The TikTok USDS Joint Venture, created under a national security executive order, reshapes who secures US user data. It does not automatically resolve your own exposure. Here is what changed and what to check.
What the executive order actually did
The September 2025 executive order determined that a framework agreement for TikTok’s US operations met the legal test for a “qualified divestiture” under the federal divest-or-ban Act. That matters because the Act bars former affiliates from keeping an “operational relationship” with the app’s US operations. The order spells out that this includes cooperation on the content recommendation algorithm and agreements on data sharing.
The order lists four safeguards in plain terms:
- Algorithms, code, and content-moderation decisions move under the control of the new joint venture.
- Sensitive US user data cannot be stored where a foreign adversary controls it, and it must sit in a cloud environment run by an American company.
- Trusted security partners monitor software updates, algorithms, and data flows.
- Recommendation models that use US user data must be retrained and monitored by those partners.
Read that list again. Every item concerns user data, code, and the algorithm. None of it is written as a brand-facing guarantee. That gap is where your risk lives.
Who runs what: the joint venture and the rest of TikTok
On January 23, 2026, TikTok published its official announcement that the TikTok USDS Joint Venture LLC had been established. The company describes it as majority American owned, built on the foundation of the existing TikTok U.S. Data Security (USDS) organization, and governed by a seven-member, majority-American board.
The joint venture’s stated mandate covers four areas:
- Data protection: US user data is protected in Oracle’s US cloud environment, under a privacy and cybersecurity program audited and certified by third parties. The announcement says the program will follow major industry standards, including NIST CSF and 800-53, plus CISA’s Security Requirements for Restricted Transactions.
- Algorithm security: The recommendation algorithm is retrained, tested, and updated on US user data, and secured in Oracle’s US cloud.
- Software assurance: Ongoing source code review, assisted by Oracle as Trusted Security Partner.
- Trust and safety: The joint venture holds decision-making authority over moderation policy.
Now the line that should make every paid social lead pause. According to the same announcement, TikTok global’s US entities will manage global product interoperability and certain commercial activities, including e-commerce, advertising, and marketing.
The entity securing US user data and the entity running advertising and commerce are not described as the same thing. Your data processing agreement needs to name which one touches your data.
I am not saying that signals a problem. I am saying the announcement splits responsibilities, and your contracts, pixel setups, and audience uploads probably were not drafted with that split in mind.
Where brand data actually touches the platform
Think of the flows a typical program creates. Then ask which side of the split each one lands on.
- Pixel and Events API data. Purchase events, hashed emails, and site behavior flow into TikTok Ads Manager. This is advertising infrastructure, which the announcement places with global’s US entities.
- Customer list uploads. CRM audiences are your first-party data. Once uploaded, who stores it and under which policy?
- Creator-side data. Spark Ads authorizations, creator analytics exports, and affiliate payout details travel through the platform and through your own tools.
- Third-party measurement. Attribution, social listening, and brand-lift vendors pull TikTok data through APIs, then store it elsewhere.
The fourth flow is the one most teams forget. Even if the platform’s US data sits in Oracle’s cloud, a measurement vendor that copies it into its own warehouse has created a new copy under a new set of rules. Our guide on vendor audit rights covers what to demand contractually.
Does the new structure change your compliance obligations?
Short answer: not on its own. The executive order is a national security instrument aimed at the platform’s ownership and operations. It does not rewrite state privacy statutes, the FTC’s endorsement rules, or children’s privacy law. Your duties as a data controller or business stay where they were.
What it can change is your factual situation. If your privacy notice tells customers where data goes, or your enterprise clients ask whether campaign data is handled inside a US-controlled environment, you now have a better answer to give, but only if you verify it for your specific flows. Do not repeat the platform’s headline claims to a client as if they were your own warranties. Cite the source, state what it covers, and state what it does not.
Two groups deserve extra care:
- Regulated and public-sector-adjacent brands. Financial services, health, and government contractors often run vendor risk reviews. Expect questions about the TikTok structure, and have documentation ready.
- Brands targeting younger audiences. Minors’ data carries its own rules regardless of ownership. See our breakdown of teen audience privacy rules for how that affects creator selection.
A practical audit in five steps
You do not need a legal task force. You need a short, disciplined review, ideally finished within one quarter.
- Map every TikTok data flow. List pixels, API connections, audience uploads, creator exports, and any tool with TikTok credentials. One spreadsheet is enough.
- Request written clarification. Ask your TikTok account rep which entity acts as processor for each flow and under which terms. Save the reply. Verbal assurances will not help in an audit.
- Re-read vendor contracts. Look for data location, subprocessor lists, retention periods, and deletion on termination. Our checklist on vetting data privacy for AI discovery tools applies equally to any platform-connected vendor.
- Check on-site tracking. If you use TikTok’s pixel alongside analytics scripts, confirm what is captured. Session capture tools carry separate litigation exposure, explained in our piece on session replay trackers.
- Update creator agreements. Creators handle audience data, whitelisting access, and usage analytics. Align your contract clauses and indemnities with what they are actually allowed to share.
Contingency: what if the structure shifts again?
TikTok’s US status has moved repeatedly over several years. Planning as if the current arrangement is permanent is a bet, not a strategy.
Build modest resilience. Keep first-party audiences in your own CDP so you can redeploy them on Instagram, YouTube, or Snapchat within days. Avoid contracts that lock creators into TikTok-exclusive deliverables without a platform-change clause. Keep creative assets in your own storage, not only in the platform’s library. None of this signals pessimism. It is the same discipline you would apply to any single channel that carries a large share of spend.
Treat the joint venture as a stronger starting position, not a finished compliance answer. The proof sits in your own data map and signed documents.
FAQs
What is the TikTok USDS Joint Venture?
It is a majority American owned entity, announced on January 23, 2026, that is responsible for securing US user data, the app, and the recommendation algorithm. It builds on TikTok’s existing U.S. Data Security organization and operates with its own board and a Security Committee.
Where is US TikTok user data stored now?
According to TikTok’s announcement, US user data is protected by the joint venture in Oracle’s secure US cloud environment. The executive order also requires that sensitive US user data be stored in a cloud run by an American company and not under foreign adversary control.
Does the joint venture handle TikTok advertising and e-commerce?
The announcement states that TikTok global’s US entities will manage global product interoperability and certain commercial activities, including e-commerce, advertising, and marketing. Brands should confirm in writing which entity processes their ad and commerce data.
Do brands need to change their privacy policies because of this?
Not automatically. The order targets platform ownership and operations, not advertiser obligations. Review your privacy notice only if it makes specific claims about where TikTok-related data is stored or who processes it, and have counsel confirm any updates.
Can brands tell clients their campaign data is now fully protected?
No. Safeguards described by TikTok and the executive order cover the platform’s handling of US user data. They do not cover copies held by your agencies, measurement vendors, or creators, so avoid blanket assurances.
Should brands reduce TikTok spend because of the national security issue?
That is a business decision, not a legal requirement stemming from the order. The order was designed so that US users and businesses could keep using the app. A sensible middle path is to keep spend while building portability for audiences and assets.
Next step: this week, build the data-flow map from step one and send your TikTok rep a written question asking which entity processes each flow.
Top Influencer Marketing Agencies
The leading agencies shaping influencer marketing in 2026
Agencies ranked by campaign performance, client diversity, platform expertise, proven ROI, industry recognition, and client satisfaction. Assessed through verified case studies, reviews, and industry consultations.
Moburst
-
2
The Shelf
Boutique Beauty & Lifestyle Influencer AgencyA data-driven boutique agency specializing exclusively in beauty, wellness, and lifestyle influencer campaigns on Instagram and TikTok. Best for brands already focused on the beauty/personal care space that need curated, aesthetic-driven content.Clients: Pepsi, The Honest Company, Hims, Elf Cosmetics, Pure LeafVisit The Shelf → -
3
Audiencly
Niche Gaming & Esports Influencer AgencyA specialized agency focused exclusively on gaming and esports creators on YouTube, Twitch, and TikTok. Ideal if your campaign is 100% gaming-focused — from game launches to hardware and esports events.Clients: Epic Games, NordVPN, Ubisoft, Wargaming, Tencent GamesVisit Audiencly → -
4
Viral Nation
Global Influencer Marketing & Talent AgencyA dual talent management and marketing agency with proprietary brand safety tools and a global creator network spanning nano-influencers to celebrities across all major platforms.Clients: Meta, Activision Blizzard, Energizer, Aston Martin, WalmartVisit Viral Nation → -
5
The Influencer Marketing Factory
TikTok, Instagram & YouTube CampaignsA full-service agency with strong TikTok expertise, offering end-to-end campaign management from influencer discovery through performance reporting with a focus on platform-native content.Clients: Google, Snapchat, Universal Music, Bumble, YelpVisit TIMF → -
6
NeoReach
Enterprise Analytics & Influencer CampaignsAn enterprise-focused agency combining managed campaigns with a powerful self-service data platform for influencer search, audience analytics, and attribution modeling.Clients: Amazon, Airbnb, Netflix, Honda, The New York TimesVisit NeoReach → -
7
Ubiquitous
Creator-First Marketing PlatformA tech-driven platform combining self-service tools with managed campaign options, emphasizing speed and scalability for brands managing multiple influencer relationships.Clients: Lyft, Disney, Target, American Eagle, NetflixVisit Ubiquitous → -
8
Obviously
Scalable Enterprise Influencer CampaignsA tech-enabled agency built for high-volume campaigns, coordinating hundreds of creators simultaneously with end-to-end logistics, content rights management, and product seeding.Clients: Google, Ulta Beauty, Converse, AmazonVisit Obviously →