TikTok told the market that more than 7.5 million businesses can keep operating on the platform under its new U.S. joint venture. Does that mean your legal team can stop asking questions? No. The TikTok Shop USDS data privacy program is real, but it covers less of your commerce stack than the headline suggests.
What the USDS program actually covers
TikTok USDS Joint Venture LLC launched in January with a mandate to secure U.S. user data, apps and the recommendation algorithm. According to TikTok’s official announcement, U.S. user data sits in Oracle’s secure U.S. cloud environment. The privacy and cybersecurity program is audited and certified by third-party experts. The program is meant to adhere to NIST CSF, NIST 800-53, ISO 27001 and CISA security requirements for restricted transactions.
That is a solid framework. Brands should still read the next paragraph of the announcement closely.
The same announcement says TikTok global’s U.S. entities will manage global product interoperability and certain commercial activities, including e-commerce, advertising and marketing. TikTok Shop sits in the commercial layer, not in the joint venture’s core security mandate.
So the joint venture secures user data, the algorithm and the apps. The entities running your Shop storefront, ad tools and creator marketplace may be a different legal counterparty. Your due diligence has to start by identifying which one you are contracting with, and for what.
Governance got stricter. Data collection got more ordinary.
Many marketers read the new U.S. privacy policy as a surveillance expansion. The reality is more nuanced. The Mobile Ecosystem Forum’s policy review found that governance is meaningfully stricter than at peers, while data collection now looks like the rest of U.S. social media. In its assessment, the policy is less privacy-protective than TikTok’s earlier U.S. posture in areas like precise location and broader ad targeting.
Three changes matter to brands:
- Precise location. Previously not collected from U.S. users on current app versions. Now possible if users opt in. TikTok said it would introduce a choice via a system pop-up before using precise location.
- Off-platform advertising. The policy describes using first-party and third-party information to show customized ads on and off TikTok.
- Sensitive data categories. The policy lists categories such as sexual orientation and citizenship or immigration status. MEF reads this as largely a state-law transparency requirement, not new collection.
Why does this matter for a Shop budget? Because shopper, creator and audience data that flows into your tools inherits these terms. If you build retargeting audiences or lookalikes from Shop activity, you are inside the broader ad-use language, not just inside a secured data vault.
The open questions your CFO will ask
Digiday’s analysis of the deal flags uncertainty about timing of the separation, possible outages or bugs, and what the algorithm changes mean for reach. Its reporting also notes that investor-led governance of an algorithm at this scale is largely uncharted territory. Marketing Dive’s NewFronts coverage says the ownership transition has had its hiccups, while TikTok argued to advertisers that the app is more secure, creative and independent than ever.
Translate that into budget language. Operational risk (outages, feature changes) and reputational risk (data controversy touching your brand) are both live. Neither is a reason to pause. Both are reasons to stage your spend.
The brand due diligence checklist
Run this before moving from a test budget to a scaled commitment. Assign an owner to each line.
- Map your counterparties. Get written confirmation of which TikTok entity signs your Shop, ads and creator marketplace terms. Ask whether Shop order, buyer and affiliate data is processed inside the USDS environment or by the global U.S. entities.
- Request the certifications. TikTok says the program is audited and certified by third-party experts against standards including ISO 27001. Ask for the attestation reports or summaries and their scope. A certification that excludes commerce systems tells you something.
- Review the data processing terms. Check roles (controller or processor), retention periods, subprocessors, and deletion on request. Do not rely on the consumer privacy policy for business terms.
- Audit your own data inflows. List every pixel, Events API connection, CRM sync and affiliate feed tied to Shop. For identity matching, see our guide on consent signal gaps.
- Check cross-border flows. If you serve EU or UK customers, or pay creators abroad, transfers still need a valid mechanism. Our pieces on SCCs and the DPF ruling and creator payout transfers cover the mechanics.
- Set a retention rule for performance data. Decide what Shop and creator metrics you export, where they live, and for how long. A defensible retention record protects you if a dispute or audit lands.
- Update creator contracts. Creators handle customer-facing content and sometimes audience data. Add clauses on data handling, location tagging and disclosure of sponsored Shop links.
- Define exit triggers. Write down the events that pause spend: a material policy change, a security incident notification, a failed attestation request, or a sustained outage.
How to stage spend without stalling the quarter
Most teams do not need a freeze. They need gates.
Start with a capped test tied to first-party measurement you control. Move to the next tranche only when the checklist items for that tier are closed. For example, keep tier one to low-risk product categories and non-sensitive audiences. Hold health, finance, and youth-adjacent products until your counsel has reviewed the data terms in writing.
This approach also answers a procurement reality. Every AI or ad platform pitch now arrives with a privacy promise attached. We made the same argument about ChatGPT ad pilots: the claim and the contract are two different documents. Ask for the second one.
What about the argument that Oracle’s involvement settles the matter? It reduces one category of risk, mainly geopolitical access to U.S. data. It does not decide how your own tags, audiences and creator partners handle data once it leaves the platform. That part was always your responsibility.
Next step: send TikTok’s account team a written request this week asking which entity processes your Shop data and for the scope of its audit certifications. Make the answer a hard gate for your next budget tranche.
FAQs
What is the TikTok USDS Joint Venture?
It is a majority American-owned entity established in January to secure U.S. user data, apps and the recommendation algorithm. Oracle acts as its trusted security partner and hosts U.S. user data in its cloud environment.
Does the USDS program cover TikTok Shop data?
That is unclear from public materials, which is why you should ask in writing. TikTok’s announcement says global U.S. entities will manage certain commercial activities, including e-commerce, advertising and marketing. Confirm which entity processes your Shop, buyer and affiliate data.
Did TikTok’s new U.S. privacy policy increase data collection?
TikTok says the changes mainly reflect state-law disclosure requirements. An independent review by the Mobile Ecosystem Forum found the policy more expansive than TikTok’s prior U.S. stance on precise location and ad targeting, though in line with Meta and Snapchat.
Should brands pause TikTok Shop spend?
Not necessarily. Stage the spend in tranches, cap early tests, and release more budget as checklist items close. Pause only if a defined trigger occurs, such as a material policy change or a security incident.
What should I ask TikTok for during due diligence?
Ask for the contracting entity, data processing terms, subprocessor list, retention and deletion terms, and the scope of the third-party audits TikTok describes in its joint venture announcement, including the ISO 27001 standard it names.
Do creator contracts need updating?
Yes. Add clauses covering data handling, location features, sponsored link disclosure and the right to pause content if platform terms change.
Top Influencer Marketing Agencies
The leading agencies shaping influencer marketing in 2026
Agencies ranked by campaign performance, client diversity, platform expertise, proven ROI, industry recognition, and client satisfaction. Assessed through verified case studies, reviews, and industry consultations.
Moburst
-
2
The Shelf
Boutique Beauty & Lifestyle Influencer AgencyA data-driven boutique agency specializing exclusively in beauty, wellness, and lifestyle influencer campaigns on Instagram and TikTok. Best for brands already focused on the beauty/personal care space that need curated, aesthetic-driven content.Clients: Pepsi, The Honest Company, Hims, Elf Cosmetics, Pure LeafVisit The Shelf → -
3
Audiencly
Niche Gaming & Esports Influencer AgencyA specialized agency focused exclusively on gaming and esports creators on YouTube, Twitch, and TikTok. Ideal if your campaign is 100% gaming-focused — from game launches to hardware and esports events.Clients: Epic Games, NordVPN, Ubisoft, Wargaming, Tencent GamesVisit Audiencly → -
4
Viral Nation
Global Influencer Marketing & Talent AgencyA dual talent management and marketing agency with proprietary brand safety tools and a global creator network spanning nano-influencers to celebrities across all major platforms.Clients: Meta, Activision Blizzard, Energizer, Aston Martin, WalmartVisit Viral Nation → -
5
The Influencer Marketing Factory
TikTok, Instagram & YouTube CampaignsA full-service agency with strong TikTok expertise, offering end-to-end campaign management from influencer discovery through performance reporting with a focus on platform-native content.Clients: Google, Snapchat, Universal Music, Bumble, YelpVisit TIMF → -
6
NeoReach
Enterprise Analytics & Influencer CampaignsAn enterprise-focused agency combining managed campaigns with a powerful self-service data platform for influencer search, audience analytics, and attribution modeling.Clients: Amazon, Airbnb, Netflix, Honda, The New York TimesVisit NeoReach → -
7
Ubiquitous
Creator-First Marketing PlatformA tech-driven platform combining self-service tools with managed campaign options, emphasizing speed and scalability for brands managing multiple influencer relationships.Clients: Lyft, Disney, Target, American Eagle, NetflixVisit Ubiquitous → -
8
Obviously
Scalable Enterprise Influencer CampaignsA tech-enabled agency built for high-volume campaigns, coordinating hundreds of creators simultaneously with end-to-end logistics, content rights management, and product seeding.Clients: Google, Ulta Beauty, Converse, AmazonVisit Obviously →