the terms of service nobody reads, and the quieter design choices that make the privacy-protective option harder to find than the one that hands your data over. It's the piece that finally answers the question this whole series has been circling: if nobody explained any of this clearly enough for real consent, what do you call the agreement everyone supposedly made?