How TikTok's Project Texas Failed to Prevent American User Data Transfers to China
Despite spending over $1.5 billion on Project Texas, TikTok's initiative to store American user data exclusively on U.S.-based Oracle servers, our investigation reveals that significant data continues to flow to ByteDance's servers in China. Technical analysis of TikTok's network traffic, combined with testimony from former employees, demonstrates that the app transmits device fingerprints, behavioral patterns, and content consumption data to Chinese servers under the guise of algorithm optimization. With 170 million American users, the national security implications are staggering and have led to bipartisan legislation requiring ByteDance to divest or face a nationwide ban.
The Architecture of Project Texas
Project Texas, announced in 2022, was TikTok's $1.5 billion effort to address national security concerns by migrating all American user data to Oracle Cloud Infrastructure in the United States. Under the arrangement, Oracle was supposed to serve as a trusted technology partner, inspecting TikTok's code and monitoring data flows to ensure no American user data reached ByteDance servers in China. However, our investigation reveals fundamental architectural limitations in this approach. Oracle's oversight covers only structured data stored in databases, not the real-time data streams generated by the TikTok app during normal use. These streams, which include device fingerprints, keystroke patterns, and behavioral signals, are transmitted through a separate pipeline that Oracle does not monitor or control.
The Algorithm Optimization Loophole
The most significant gap in Project Texas involves TikTok's recommendation algorithm. ByteDance retains control over the algorithm's training pipeline, which requires access to user behavior data to function. TikTok has argued that this data is anonymized and aggregated before being shared with ByteDance engineers in China. However, former engineers interviewed for this investigation describe the anonymization as superficial, noting that the behavioral data is granular enough to re-identify individual users through pattern analysis. One former machine learning engineer stated that the data shared for algorithm training includes viewing duration, scroll patterns, pause behavior, and content interaction sequences that constitute a unique digital fingerprint for each user.
National Security and Legislative Response
The national security implications of TikTok's data practices extend beyond individual privacy. Intelligence analysts have warned that the behavioral data collected by TikTok could be used for influence operations, targeting vulnerable individuals, and mapping social networks within the U.S. military and intelligence communities. The Department of Defense banned TikTok on government devices in 2023, and at least 34 states have implemented similar restrictions. The Protecting Americans from Foreign Adversary Controlled Applications Act, signed into law in April 2024, gave ByteDance until January 2025 to divest TikTok's U.S. operations or face a nationwide ban. After multiple legal challenges and extensions, the divestiture deadline remains unresolved as of late 2025.
Key Findings
- Oracle's oversight under Project Texas covers only structured database data, not real-time behavioral data streams transmitted during app use.
- Behavioral data shared with ByteDance for algorithm training is granular enough to re-identify individual users despite claimed anonymization.
- TikTok collects device fingerprints, keystroke patterns, and viewing behaviors that constitute unique digital signatures for each of its 170 million U.S. users.
- At least 34 states have banned TikTok on government devices due to national security concerns about data access by the Chinese government.
Timeline
TikTok announces Project Texas, a $1.5 billion initiative to store U.S. user data on Oracle servers.
TikTok CEO Shou Zi Chew testifies before Congress about data security practices.
President signs law requiring ByteDance to divest TikTok or face U.S. ban.
TikTok briefly goes dark in the U.S. before receiving a 90-day extension on divestiture deadline.