Real in the sense that there is some sort of evidence of actions that have crossed the thresholds of legality as per American laws. The data security/privacy community, I think generally don't see TikTok for example as any much more egregious an offender than Instagram for example.