TikTok Phone-Username Privacy Audit

I need a clear, reproducible assessment that proves (or disproves) whether a phone number can be turned into a TikTok username and, in the process, expose personal information such as a user’s name or email. My goal is to understand the extent of this user-data exposure and verify whether the current behaviour complies with TikTok’s own privacy policy.

Here’s what matters most to me:
• A methodology that shows how the lookup is carried out—API calls, OSINT techniques, fuzzing or any other route you take.
• Concrete evidence of what data is revealed at each step, including full request/response captures, screenshots or logs.
• A comparison of your findings against the wording of TikTok’s privacy policy to highlight any non-compliance.
• Clear, practical recommendations I can forward to the relevant security or legal team.

Acceptance criteria
1. You demonstrate at least one working proof-of-concept that starts with a phone number and ends with a confirmed TikTok username.
2. You document every endpoint or process used, plus required headers or tokens, so the test is repeatable.
3. You flag any rate limits, captchas or mitigation controls encountered.
4. The final report is concise, well-structured, and delivered in PDF and Markdown.

Feel free to use tools such as Burp Suite, mitmproxy, Python requests, or any specialised TikTok API libraries—whatever gets the job done cleanly and ethically.