In May, as millions of quarantined and socially deprived Americans turned bored eyes to their smartphones, legal storms began to brew for TikTok, an app for sharing short-form mobile videos. The legal actions center on the company’s use of biometric data and other information collected from the network’s 800 million active monthly users.
Violation of Illinois’ Users’ Privacy Rights
Parents and legal guardians representing Illinois minors filed a lawsuit in the U.S. District Court for the Northern District of California. According to Illinois’ Biometric Information Privacy Act (BIPA), biometric information, like that gathered from scans (iris, fingerprint, and facial) is protected. This law specifies that a company can collect such user data only with the consumers’ consent, and it further stipulates that consumers must be informed about how the company will use the data they gather and how long they will keep it.
In another May lawsuit, Molly Janik, the guardian of another minor Illinois-based TikTok user, filed a class-action lawsuit against the company and its parent, ByteDance, for similar reasons. The case was filed in the United States District Court for the Northern District of Illinois Eastern Division.
Of particular concern to plaintiffs in the Janik biometric lawsuit is the fact that, while a bank account, phone number, or social security number can be changed when compromised, there is no recourse for an individual’s biometric data. It puts the user “at heightened risk for identity theft,” the claim states.
Illinois Biometric Privacy Acts and Facebook
This will not be the Illinois law’s first time at the social media rodeo. Facebook reached an agreement to pay $550 million to Illinois’ users of the social media network. The settlement followed a drawn-out legal battle wherein claimants argued that the platform’s facial tagging feature crossed lines in Illinois’ biometric privacy law.
The Possibility for Other States Following Suit
California, Texas, Washington, Arkansas, and New York all have their own version of BIPA, either via new statutes or expansion of existing legislation. Illinois, however, is the only state wherein the biometric law provides for a private right of action. Other states either reserve such actions for state attorneys general or they do not specifically address the issue of whether private parties can bring a lawsuit.
Children’s Online Privacy Act Violations
Also, in May, Center for Digital Democracy and Campaign for a Commercial Free Childhood led a group of advocacy organizations in filing a complaint against social media app TikTok. The complaint alleges that the app, which touts a deep user base of teens and kids, violates the Children’s Online Privacy Protection Act. The groups are also asking the Federal Trade Commission (FTC) to investigate the app, which is owned by Chinese parent company ByteDance, for its violation of last year’s consent decree, following TikTok agreement to pay a $5.7 million fine for overstepping child privacy rules.
In Case No. 2:19-cv-1439, plaintiffs claimed that the defendant, musical.ly (the former iteration of TikTok), knowingly collected information from children under the age of 13. The claim further alleged that the company failed to disclose this collection, how it would use the information, and various disclosure practices, thereby violating the COPPA Rule.
Furthermore, parents of child subscribers were not notified, nor was their consent sought, before collecting such information from under-13-aged users. Plaintiffs also claimed that the company failed to delete such user data when parents requested this action be taken, and the information was stored longer than what was deemed necessary to accomplish the purported function for which the app collected the data.
A Growing Concern
The COVID-19 pandemic has kicked Tiktok’s growth into hyperdrive. With Americans hunkering down in forced orders to shelter at home, the already immensely popular app saw 199 million downloads—a 51-percent increase since the same time last year, according to Sensor Tower.
The legal disputes currently playing out will no doubt seep out into greater populations as awareness of the data misuse spreads.