They say that they didn't see contacts getting uploaded without permission.

TikTok's privacy policy contains this paragraph:

Your phone and social network contacts, with your permission. If you choose to find other users through your phone contacts, we will access and collect the names and phone numbers and match that information against existing users of the Platform. If you choose to find other users through your social network contacts, we will collect your public profile information as well as names and profiles of your social contacts

https://www.tiktok.com/legal/privacy-policy?lang=en

>They say that they didn't see contacts getting uploaded without permission.

Further down in the report they say it never uploads contacts.

> Neither Douyin nor TikTok (Musically) seemed to upload contact lists, photos, or user files.

I guess that means they didn't try to find other users from their contacts, didn't set a profile picture and didn't post any videos.