We're excited to announce that the Singapore IMDA has accepted TikTok's PrivacyGo toolkit as part of the IMDA's PET Sandbox.

This collaboration highlights how privacy-enhancing technologies (PETs) can enable privacy-preserving analytics for advertising and beyond in real-world deployments.

IMDA and the PET sandbox

The Infocomm Media Development Authority (IMDA) is Singapore's statutory agency overseeing digital regulation, innovation, and data privacy strategy. In partnership with the Personal Data Protection Commission (PDPC), IMDA launched the Privacy-Enhancing Technology (PET) Sandbox in July 2022 to support organizations experimenting with PETs through real-world pilots and providing regulatory support.

PrivacyGo: What it is and how it works

PrivacyGo is TikTok’s open‑source framework for combining multiple PETs—such as Differential Privacy (DP), Secure Multi‑Party Computation (MPC), Homomorphic Encryption (HE), and others—to perform privacy-safe analytics (GitHub & TikTok for Developers).

The motivation: Individual PET techniques each have trade‑offs in privacy, utility, and efficiency, and there is no silver bullet. Special care must be taken when combining multiple PETs to (1) keep the advantages and avoid the shortcomings of individual PETs, and (2) avoid introducing unexpected information leakage.

One core protocol in PrivacyGo is DPCA‑PSI, which carefully combines Private Set Intersection (PSI) with a DP mechanism to match datasets across parties without revealing sensitive membership details or intersection sizes beyond calibrated, privatized outputs.

As a pilot project developed by TikTok, PrivacyGo enabled publishers and advertisers to compute ad attribution and campaign effectiveness using this two-step approach:

• Intersect: Identify common users via DPCA‑PSI, with encrypted identifiers and noise‑added shuffling
• Compute: Aggregate conversion values via MPC‑DualDP and HE, returning differentially private campaign metrics without exposing individual-level data.

This design supports large-scale datasets (e.g. 10 million user records), efficient compute time, and low communication cost, key requirements in real deployment.

Regulatory insights from PDPC

As part of the PET Sandbox pilot, TikTok sought guidance from Singapore's Personal Data Protection Commission (PDPC) on whether the data exchanged between the advertiser and publisher would be considered personal data under the Personal Data Protection Act (PDPA).

In their summary report, IMDA PET SANDBOX – TikTok CASE STUDY, PDPC concluded that "the data sharing between the parties does not constitute a disclosure or collection of personal data under the PDPA for the disclosing party and the receiving party respectively," as there was no serious risk of re-identifying individuals. This view was based on the presence of several safeguards, including data shuffling, dummy records, strong encryption, and the use of Secure Multi-Party Computation (SMPC) to generate only aggregated, privacy-preserving outputs.

Next steps

We're proud to be part of the IMDA's PET Sandbox use case, an important milestone that validates our open source framework as both technically robust and regulator-reviewed.

If your organization is exploring Privacy-Enhancing Technologies—whether in marketing, healthcare, finance, or AI—we invite you to take the next step with us:

• Explore PrivacyGo: Our open source project that combines MPC, DP, and HE to help you implement secure, scalable, and compliant analytics.
• Collaborate with us: We're actively looking to partner with developers, researchers, enterprises, and regulators who want to co-create privacy-preserving solutions.

You can discover more about PrivacyGo and other innovative open source projects from TikTok on our Open Innovation platform, and we welcome you to reach out for collaboration and partnership opportunities.