California Class-Action Lawsuit Accuses TikTok of Illegally Harvesting Data and Sending It to China

The social-media platform TikTok is amassing vast swaths of data on its users without their consent and sending it to servers in China, according to a class-action lawsuit filed the day before Thanksgiving in California federal court.

The suit, filed by Misty Hong, a college student from Palo Alto, alleges TikTok and its Chinese parent company, ByteDance, neglected their duty to handle user data with care and knowingly violated a slew of statutes governing data gathering and the right to privacy.

Hong is seeking punitive damages and injunctions on the company that would, among other things, bar it from transferring user data from the U.S. to China and from retrieving any biometric data like facial scans from videos users have chosen not to upload.

“At the same time that Defendants utilized the Musical.ly and TikTok apps to covertly tap into a massive array of private and personally-identifiable information, they went to great lengths to hide their tracks,” Hong alleges. 

TikTok has been downloaded more than 750 million times in the past year, becoming the first global social-media app to emerge from China. Because Chinese law grants authorities and the government greater search-and-seizure power than in the United States and many other countries, questions about control over TikTok’s data have clouded the app’s rise.

According to the suit, ByteDance used Musical.ly—which was acquired in November 2017 for $800 million to $1 billion and later christened TikTok—to secretly gather users’ locations, ages, private messages, phone numbers, contacts, genders, browsing histories, cell-phone serial numbers, and IP addresses. That data was allegedly then sent to Chinese servers. 

The suit contends that previous versions of TikTok’s privacy policies explicitly stated that the app might send user data to China but that even after the policy changed, TikTok still delivered such information to servers in China.

TikTok’s leaders have repeatedly offered assurances, most recently in an in-depth profile in The New York Times, that the app stores American users’ data in the U.S., specifically in Virginia (with a backup in Singapore), and that the Chinese government has no access to the company’s user information. 

Hong’s suit takes issue with the process of posting a video on TikTok, alleging that in between recording a video and posting it, an intermediary stage saves the video and transfers the video to ByteDance’s servers without the user’s knowledge. Hong alleges that after she downloaded TikTok in March or April 2019, the app made an account for her using her phone number—despite the fact that she never signed up—that it created a dossier on her by analyzing several videos she never posted. The information on her, the suit contends, included a scan of her face. 

The app, she alleges, transferred all of her information to servers owned and operated by companies that cooperate with the Chinese government. She’s filed the lawsuit on behalf of all U.S. residents who have downloaded TikTok, roughly 110 million people.

The Committee on Foreign Investment in the United States (CFIUS) is conducting a national security review of ByteDance’s acquisition of Musical.ly. Sen. Chuck Schumer (D-NY) and Sen. Tom Cotton (R-AR) sent a letter to Acting Director of National Intelligence Joseph Maguire warning of the risks TikTok posed to national security if users were to share data that wound up in the hands of the Chinese government.

Hong, her lawyers, and ByteDance did not immediately return requests for comment.