ByteDance Shelved IPO Intentions After Chinese Regulators Warned About Data Security

But the company’s founder, Zhang Yiming, decided it would be wiser to put the plans on ice in late March, after meetings with cyberspace and securities regulators in which they asked the company to focus on addressing data-security risks and other issues, the people familiar with the matter said.

The company had other reasons for delaying the listing. It didn’t have a chief financial officer at the time, a person close to the company said.

ByteDance’s cautious approach contrasts with that of Chinese ride-hailing giant

Didi Global Inc.,

which runs the country’s ubiquitous car-hailing app. Didi pressed ahead with listing plans in the U.S. despite suggestions from the cyberspace administration not to amid concerns that some of its data could fall into foreign hands, The Wall Street Journal reported.

Didi raised $4.4 billion in late June but is now the subject of a cybersecurity investigation and has since had its main app and 25 others it operates ordered removed from Chinese app stores.

The Cyberspace Administration of China, the nation’s internet regulator, and the China Securities Regulatory Commission didn’t respond to requests for comment.

Chinese authorities have been stiffening enforcement over the country’s technology companies since November, with a sweeping antimonopoly crackdown, and new rules to govern data collection and cybersecurity practices. Several other companies, including

Alibaba Group Holding Ltd.

and online delivery company

Meituan,

have been caught up in the dragnet.

One concern in Beijing has been that data collected by China’s tech companies could be compromised as a result of greater disclosure associated with a U.S. listing. The authorities have also been cracking down on improper collection and use of data to protect consumers’ interests.

On Tuesday, China said it would tighten oversight of offshore listings. The securities regulator is drafting rules that could require offshore registered companies to seek regulatory approval before selling shares in foreign markets, with the cyberspace administration leading interagency scrutiny into IPO candidates to make sure their plans don’t risk national security.

On Saturday, the agency proposed amending its own draft cybersecurity-review rules to include a requirement that internet companies with more than one million users undergo a cybersecurity review if they are looking to list abroad.

Previously, Chinese companies didn’t typically need the cyberspace administration’s permission to list overseas. But toward the end of 2020, as U.S.-China tensions deepened, the administration began requiring some technology companies to inform it about possible overseas listings and seek informal approval, people familiar with the agency said.

In ByteDance’s case, Chinese regulators never called outright for a delay in possible share offerings, people familiar with the matter said.

But regulators were concerned about the data-security compliance of ByteDance’s apps in China, the person close to the company said. During the meetings, the regulators were eager to understand how ByteDance collected, stored and managed data, according to people familiar with communication between the two parties.

ByteDance runs apps used by hundreds of millions of people in China, including short-video app Douyin and Jinri Toutiao, or Today’s Headlines. Personal information collected by Douyin can include mobile-phone numbers, birthdays, real names and ID numbers.

Given Beijing’s concerns, ByteDance’s Mr. Zhang assessed that the time wasn’t right for an IPO because of the political and regulatory environment, the people familiar with the matter said.

On April 23, Bytedance said in a statement on its social media account, “After serious research, we think the company does not fulfill the necessary requirements to go public, and currently have no such plan.” The company didn’t provide further explanation for its decision at the time.

Bytedance, whose shareholders include Sequoia Capital and

KKR

& Co., is one of the world’s most valuable startups. Unlike Didi, which had chalked up losses for years, Bytedance’s financials meant it didn’t have to hurry to list, said people familiar with the company.

The company told employees in June that its revenue last year more than doubled to $34.3 billion as advertising on its platforms grew, while gross profit rose to $19 billion.

ByteDance has had previous run-ins with regulators. In early 2018, Beijing shut down a joke app, Neihan Duanzi, run by the company on the grounds that it contained vulgar content. Mr. Zhang responded with a lengthy social-media post apologizing and promising to add more censors.

This year, ByteDance was publicly called out by authorities for a variety of infractions including excessive collection of users’ personal information and unsuitable content.

Bytedance was among 13 internet companies summoned by financial regulators and told to adhere to much tighter regulation of their data and lending practices in April. It was also among nearly three dozen Chinese tech companies that made public pledges to comply with antimonopoly laws that month.

In May, the company’s 38-year-old founder, Mr. Zhang, resigned as chief executive, joining a group of tech leaders who have stepped down as the government increases pressure on the sector.

ByteDance has also faced pressure from U.S. regulators. Last year, the Trump administration raised concerns that data its TikTok app collects from users could be shared with the Chinese government. TikTok denied that could happen.

The Biden administration revoked in June a Trump-era attempt to ban TikTok in the U.S. But TikTok still faces a broad review of apps controlled by foreign adversaries to determine whether they pose a security threat to the U.S.

—Raffaele Huang, Keith Zhai, Yang Jie and Jing Yang contributed to this article.

Write to Xie Yu at Yu.Xie@wsj.com and Liza Lin at Liza.Lin@wsj.com