ByteDance, TikTok ‘Unjustly Profit’ From ‘Harvesting’ CaptCut Users' Data: Class Action

ByteDance's CapCut videoediting app, launched three years ago in the U.S. and fast approaching 250 million monthly active users, “facilitates” the unlawful collection “of a wide range of private information from users, including their biometric information,” alleged a privacy class action Friday (docket 1:23-cv-04953) against ByteDance and TikTok, for heavily promoting the app, in U.S. District Court for Northern Illinois in Chicago.

The complaint references the data privacy concerns that Montana says sparked it to enact a statewide TikTok ban. The plaintiffs in two consolidated lawsuits there are seeking a preliminary injunction, on First Amendment grounds, to block Montana Attorney General Austin Knudsen (R) from enforcing the measure when it takes effect Jan. 1 (see 2307070002).

CapCut users Evelia Rodriguez, Erikka Wilson and Wilson’s 14-year-old daughter, A.N., filed the complaint, listing nine causes of action. They include violations of the Computer Fraud and Abuse Act, the California Unfair Competition Law and the Illinois Biometric Information Protection Act. The complaint also alleges A.N. was able to open a CapCut account without her mother's consent.

ByteDance and TikTok “unjustly profit from the secret harvesting of a massive array of private and personally identifiable CapCut user data and content,” alleged the complaint. They use the information for targeted advertising, for making improvements to their AI technologies and for bolstering consumer demand for their other goods and services, it said.

Unknown to CapCut users, the app “may be used to conduct clandestine surveillance of users by individuals located in China,” alleged the complaint. “Based on information and belief,” the CapCut app “has clandestinely collected vast quantities of private and personally identifiable user data and content accessible to individuals in China, which could be employed to identify, profile, and track the physical and digital location and activities of United States users now and in the future,” it said.

CapCut allowed ByteDance and TikTok “to expand their data collection activities to new individuals who had not previously downloaded their apps,” including TikTok, said the complaint. CapCut subscribers typically use the app “to edit videos for their personal use,” or for posting on other social media apps, including Instagram, Facebook, YouTube or Linkedin, it said. “Unbeknownst to CapCut users, personal and private information may be collected from users even before they set up an account,” it said.

ByteDance and TikTok “unlawfully accumulated private and personally identifiable data and content from CapCut users” from which they’re “unjustly profiting,” said the complaint. Though CapCut has been exposed to less government “scrutiny” than TikTok, it’s “no less of a threat to the privacy of its users,” it said. “Unless publicly shared through the affirmative consent of a CapCut user, videos created using the CapCut app, which often include close-up views of faces and private acts unintended for public consumption, are inherently private, personal and sensitive,” it said.

ByteDance and TikTok built into the CapCut app “the capacity to collect a range of private and personally identifiable information regarding users,” including their Mac addresses, their SSID numbers and their SIM serial numbers, said the complaint. They also built into CapCut the capacity to collect “fine-grained location information and location updates,” plus the capability to access files on user devices and store them,” it said.

Collection of physical and digital location tracking data “is highly invasive of CapCut users’ privacy rights,” said the complaint. “Over time, location data reveals private living patterns of CapCut users, including where they work, where they reside, where they go to school, and when they are at each of these locations,” it said. Location data, either standing alone, or combined with other information, “exposes deeply private and personal information about CapCut users’ health, religion, politics and intimate relationships,” it said.

CapCut’s “functionality and code,” together with the close “political ties” of ByteDance and TikTok to the Beijing government, demonstrate “the broad scope and implications” of the defendants’ privacy violations, said the complaint. ByteDance and TikTok use the private and personally identifiable data and content “to analyze CapCut users’ income, consumption habits, and preferences,” it said. “Such information provides guidance as to what methods of advertising will be most effective on particular CapCut users,” it said. The companies “unjustly have earned and continue to earn substantial profits and revenues from such targeted advertising” and from generating increased demand for use of their other products, it said.

The class action seeks an order for injunctive and declaratory relief enjoining ByteDance and TikTok “from transmitting CapCut user data and content to China or to other locations or facilities where such CapCut user data and content is accessible.” It also seeks to bar the companies from capturing CapCut users’ “private draft videos” and biometric identifiers and information without their “advance notice” and consent, it said. The complaint also seeks compensatory, statutory and punitive damages for the allegedly unlawful conduct. ByteDance and TikTok didn’t comment.