What you agreed to with TikTok and the social networks: typing rhythm, mouse movement and your habits

In the article about unknown numbers we promised a sequel. There the heart of it was that an app makes you hand over the data of other people. Here it is the other way round, and for many people less comfortable: you hand over yourself, in detail, entirely voluntarily, and all of it is written in the terms you agreed to. We opened them and compared them. One finding surprised us even after years in the field.

The rhythm with which you hit the keys

Let us start with what gets repeated about TikTok most often, because it is also the one place where the repeated story matches the document.

TikTok's European policy lists, among the technical information collected automatically, also keystroke patterns or rhythms. It sits there next to the device model, the operating system and the IP address. Automatically means it is not a choice: it is not a permission you could refuse the way you refuse access to contacts.

The other side needs saying too, otherwise this would be misleading. TikTok maintains that it is not recording what you type, but how you type: whether the gaps between keystrokes are exactly equal, which gives away a machine rather than a person. It states the purpose as verifying the authenticity of an account, risk control and debugging.

That explanation makes technical sense. But typing rhythm is at the same time a behavioural biometric: people type recognisably differently, and with enough data one person can be told apart from another by it. Whether anyone uses it that way, you will not read out of the terms. You will only read that it is collected.

The surprise: one app, two sets of rules

This is the finding that makes it worth reading the terms in the right version. TikTok does not have one policy but several, by region. We compared the European one with the American one, and the difference is not cosmetic.

The US version speaks of biometric data including faceprints and voiceprints taken from the content you upload, and refers to US laws. The European version has no such sentence; it says only that it analyses content for the presence and location of a face or other body parts in an image.

Mouse movement, and what you do when you are doing nothing

If you expected mouse movement at TikTok, you will not find it in either version. You will find it elsewhere, and written down quite openly.

Meta's policy, covering Facebook, Instagram and Messenger, effective from 23 July 2026, lists among the data it collects also what you are doing on your device, such as whether our app is in the foreground or if your mouse is moving, with a note in brackets that this helps tell humans from bots.

Read that again. It is not about what you do in the app. It is about whether your mouse is moving and whether the window is on top. That is a fact about you, not about your use of the service.

The same policy lists, among its examples of device information, also:

• battery level and signal strength,
• available storage,
• names and types of apps and files,
• browser type and plugins,
• and, in a separate category, device signals: GPS, Bluetooth signals, nearby Wi-Fi access points, beacons and cell towers.

If you have given access to your photo library, metadata of photos and videos is collected too, including the date and time they were made.

Every single one of those items has a defensible explanation. The battery so that playback does not eat the rest of your charge. Signal strength for video quality. Nearby Wi-Fi for location. But this is not about the individual items. Together they are a description of your device so detailed that you could pick it out among millions of others without a name attached. And that is exactly what the platforms formally warn against, which we come to in a moment.

Human habits that became the subject of proceedings

The most interesting thing of the past year did not happen in the terms but in Brussels. And it concerns exactly what an ordinary person notices about themselves: that you open it for five minutes and an hour is gone.

On 6 February 2026 the European Commission preliminarily found that TikTok, through its addictive design, breaches the Digital Services Act. It names specific features: infinite scroll, autoplay, notifications and a highly personalised recommender system.

One thought from the reasoning is worth quoting, because you would not expect it in a legal document. The Commission writes that by constantly rewarding users with new content these features fuel the urge to keep scrolling and shift the user's brain into autopilot mode, which according to scientific research may lead to compulsive behaviour and reduce self-control.

The Commission also faulted TikTok for disregarding indicators of compulsive use that it had available: how much time minors spend in the app at night and how often they open it. And that its time management tools do not work, because they are easy to dismiss and introduce too little friction, while parental controls demand extra time and skills from the parent.

This is so far a preliminary finding, not a decision. TikTok may respond to it. If it were confirmed, the fine could reach up to 6 % of total worldwide annual turnover. The Commission also hinted at the remedy: switch off infinite scroll, introduce real breaks including at night, and adapt the recommender system.

In other words: what you suspected about yourself is being assessed by a regulator as a design feature, not as your weakness.

What Apple and Google are actually supposed to allow

Here is the heart of your question, and the answer is more interesting than expected. The app store rules are surprisingly strict. Stricter than you would guess from those lists of data.

Apple states in its app review guidelines that apps should only request access to data relevant to the core functionality of the app and only collect and use what is required for the task. Further:

• data collected for one purpose may not be used for another without further consent,
• apps must not surreptitiously build a profile of the user, nor try to re-identify people from data labelled as anonymous,
• from contacts and photos no database of your own may be built and it is not allowed to collect which other apps a person has installed, for analytics or advertising,
• tracking across apps and websites requires explicit permission through App Tracking Transparency, and an app may not make its functionality or a reward conditional on your giving it.

And on top of that, the essential part: creating a device fingerprint is forbidden even when the user permits tracking. It is not an exception you can buy with consent.

Google takes a similar route. Permissions and sensitive interfaces must be necessary for the app's core functions and limited to the purposes the user consented to. From 28 October 2026 two changes worth mentioning arrive: apps that do not need the whole address book must use the system contact picker instead of access to everything, and for precise location the recommended minimum becomes a one off location button.

So how can file names be in the terms

The question is fair and the answer is uncomfortable but true. A discrepancy between the rules and the lists is not proof that anybody is breaking the rules. There are three reasons and they are worth knowing:

• Privacy policies are written broadly. They describe what a company may process across all its products and platforms, not what your app is doing on your phone. Part of it applies to the web, not to mobile.
• A lot of it is conditional on permission. Contacts, location, photos, microphone: without your tap they do not happen. That is why it is worth going through those permissions.
• Store rules are enforced by review and by developer declarations, not by a line by line comparison with the text of a policy. The store checks what the app does, not what the company wrote in a legal document.

From that follows a practical conclusion, which in our series is always the same: what decides is your permissions on the phone, not a kind word in the terms. The terms tell you what is possible. The permissions determine what happens.

What you can do about it in fifteen minutes

• Go through the app's permissions. On iPhone open Settings and the app in question, on Android Settings, Apps and Permissions. Revoke contacts, precise location, microphone and photos everywhere the app does not need them for what you actually do with it.
• Turn off tracking across apps. On iPhone Settings, Privacy and Security, Tracking. On Android reset the advertising ID in the Google settings.
• With photos give a selection, not the whole library. Both systems can do it: the app sees only the photos you show it.
• Do not synchronise your address book. This is exactly the thing from our article about unknown numbers: you are not handing over yourself, you are handing over the people you know.
• Ask for your own data. Under Article 15 GDPR you have the right to a copy and most networks have a button for it in the settings. It makes instructive reading.
• Object to profiling for advertising. Article 21 GDPR allows you to, and for direct marketing you do not have to give a reason.
• If what you care about is time rather than data, switch off notifications and keep the service in the browser only. That removes most of what the Commission called addictive, and at the same time most of the access to your device.

How to read terms so that it is worth something

This is the third article in our series and the advice is the same every time, because every time it holds: open them and read them, even when they are long and even when they are in a foreign language. A translator handles it. With these three documents two more things are worth adding.

1. Find the right regional version. As you saw above, the American and the European one differ in what is collected at all. Look in the address or the header for a mention of the European Economic Area.
2. Open the “see examples” links. The most interesting items tend not to be in the main text but in the expandable notes beneath it. The battery, the free storage and the file names are exactly there.

And what we wrote last time holds too: with a legitimate service these things are stated, even when they do not look flattering, because it has to state them. With a scam they are missing instead. That is precisely why the truth can be found in the terms. An uncomfortable truth, but it is there.

A closing word without moralising

We are not telling you to delete TikTok or Instagram. It is not our business and it would not be honest either; we run client projects on those networks.

We are saying something more modest. You agreed to a document that says your typing rhythm is collected, whether your mouse is moving, how much battery you have and what the files on your device are called. That is not a conspiracy or a leak; it is a contract you entered into. The difference between a person who knows this and a person who does not is not in what is collected about them. It is in whether they can make a decision.

And the decision is in the end a very practical one: go through your permissions. It takes fifteen minutes and it is the only part of this whole subject that is entirely in your hands.

Related reading

The first part of the series is about what you hand over from your address book: An unknown number is calling: how caller ID services work and what you hand over for them.

The second is about what happens when the terms are missing instead: A clone instead of the original: how a fake site outranks the real one in Google.

And if you are curious what your own visitors are giving away on your website, our Free audit will show which third party scripts run on it and who they send data to.