It’s both.

The companies who do this shit absolutely need to be regulated way more aggressively.

TikTok (ByteDance), being a Chinese company based in the PRC, is compelled to operate in partnership with the CCP by law, which gives the CCP an insane degree of visibility and control into their systems. I would be absolutely unsurprised to find that the CCP is compelling them to tweak their algorithms and push specific content to specific audiences, in addition to the data gathering they’re surely engaged in. Source: I work for an oncology biotech, and we halted our Chinese efforts because there was apparently no legal way to square the circle with regard to data privacy/HIPAA considerations.