It’s easy to get hooked on TikTok's endlessly scrolling videos, but there's been a bit of a dark cloud hanging over the super-popular app, coming under constant fire for its alleged links to the Chinese government. Now a new investigation reveals that the overlords at TikTok’s parent company ByteDance spied on Forbes journalists. This news comes the same week Congress will decide on banning TikTok from US government devices.

The whole saga began in June, when BuzzFeed learned that ByteDance employees in China can and do secretly access US user data. The outlet found concrete evidence in dozens of leaked recordings of TikTok’s internal meetings. TikTok took no time to announce that all its US user data will be routed through Oracle’s cloud network within the country and that it will delete the data from its own servers.

Fast-forward to today, and it looks like ByteDance still has the capability to track US citizens without their consent, unlike what it suggested back in June. Forbes found out in its investigation that TikTok spied on two of its journalists (among other people), going as far as tracking their physical location. The outlet believes this was done in an attempt to determine if any TikTok employee was leaking internal information that led to some recent Forbes stories that were critical of TikTok, or tried to explore its close ties with the Chinese state.

In its own internal inquiry following this Forbes revelation, ByteDance concluded that such unauthorized user tracking did indeed take place, but it only confirmed it for the two Forbes reporters. As a result, the Chinese company has fired four of its employees: two based in the US, and two senior executives from China who authorized the surveillance.

ByteDance and TikTok CEOs noted in statements that while the company has moved to Oracle’s servers, some older US user data is still present on its own servers, which it’s in the process of deleting. In the meantime, it has cut access to such sensitive user information.

While ByteDance is addressing the situation and taking action against the accused employees, this episode raises several questions about user privacy on the platform. This comes right before Congress is going to decide whether or not to ban TikTok from devices issued by the US federal government, similar to what many states have already done. There is also a proposed bill that seeks a complete ban on TikTok from all consumer devices in the States, but it will likely face several legal challenges. Only time can tell what all this could mean for your TikTok account and all the short videos that you're hooked to.