Image: TikTok

TikTok is on the up-and-up. First launched just three years ago, the Chinese-owned video-centric social media platform is making headlines after luring former Disney head of streaming Kevin Mayer to join as its chief executive officer, and continuing to boast burgeoning growth; it added more than 12 million unique U.S. visitors in March, alone, helping it to reach 52.2 million domestic users and some 800 million active users worldwide, according to recent Comscore data. And of those U.S. users, the average TikTok fan spent a whopping 858 minutes (14 hours, 18 minutes) on the app in March. 

In addition to boasting mind-boggling numbers both in terms of users and activity duration, TikTok is readily racking up figures of another kind: the number of lawsuits that it is currently facing, most of which accuse the Los Angeles-headquartered company of scanning users’ faces (in order to enable them to access and use various in-app “filters and effects”), but failing to notify those users that it collects and stores their biometric data, namely, their faceprints.

As a result of such data collection, TikTok and its owner ByteDance, which acquired the app for $1 billion in December 2017, is running afoul of Illinois Biometric Information Privacy Act, according to the lawsuit that Molly Janik, the legal guardian for a 17-year-old TikTok user, who is identified as L.B., filed in an Illinois federal court this month. The Illinois Biometric Information Privacy Act prohibits private entities (i.e., non-governmental entities) from capturing or collecting biometric information, such as fingerprints, retina and iris patterns, voice waves, and DNA, from an individual unless it first creates a publicly-available written policy governing how it will collect, maintain, and ultimately destroy such identifiers, and also obtains each individual’s written consent.

TikTok not only fails to alert users of its practice of collecting and storing such data, and to receive their written authorization, Janik asserts that it also shares the biometric information with third parties without users’ consent.

At least two other, similiar lawsuits have also been filed in Illinois, and one has been filed in the U.S. District Court for the Northern District of California. Still yet, the Center for Digital Democracy and Campaign for a Commercial Free Childhood filed a complaint with the Federal Trade Commission (“FTC”) this month, asserting that TikTok is not only running afoul of the Children’s Online Privacy Protection Act (“COPPA”), it is violating the terms of the $5.7 million settlement agreement it entered into with the government agency in February 2019. In connection with that investigation and settlement, which resulted in the “the FTC’s largest ever civil penalty under COPPA,” the FTC accused TikTok of breaking the law by collecting personal information from kids without parental consent. 

(COPPA imposes certain requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age).

In its complaint, the Center for Digital Democracy claims that it is “especially important that the FTC promptly and thoroughly investigate TikTok’s practices and take effective enforcement action,” as TikTok “continues to be one of the most popular apps in the world, and it is widely used by children and teens in the United States.”

Not only do the lawsuits at hand follow from the record-making FTC settlement, they come after TikTok was hit with a children’s privacy lawsuit late last year by California and Illinois residents, who alleged that TikTok’s owner tracked, collected and disclosed the personally identifiable information and/or viewing data of children under the age of 13 without parental consent, as required by COPPA. Facing allegations that “failed to deploy appropriate safeguards” to protect its young user base and their “personally identifiable information” and instead, “operated their app in a reckless and unlawful manner for commercial gain,” TikTok swiftly settled the suit and paid out $1.1 million. 

At the time of the settlement, a representative for TikTok said, “TikTok is firmly committed to safeguarding the data of its users, especially our younger users. Although we disagree with much of what is alleged in the complaint, we have been working with the parties involved and are pleased to have come to a resolution of the issues.” A spokesman for the company echoed this notion in relation to the more recently-initiated litigation, saying, “We take privacy seriously and are committed to helping ensure that TikTok continues to be a safe and entertaining community for our users.”

*The case is L.B., a minor, by and through his or her legal guardian, MOLLY JANIK, individually, and on behalf of all others similarly situated, v. TikTok, Inc., and ByteDance, Inc., L.B., a minor, by and through his or her legal guardian, MOLLY JANIK, individually, and on behalf of all others similarly situated, v. TikTok, Inc., and ByteDance, Inc., 1:20-cv-02889 (N.D. Ill).