UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF ILLINOIS

EASTERN DIVISION

IN RE TIKTOK, INC., 

CONSUMER PRIVACY 

LITIGATION

This Document Relates to All Cases

)

)

)

)

)

)

)

)

)

)

)

MDL No. 2948

Master Docket No. 20-cv-4699

Hon. John Z. Lee

Magistrate Judge Sunil R. Harjani

JURY TRIAL DEMANDED

CONSOLIDATED AMENDED CLASS ACTION COMPLAINT

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 1 of 120 PageID #:1873
1

Plaintiffs, individually and on behalf of all other persons similarly situated, upon personal 

knowledge of the facts pertaining to them and on information and belief based upon the 

investigation of counsel as to all other matters, by and through undersigned counsel, bring this 

class action complaint against TikTok, Inc. f/k/a Musical.ly, Inc. (“TikTok, Inc.”); ByteDance, 

Inc. (“ByteDance”); Musical.ly n/k/a TikTok, Ltd. (“Musical.ly”) and Beijing ByteDance 

Technology Co. Ltd. (“Beijing ByteDance”) (collectively, “Defendants”).

I. INTRODUCTION.

1. In August 2018, Defendants launched a video-creation and sharing social media 

platform, TikTok (formerly Musical.ly) (the “TikTok app”), in the United States. In less than a 

year, the TikTok app skyrocketed in popularity, landing it among the “top 5” most downloaded 

free iPhone/Android apps. With an eye-popping 800+ million active users worldwide1 and 2019 

revenues estimated at over $17 billion dollars,

2 the TikTok app is one of the most popular 

entertainment apps for mobile devices in the United States and the world.

2. The TikTok app has acquired one of the largest installed user bases in the country 

on the strength of its popular 60-second videos of fun activities like dancing, lip-syncing, and 

stunts. 

3. TikTok’s owner, ByteDance, was founded in 2012 and remains based in Beijing, 

China. ByteDance is well known as a hit app factory that has spent the last decade using 

technologies such as artificial intelligence and facial recognition. This action seeks to ensure that 

the privacy of TikTok users is adequately protected.

1 https://influencermarketinghub.com/tiktok-stats/ (last accessed June 24, 2020).

2 https://www.bloomberg.com/news/articles/2020-05-27/bytedance-is-said-to-hit-3-billion-inprofit-as-revenue-doubles (last accessed Sept. 24, 2020).

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 2 of 120 PageID #:1874
2

4. Plaintiffs and class members have particular concerns here given TikTok’s reported 

connections to the Chinese government, which have very recently come under close public 

scrutiny. Several U.S. Senators have formally requested that the Intelligence Community conduct 

an assessment of the national security risks posed by TikTok. Recognizing the serious ongoing 

threat posed by TikTok, prominent U.S. Senators wrote to the FTC on May 29, 2020 that, “[f]aced 

with compelling evidence that this wildly popular social media platform is blatantly flouting 

binding U.S. privacy rules, the FTC should move swiftly to launch an investigation and forcefully 

hold violators accountable for their conduct.”

5. Because of data privacy concerns, some U.S. military branches have even banned 

the use of the app on government-issued phones. Republican Senator Josh Hawley called for a 

total ban on the use of the app across the United States.3 Reddit CEO and co-founder Steve 

Huffman called TikTok “fundamentally parasitic” due to privacy concerns.4

6. In fact, the Department of Defense recently expressed concern over TikTok’s 

“popularity with Western Users, and its ability to convey location, image and biometric data to its 

Chinese parent company, which is legally unable to refuse to share data to the Chinese 

Government,” going so far as to issue an internal memo to encourage its employees to avoid 

installing the app.5

7. ByteDance relies on artificial intelligence (“AI”) technologies for its different 

content platforms and states that “these new technologies can be found across every segment of 

3 https://www.forbes.com/sites/tjmccue/2020/02/13/is-tiktok-raiding-your-privacy-in-2020-hereis-how-to-stop-it/#1e34f6b569c8.

4 https://www.theverge.com/2020/2/27/21155845/reddit-ceo-steve-huffman-tiktok-privacyconcerns-spyware-fingerprinting-tracking-users.

5 https://www.inc.com/jason-aten/the-department-of-defense-is-warning-people-not-to-usetiktok-over-national-security-concerns.html

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 3 of 120 PageID #:1875
3

our product portfolio.”6 The company uses AI technologies in its services: e.g., recommender 

systems, voice recognition, computer vision, natural language process, and more.7 According to a 

ByteDance executive, “ByteDance has the largest number of users in the world whose videos need 

to be analyzed and processed and uploaded[.]”8

8. “As a user interacts with the content by taps, swipes, time spent with each article, 

comments and more, large-scale machine learning and deep learning algorithms continue to learn 

about a user’s preferences[.]”9

9. Defendants have used automated software, proprietary algorithms, AI, facial 

recognition, and other technologies to commercially profit from Plaintiffs’ and Class Members’ 

identities, unique identifying information, biometric data and information, images, video and 

digital recordings, audio recordings, clipboard data, geolocation, names, e-mail addresses, 

passcodes, social media accounts, messaging services, telephone numbers, and other private, nonpublic, or confidential data and information, or meaningful combinations thereof, as more fully set 

forth herein.

10. Further, Defendants, through the TikTok app, collected, captured, obtained, stored 

and, upon information and belief, disclosed and otherwise disseminated Illinois resident TikTok 

users’ biometric information in violation of the Illinois’ Biometric Information Privacy Act 

(“BIPA”), 740 ILCS §14/1, et seq. Public policy in Illinois provides that given the risks of 

unwanted data collection, Illinois citizens need the power to make decisions about the fate of their 

6 https://ailab.bytedance.com 

7 https://medium.com/syncedreview/intel-and-bytedance-partner-on-ai-lab-b678036cbda4.

8 https://technode.com/2018/04/24/bytedance-jinri-toutiao-ai-chips.

9 https://www.forbes.com/sites/bernardmarr/2018/12/05/ai-in-china-how-buzzfeed-rivalbytedance-uses-machine-learning-to-revolutionize-the-news/#524f960e40db.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 4 of 120 PageID #:1876
4

unique biometric identifiers and information. Defendants’ actions robbed them of that power.

11. What is more, unknown to its users, included in the TikTok app is surveillance 

software developed in China. The TikTok app has clandestinely vacuumed up and transferred to 

servers in China (and to other servers accessible from within China) vast quantities of private and 

personally identifiable user data and content that could be employed to identify, profile, and track 

the physical and digital location and activities of United States users now and in the future.

12. The TikTok app has surreptitiously taken TikTok users’ private draft videos they 

never intended for publication – without notice or consent.

13. Defendants and their sophisticated engineering teams also covertly collect and use

TikTok users’ highly sensitive and immutable biometric identifiers and information.

14. Defendants also covertly transmit personally identifiable information about each 

TikTok user’s video viewing history to third parties without notice or consent, in violation of the 

Video Privacy Protection Act (“VPPA”).

15. In short, the TikTok app’s lighthearted fun comes at a heavy cost. Meanwhile, 

Defendants unjustly profit from the secret harvesting of this massive array of private and 

personally identifiable TikTok user data and content by using it for targeted advertising, 

improvements to Defendants’ artificial intelligence technologies, the filing of patent applications, 

and the development of consumer demand for, and use of, Defendants’ other products.

16. TikTok accesses its users’ data for various purposes, including tracking users by 

age, gender, location, operating system, and interest in order to attract marketing and ad sales. By 

collecting and filtering this user data, TikTok offers a sophisticated targeted ad and marketing 

platform that allows its ad clientele to hone into their target demographics with shocking 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 5 of 120 PageID #:1877
5

precision.10

17. Users are further at risk because Defendants’ conduct exposes TikTok user data to 

access by the Chinese government to assist that government in meeting two of its crucial and 

intertwined state objectives: (a) world dominance in artificial intelligence; and (b) population 

surveillance and control.

18. Defendants’ conduct violates statutory, constitutional, and common law privacy, 

data, biometrics and consumer protections, and it should be stopped.

II. THE PARTIES.

A. The Plaintiffs.

The California Plaintiffs

19. Plaintiff Misty Hong is, and at all relevant times was, an individual and resident 

of Palo Alto, California. In or about March or April 2019, Ms. Hong downloaded the TikTok app 

onto her mobile device. At the time Ms. Hong downloaded the TikTok app, she did not read any 

privacy policy or terms of use, nor did she see discernible hyperlinks to or warnings about these 

items. In fact, she never clicked the sign-up button and never knowingly created an account with 

Defendants. However, months later, she discovered for the first time that Defendant TikTok, Inc. 

had created an account for her, without her knowledge or consent, and provided her with a user 

name (the word “user” followed by a combination of numbers followed by “@” followed by the 

word “user” followed by a combination of letters and numbers) and assigned her phone number as 

the account password.

20. Shortly after completing the download of the TikTok app onto her mobile device, 

Ms. Hong made approximately five or six videos using the TikTok app on her mobile device. 

10 https://www.wired.co.uk/article/tiktok-filter-bubbles.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 6 of 120 PageID #:1878
6

Images of her face were captured in some or all of these videos. Ms. Hong experienced difficulty 

in timing the background music to lip-syncing and dancing. Consequently, after shooting each 

video, Ms. Hong (i) sometimes pressed the “next” button and (ii) sometimes pressed the “x” button 

and then the “reshoot” button. Ms. Hong neither saved nor posted any of these videos. But, as a 

result of sometimes pressing the “next” button, Defendants took some of these private videos

without Ms. Hong’s knowledge or consent. Images of Ms. Hong’s face also have been captured in 

Musical.ly and/or TikTok videos recorded and posted by others.

21. Plaintiff A.S., a minor, is, and at all relevant times was, an individual and resident 

of Stevenson Ranch, California. A.S. brings this suit by and through her mother and legal guardian, 

Laurel Slothower, who is, and at all relevant times was, an individual and resident of Stevenson 

Ranch, California.

22. Plaintiff A.S., a minor who is currently 15 years old, first downloaded the 

Musical.ly app to her mobile device and created a user account in 2016 when she was under age 

13. She subsequently downloaded the Musical.ly app in 2017 to a new mobile device that was 

hers. In 2019, A.S. downloaded the TikTok app to another new mobile device that was hers. A.S. 

and her legal guardian have never seen or read any of Defendants’ privacy policies or terms of use.

23. Beginning in 2016, A.S. created numerous videos using the Musical.ly app and the 

TikTok app. Many are private videos containing images of her face, while many others are videos 

containing her voice and images of her face that she intentionally uploaded and posted. A.S. used 

the augmented reality features and facial filters on her face in both private videos and in videos 

that she intentionally uploaded and posted.

24. Plaintiff A.R., a minor, is, and at all relevant times was, an individual and resident 

of Pasadena, California. A.R. brings this suit by and through her mother and legal guardian, Gilda 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 7 of 120 PageID #:1879
7

Avila, who is, and at all relevant times was, an individual and resident of Pasadena, California.

25. A.R. downloaded the Musical.ly app to her mobile device and created a user 

account in or about 2017 when she was approximately 12 years old. Subsequently, in 2019, while 

still a minor, A.R. downloaded the TikTok app to a new mobile device that was hers. A.R. and her 

legal guardian have never seen or read any of Defendants’ privacy policies or terms of use.

26. A.R. created numerous videos using the Musical.ly app and the TikTok app. Many 

are private videos containing images of her face, while many others are videos containing images 

of her face that she intentionally uploaded and posted. A.R. used the augmented reality features 

and facial filters on her face in her private videos. A.R.’s voice and images of A.R.’s face have 

been captured in private videos recorded by others, as well as in videos that were recorded, 

uploaded and posted by others.

27. Plaintiff G.R., a minor, is, and at all relevant times was, an individual and resident 

of Los Angeles, California. G.R. brings this suit by and through her mother and legal guardian, 

Mayra De La Cruz, who is, and at all relevant times was, an individual and resident of Los Angeles, 

California.

28. Plaintiff G.R. downloaded the TikTok app to her own mobile devices and created 

her user account on or about October 5, 2017, when she was six years old. G.R. and her legal 

guardian have never seen or read any of Defendants’ privacy policies or terms of use.

29. Plaintiff G.R. created approximately 3,000 videos using the TikTok app. Many are 

private videos containing images of her face, while many others are videos which she intentionally 

uploaded and posted and which also contain images of her face. G.R. used the augmented reality 

features and facial filters on her face in videos she intentionally uploaded and posted. 

30. Plaintiff Aparna Iyer is a citizen and resident of the State of California. Plaintiff 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 8 of 120 PageID #:1880
8

created her TikTok account approximately fall 2019.

31. Plaintiff Iyer has uploaded and posted at least one video using TikTok, which 

includes images of her face and a friend’s face, since creating her account. Plaintiff Iyer has also 

appeared in friends’ videos, which have included the use of a combination of TikTok features such 

as stickers, filters, and the tracker lens available in the App when creating, saving, and posting 

videos on the App. Plaintiff Iyer has also viewed and “liked” other videos, commented on videos, 

and sent messages to other viewers concerning their videos.

32. Plaintiff Iyer does not recall seeing the Terms of Service or Privacy Policy upon 

registering for an account with the App. 

The Illinois Plaintiffs

33. Plaintiff Meghan Smith is, and at all relevant times was, an individual and resident 

of Champagne, Illinois.

34. Plaintiff Meghan Smith downloaded the TikTok app to her mobile device and 

created a user account in 2018. Ms. Smith has never read and does not recall seeing any of 

Defendants’ privacy policies or terms of use.

35. Ms. Smith created numerous videos using the TikTok app. Many are private videos

containing her voice and images of her face, while many others are videos containing her voice 

and images of her face that she intentionally uploaded and posted. Ms. Smith used the augmented 

reality features and facial filters on her face in both private videos and in videos that she 

intentionally uploaded and posted.

36. Plaintiffs C.W., a minor, and I.W., a minor, are, and at all relevant times were, 

individuals and residents of Chicago, Illinois. C.W. and I.W. bring this suit by and through their 

mother and legal guardian, Mikhaila Woodall, who is, and at all relevant times was, an individual 

and resident of Chicago, Illinois.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 9 of 120 PageID #:1881
9

37. Plaintiff C.W., a minor who is currently 11 years old, and Plaintiff I.W., a minor 

who is currently 8 years old, are siblings who each downloaded the TikTok app to their own mobile 

devices and created their respective user accounts in or about March 2019. C.W., I.W. and their 

legal guardian have never seen or read any of Defendants’ privacy policies or terms of use.

38. C.W. and I.W. each created numerous videos using the TikTok app. Each has 

videos containing images of their respective faces that they intentionally uploaded and posted. 

C.W. and I.W. used the augmented reality features and facial filters on their respective faces in 

videos they intentionally uploaded and posted.

39. Plaintiff P.S., a minor, is, and at all relevant times was, an individual and resident 

of Illinois. P.S. brings this suit by and through her legal guardian, Cherise Slate, who is, and at all 

relevant times was, an individual and resident of Carpentersville, Illinois. 

40. P.S. downloaded the TikTok app to her mobile device and created a user account 

in or about 2019 when she was approximately 12 years old. P.S. and her legal guardian have never 

seen or read any of Defendants’ privacy policies or terms of use.

41. P.S. created numerous videos using the TikTok app. Many are private videos

containing images of her face, while many others are videos containing images of her face that she 

intentionally uploaded and posted. P.S. used the augmented reality features and facial filters on 

her face. P.S.’s voice and images of P.S.’s face have been captured in private videos recorded by 

others, as well as in videos that were recorded, uploaded and posted by others.

42. Plaintiff M. T. W., a minor, is, and at all relevant times was, an individual and 

resident of Illinois. M.T.W. brings this suit by and through her legal guardian, Brenda Washington, 

who is, and at all relevant times was, an individual and resident of Country Club Hills, Illinois.

43. M.T.W. first downloaded the Musical.ly app followed by the TikTok app to her 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 10 of 120 PageID #:1882
10

mobile device and created a user account in or about 2018 when she was approximately 15 years 

old. M.T.W. and her legal guardian have never seen or read any of Defendants’ privacy policies 

or terms of use.

44. M.T.W. created numerous videos using the Musical.ly app and the TikTok app. 

Many are private videos containing images of her face, while many others are videos containing 

images of her face that she intentionally uploaded and posted. M.T.W. used the augmented reality 

features and facial filters on her face. M.T.W.’s voice and images of M.T.W.’s face have been 

captured in private videos recorded by others, as well as in videos that were recorded, uploaded 

and posted by others.

45. Plaintiffs N.T., a minor, and L.T., a minor, are, and at all relevant times were, 

individuals and residents of Yorkville, IL. N.T. and L.T. bring this suit by and through their mother 

and legal guardian, Darcy Tellone, who is, and at all relevant times was, an individual and resident 

of Yorkville, IL.

46. Plaintiffs N.T. and L.T. are siblings who each downloaded the TikTok app to their 

own mobile devices and created their respective user accounts in or about 2014. Neither N.T., L.T., 

or their legal guardian have ever seen or read any of Defendants’ privacy policies or terms of use.

47. N.T. and L.T. each created numerous videos using the TikTok app. Each has videos 

containing images of their respective faces that they intentionally uploaded and posted. N.T. and 

L.T. used the augmented reality features and facial filters on their respective faces in videos they 

intentionally uploaded and posted. Images of N.T.’s and L.T.’s faces have been captured in videos 

that were recorded, uploaded, and posted by others.

48. Plaintiffs S.P., J.P., K.P., and G.P., minors, are, and at all relevant times were, 

individuals and residents of Yorkville, Illinois. S.P., J.P., K.P., and G.P. bring this suit by and 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 11 of 120 PageID #:1883
11

through their mother and legal guardian, Katie Pattermann, who is, and at all relevant times was, 

an individual and resident of Yorkville, IL.

49. Plaintiffs S.P., J.P., K.P., and G.P. are siblings who each downloaded the TikTok 

app to their mobile devices and created their respective user accounts in or about 2014 (for J.P.)

and in or about 2020 (for S.P., K.P., and G.P.). S.P., J.P., K.P., and G.P. and their legal guardian 

have never seen or read any of Defendants’ privacy policies or terms of use.

50. S.P., J.P., K.P., and G.P. each created numerous videos using the TikTok app. Each 

has videos containing images of their respective faces that they intentionally uploaded and posted. 

S.P., J.P., K.P., and G.P. used the augmented reality features and facial filters on their respective 

faces in videos they intentionally uploaded and posted. Images of S.P., J.P., K.P., and G.P.’s faces 

have been captured in videos that were recorded, uploaded, and posted by others.

51. Plaintiff L.M., a minor, is, and at all relevant times was, an individual and resident 

of Swansea, Illinois. L.M. brings this suit by and through L.M.’s mother and legal guardian, 

Stephanie Mohler, who is, and at all relevant times was, an individual and resident of Swansea, 

Illinois.

52. Plaintiff L.M., who is currently 12 years old, first downloaded the Musical.ly app 

to Plaintiff L.M.’s own mobile device and created a user account in or about 2017. Subsequently, 

Plaintiff L.M. downloaded the TikTok app and created a user account in or about 2018. L.M.’s 

legal guardian has never seen or read any of Defendants’ privacy policies or terms of use.

53. L.M. created numerous videos using the TikTok app. Many are private videos

containing images of L.M.’s face, while many others are videos containing images of L.M.’s face 

that L.M. intentionally uploaded and posted. L.M. used the facial filters on L.M.’s face in both 

private videos and in videos that L.M. intentionally uploaded and posted. L.M.’s voice and/or 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 12 of 120 PageID #:1884
12

images of L.M.’s face have been captured in videos recorded by L.M.’s sibling, as well as in videos 

that were recorded, uploaded, and posted by L.M.’s sibling.

54. Plaintiff A.J. a minor, is and at all relevant times was, an individual and resident 

of Palatine, Illinois. A.J. brings this suit by and through her father and legal guardian, Aaron 

Johnson, who is, and at all relevant times was, an individual and resident of Palatine, Illinois.

55. Plaintiff A.J., a minor who is currently 14 years old, downloaded the Musical.ly 

app to her iPad and created her Musical.ly user account, with the help of her mother, in or about 

January 2016. A.J. and legal guardian have never seen or read any of Defendants’ privacy policies 

or terms of use. Plaintiff A.J. also downloaded the Musical.ly app or the TikTok app, by herself 

and without any adult supervision, to (a) her iPhone 5S in or about December 2017; (b) her iPhone 

6S Plus in or about August 2018; and (c) her iPhone 8 in or about December 2019. A.J. has never 

seen or read any of Defendants’ privacy policies or terms of use.

56. A.J. created dozens of videos using the TikTok app. A.J. has videos containing 

images of her face that she intentionally uploaded and posted. A.J. used the augmented reality 

features and facial filters on their respective faces in videos she intentionally uploaded and posted. 

Images of A.J.’s face have been captured in videos that were recorded, uploaded, and posted by 

others.

57. Plaintiff E.R., a minor, is, and at all relevant times was, an individual and resident 

of Streamwood, Illinois. E.R. brings this suit by and through her mother and legal guardian, L.H., 

who is, and at all relevant times was, an individual and resident of Streamwood, Illinois.

58. E.R., a minor who is currently 16 years old, downloaded the Musical.ly app to her 

mobile device and created a user account in or about 2014 when she was approximately 10 years 

old. E.R. and her legal guardian have never seen or read any of Defendants’ privacy policies or 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 13 of 120 PageID #:1885
13

terms of use.

59. E.R. created numerous videos using the Musical.ly/TikTok app. Many are private 

videos containing images of her face, while many others are videos containing images of her face 

that she intentionally uploaded and posted. E.R. used the augmented reality features and facial 

filters on her face in both private videos and in videos that she intentionally uploaded and posted.

60. Plaintiffs R.S., a minor, and J.S., a minor, are, and at all relevant times were, 

individuals and residents Highland Park, Illinois. R.S. and J.S. bring this suit by and through their 

mother and legal guardian, who is, and at all relevant times was, an individual and resident of 

Highland Park, Illinois.

61. Plaintiffs R.S. and J.S. are siblings who each downloaded the TikTok app to their 

own mobile devices (an iPhone 7 for R.S. and iPad for J.S.), and created their respective user 

accounts in or about March 2020. R.S., J.S., and their legal guardian had not seen nor read any of 

Defendants’ privacy policies or terms of use prior to establishing their accounts. 

62. R.S. and J.S. each created numerous videos using the TikTok app. Each has videos 

containing images of their respective faces that they intentionally uploaded and posted. R.S. and 

J.S. used the augmented reality features and facial filters on their respective faces in videos they 

intentionally uploaded and posted. Images of R.S. and J.S.’s face have been captured in videos that 

were recorded, uploaded, and posted by others.

63. Plaintiff Katherine Czajka is a citizen and resident of the State of Illinois. Plaintiff 

downloaded the App on an iPhone 8 (November 2018), iPhone 11 (September 2019), and iPad Pro 

(June 2020), and created her TikTok account in or around November of 2018. 

64. Plaintiff Czajka has uploaded and posted numerous videos using TikTok, which 

includes images of her face, since creating her account from December 2018 through July 2020. 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 14 of 120 PageID #:1886
14

Plaintiff Czajka has also viewed and “liked” other videos, commented on videos, and sent 

messages to other viewers concerning their videos.

65. Plaintiff Czajka does not recall seeing the Terms of Service or Privacy Policy upon 

registering for an account with the App. 

66. Plaintiff Brandy Johnson is a citizen and resident of the State of Illinois. Plaintiff 

created her TikTok account approximately April 2020 on her mobile device (iPhone 11) and 

maintains her account to the present day.

67. Plaintiff Johnson has uploaded and posted numerous videos using TikTok, which 

includes images of her face, since creating her account. Plaintiff Johnson has also used a 

combination of TikTok features such as stickers, filters, and the tracker lens available in the App 

when creating, saving, and posting videos on the App. Plaintiff Johnson has also viewed and 

“liked” other videos, commented on videos, and sent messages to other viewers concerning their 

videos.

68. Plaintiff Johnson does not recall seeing the Terms of Service or Privacy Policy upon 

registering for an account with the App. 

69. Plaintiff Karina Quinteiro is a citizen and resident of the State of Illinois. Plaintiff 

downloaded the App and created her TikTok account in or around July 2019.

70. Plaintiff Quinteiro has uploaded numerous videos using TikTok, which includes 

images of her face, since creating her account. Plaintiff Quinteiro has also used a combination of 

TikTok features such as stickers, filters, and the tracker lens available in the App when creating, 

saving, and posting videos on the App. Plaintiff Quinteiro has also viewed and “liked” other 

videos, commented on videos, and sent messages to other viewers concerning their videos.

71. Plaintiff Quinteiro does not recall seeing the Terms of Service or Privacy Policy 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 15 of 120 PageID #:1887
15

upon registering for an account with the App.

72. Plaintiff S.A., a minor, is, and at all relevant times was, an individual and resident 

of Illinois (Waukegan, Illinois until May 2020 and, since then, Park City, Illinois). S.A. brings this 

suit by and through his mother and legal guardian, Maritza Albarran, who is, and at all relevant 

times was, an individual and resident of Illinois (Waukegan, Illinois until May 2020 and, since 

then, Park City, Illinois).

73. S.A. first downloaded the Musical.ly app, followed by the TikTok app to his mobile 

device and created a user account in or about 2016, when he was approximately 10 years old. S.A. 

and his legal guardian have never seen or read any of Defendants’ privacy policies or terms of use. 

74. S.A. created approximately five or six videos using the TikTok app. These are 

private videos containing images of his face. S.A. used the augmented reality features and facial 

filters on his face in these videos. Numerous additional images of S.A.’s face have been captured 

in videos that were recorded, uploaded, and posted in Illinois by others.

75. Plaintiff L.B., a minor, is, and at all relevant times was, an individual and resident 

of Mokena, Illinois. L.B. brings this suit by and through his mother and legal guardian, Molly 

Janik, who is, and at all relevant times was, an individual and resident of Mokena, Illinois.

76. L.B., a minor who is currently 17 years old, downloaded the TikTok app to his own 

mobile devices and created his respective user account in or about May 12, 2016. L.B. and his 

legal guardian have never seen or read any of Defendants’ privacy policies or terms of use.

77. L.B. created at least five videos using the TikTok app. The public videos contain 

images of his face that he intentionally uploaded and posted. L.B. used the augmented reality 

features and facial filters on his face in videos.

78. Plaintiffs L.P., a minor, and M.P., a minor, are, and at all relevant times were, 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 16 of 120 PageID #:1888
16

individuals and residents of Chicago, Illinois. L.P. and M.P. bring this suit by and through their 

mother and legal guardian, Requeenis Gilder, who is, and at all relevant times was, an individual 

and resident of Chicago, Illinois.

79. Plaintiffs L.P. and M.P. are siblings who each downloaded the TikTok app to their 

own mobile devices and created their respective user accounts in or about 2018. L.P., M.P., and 

their legal guardian have never seen or read any of Defendants’ privacy policies or terms of use.

80. L.P. and M.P. each created numerous videos using the TikTok app. Each has 

videos containing images of their respective faces that they intentionally uploaded and posted. L.P. 

and M.P. used the augmented reality features and facial filters on their respective faces in videos 

they intentionally uploaded and posted. 

81. Plaintiff A.O., a minor, was at all relevant times an individual and resident of 

Evergreen Park, Illinois. A.O. brings this suit by and through his mother and legal guardian, Jasmin 

Beverly, who was at all relevant times an individual and resident of Evergreen Park, Illinois.

82. Ms. Beverly downloaded the TikTok app to her mobile device and created a user 

account in 2015 for her son, A.O. 

83. A.O. created at least seven videos using the TikTok app. The videos contain images 

of his face that he and his mother intentionally uploaded and posted. A.O. used the augmented 

reality features and facial filters on his face in videos that he and his mother intentionally uploaded 

and posted.

84. Plaintiff H.S., a minor, is, and at all relevant times was, an individual and resident 

of River Forest, Illinois. H.S. bring this suit by and through her father and legal guardian, Joshua 

Schubkegel, who is, and at all relevant times was, an individual and resident of River Forest, 

Illinois.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 17 of 120 PageID #:1889
17

85. H.S., a minor who is currently 15 years old, downloaded the TikTok app to her 

mobile device and created a user account in May 11, 2019. H.S. and her legal guardian have never 

seen or read any of Defendants’ privacy policies or terms of use.

86. H.S. created numerous videos using the TikTok app. Many are private videos

containing images of her face, while many others are videos containing images of her face that she 

intentionally uploaded and posted. H.S. used the augmented reality features and facial filters on 

her face in both private videos and in videos that she intentionally uploaded and posted.

87. Plaintiffs K.M., a minor, is, and at all relevant times was, an individual and 

resident of Frankfort, Illinois. K.M. brings this suit by and through her mother and legal guardian, 

Charlene Marks, who is, and at all relevant times was, an individual and resident of Frankfort, 

Illinois.

88. Plaintiff first downloaded the Musical.ly app followed by the TikTok app to her 

own mobile device and created her user account in or about summer of 2018 when she was 

approximately 15 years old. K.M. and her legal guardian saw Defendants’ Cookies Policy but did 

not read or review Defendant’s Privacy Policy for Young Users, Privacy Policy, or Terms of Use.

89. K.M. created approximately 12 videos using the TikTok app. Many are private 

videos containing images of her face, while many others are videos containing images of her face 

that she intentionally uploaded and posted. K.M. used the augmented reality features and facial 

filters on her face in both private videos and in videos that she intentionally uploaded and posted.

90. Plaintiff, Morgan Kukovec, is an 18-year-old female and, at all relevant times 

herein, is and was a resident of Hampshire, Illinois. 

91. Plaintiff Kukovec downloaded the TikTok app to her mobile device and created her 

user account in or about December 2019, when she had not yet met the age of majority. Plaintiff 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 18 of 120 PageID #:1890
18

Kukovec had never seen or read any of Defendants’ privacy policies or terms of use.

92. Plaintiff Kukovec created numerous videos using the TikTok app. Plaintiff 

Kukovec has videos containing images of her face that she intentionally uploaded and posted. 

Plaintiff Kukovec used the augmented reality features and facial filters on her face in videos she 

intentionally uploaded and posted. Furthermore, images of Plaintiff Kukovec’s face have been 

captured in videos that were recorded, uploaded, and posted by others.

93. Plaintiff C.H., a minor who is currently 16 years old, is, and at all relevant times 

was, an individual and resident of Chicago, Illinois. C.H. brings this suit by and through his father 

and legal guardian, Marc Halpin, who is, and at all relevant times was, an individual and resident 

of Chicago, Illinois.

94. Plaintiff C.H. downloaded the TikTok app to his iPhone and iPad devices and 

created his user account in or about October 5, 2016 when he was 12 years old. C.H. and his legal 

guardian have never seen or read any of Defendants’ privacy policies or terms of use.

95. C.H. created numerous videos using the TikTok app. Many are private videos

containing images of his face, while many others are videos that he intentionally uploaded and 

posted and which also contain images of his face. C.H. used the augmented reality features and 

facial filters on his face in both private videos and in videos he intentionally uploaded and posted. 

C.H.’s voice and images of C.H.’s face have been captured in videos that were recorded, uploaded, 

and posted by others.

96. Plaintiff D.M., a minor, is, and at all relevant times was, an individual and resident 

of Chicago, Illinois. D.M. brings this suit by and through her mother and legal guardian, D.H., 

who is, and at all relevant times was, an individual and resident of Chicago, Illinois.

97. D.M., a minor who is currently 17 years old, downloaded the Musical.ly app to her 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 19 of 120 PageID #:1891
19

mobile device and created a user account in or about 2017 when she was approximately 14 years 

old. D.M. and her legal guardian have never seen or read any of Defendants’ privacy policies or 

terms of use.

98. D.M. created numerous videos using the Musical.ly/TikTok app. Many are private 

videos containing images of her face, while many others are videos containing images of her face 

that she intentionally uploaded and posted. D.M. used the augmented reality features and facial 

filters on her face in both private videos and in videos that she intentionally uploaded and posted.

B. The Defendants.

99. Defendant ByteDance, Inc. is, and at all relevant times was, a Delaware 

corporation with its principal place of business in Palo Alto, California. Defendant ByteDance, 

Inc. is a wholly owned subsidiary of ByteDance, Ltd., a Cayman Islands corporation.

100. Defendant TikTok, Inc. f/k/a Musical.ly, Inc. (“TikTok, Inc.”) is, and at all 

relevant times was, a California corporation with its principal place of business in Culver City, 

California.

11 Defendant TikTok, Inc. also maintains offices in Palo Alto, California and Mountain 

View, California.12 The name change from Musical.ly, Inc. to TikTok, Inc. occurred in May 2019.

Defendant TikTok, Inc. is a wholly owned subsidiary of TikTok, LLC, which in turn is a wholly

owned subsidiary of TikTok, Ltd. And TikTok, Ltd. – like Defendant ByteDance, Inc. – is a wholly 

owned subsidiary of ByteDance, Ltd.

101. Defendant Musical.ly n/k/a TikTok, Ltd. is, and at all relevant times was, a 

11 https://www.cnbc.com/2019/10/14/tiktok-has-mountain-view-office-near-facebook-poachingemployees.html.

12 https://www.washingtonpost.com/technology/2019/11/05/inside-tiktok-culture-clash-whereus-views-about-censorship-often-were-overridden-by-chinese-bosses/; 

https://www.cnbc.com/2019/10/14/tiktok-has-mountain-view-office-near-facebook-poachingemployees.html.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 20 of 120 PageID #:1892
20

Cayman Island corporation with its principal place of business in Shanghai, China. Defendant 

Musical.ly was the parent company of Musical.ly, Inc. Defendant Musical.ly changed its name to 

TikTok, Ltd. and, as noted above, is a wholly owned subsidiary of ByteDance, Ltd.

102. Defendant Beijing ByteDance Technology Co. Ltd. (“Beijing ByteDance”) is, 

and at all relevant times was, a privately held company headquartered in Beijing, China. Defendant 

Beijing ByteDance is a wholly owned subsidiary of ByteDance Co., Ltd., which is also 

headquartered in Beijing, China. ByteDance Co., Ltd. is owned by founder Zhang Yiming (98.8%) 

and Zhang Lidong (1.2%). Defendant Beijing ByteDance and ByteDance Co., Ltd. operate as one 

company.

103. ByteDance, Ltd. owns 100% of ByteDance (HK) Co., Ltd., which is headquartered 

in Hong Kong. ByteDance (HK) Co., Ltd. in turn owns 100% of Beijing ByteDance Network 

Technology Co., Ltd., which is headquartered in Beijing, China.

C. Alter Ego And Single Enterprise Allegations.

104. At all relevant times, Defendants TikTok, Inc. and ByteDance, Inc. have shared

offices in Silicon Valley13 and also have shared employees. U.S. and China-based employees of 

the ByteDance family of companies perform work on and concerning the TikTok app that is at the 

center of this lawsuit, including the functionality and operation of the TikTok app and the Chinese 

version of the app (“Douyin”) that Defendant Beijing ByteDance operates in China. 

105. Plaintiffs’ investigation has revealed that one Director of Engineering in the

Mountain View office leads an “augmented reality” team that is tasked with transforming stateof-the-art artificial intelligence and augmented reality technologies into “fun features” and 

13 In addition to ByteDance-TikTok cross-listed personnel in Palo Alto, TikTok logos and 

paraphernalia are found in the ByteDance, Inc. Palo Alto office. See

https://www.youtube.com/watch?v=RymGJG0miv0.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 21 of 120 PageID #:1893
21

“creative tools” for both the TikTok and Douyin apps.

106. At all relevant times, Defendant Beijing ByteDance has directed the operations of 

Defendants TikTok, Inc. and ByteDance, Inc. with respect to the TikTok app, and Defendants 

TikTok, Inc. and ByteDance, Inc. have reported to Defendant Beijing ByteDance.

107. At all relevant times, Defendant Beijing ByteDance has collected and analyzed data 

from the United States regarding the performance of various features of the TikTok app, and has 

worked with Defendants TikTok, Inc. and Defendant ByteDance, Inc. to address performance 

issues. Additionally, at all relevant times, Defendant Beijing ByteDance and its engineers have 

done significant coding for the TikTok app and its many versions and updates.

108. Plaintiffs’ investigation has revealed that, at certain relevant times, with respect to 

Defendants’ monitoring and censorship of content on the TikTok app, management in China has 

determined content review policies enforced in Defendant TikTok, Inc.’s Culver City office; a 

content review manager in the same Culver City office was reporting to someone in China; and 

another content reviewer was required to seek authorization from someone in China in order to 

access non-published information about user accounts when content concerns arose. Also, at 

certain relevant times Defendant Beijing ByteDance employed a vast number of content reviewers 

in China to review TikTok videos uploaded by United States users, and these reviewers in China 

had authority to take down any such videos if the content was deemed inappropriate or illegal.

109. These facts are consistent with public reporting. For example, “[m]ultiple TikTok 

sources, who spoke with The Intercept on the condition of anonymity ..., emphasized the 

primacy of ByteDance’s Beijing HQ over the global TikTok operation, explaining that their 

ever-shifting decisions about what’s censored and what’s boosted are dictated by Chinese staff, 

whose policy declarations are then filtered around TikTok’s 12 global offices, translated into 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 22 of 120 PageID #:1894
22

rough English, finally settling into a muddle of Beijing authoritarianism crossed with the usual 

Silicon Valley prudishness.”14

110. Plaintiffs’ investigation has revealed that Defendant Beijing ByteDance employees 

have collected TikTok users’ feedback regarding upgraded and/or newly introduced features, and 

the departments responsible for managing and monitoring TikTok user experience have been based 

in China. Employees in these departments reported to their supervisors in China, who in turn 

shared their findings with Defendant TikTok, Inc. in the United States. Defendant Beijing 

ByteDance employees also distributed questionnaires to TikTok users, and collected and recorded

reports from such users about problems they were experiencing. Employees in the United States 

contacted TikTok users and took notes regarding such users’ experiences. These notes were

translated into Chinese and sent to Defendant Beijing ByteDance executives to review and analyze.

111. Defendant Beijing ByteDance made key strategy decisions for Defendants TikTok, 

Inc. and ByteDance, Inc., as well as for offices elsewhere in the world, and Defendants TikTok, 

Inc., ByteDance, Inc. and the other offices were tasked with executing such decisions.

112. A publicly available interview of Isaac Bess and Gregory Justice, employees of 

Defendants, on YouTube is consistent with these facts. In that interview, Isaac Bess identifies 

himself as responsible for leading “ByteDance” business development from Los Angeles, and 

Gregory Justice identifies himself as part of Defendant TikTok, Inc.’s content team in Los Angeles. 

Both discuss having regular all-hands bi-monthly meetings with the CEO in China to discuss 

global strategy with the “local teams.”15

113. At all relevant times, and in connection with the matters alleged herein, each 

14 https://theintercept.com/2020/03/16/tiktok-app-moderators-users-discrimination/.

15 https://www.youtube.com/watch?v=lKV6wsdI4-A (at 0:20 – 0:54; 15:59 – 17:08).

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 23 of 120 PageID #:1895
23

Defendant acted as an agent, servant, partner, joint venturer and/or alter ego of each of the other 

Defendants, and acted in the course and scope of such agency, partnership, and relationship and/or 

in furtherance of such joint venture. Each Defendant acted with the knowledge and consent of each 

of the other Defendants and/or directed, authorized, affirmed, consented to, ratified, encouraged, 

approved, adopted, and/or participated in the acts or transactions of the other Defendants.

114. At all relevant times, and in connection with the matters alleged herein, Defendants 

were controlled and largely owned by the same person, founder Zhang Yiming, and constitute a 

single enterprise with a unity of interest. Recognition of the privilege of separate existence under 

such circumstances would promote injustice.

III. JURISDICTION AND VENUE.

115. This Court has subject matter jurisdiction over this action pursuant to 28 U.S.C. § 

1332(d) & 1367 because: (i) this is a class action in which the matter in controversy exceeds the 

sum of $5,000,000, exclusive of interest and costs; (ii) there are 100 or more class members; and 

(iii) some members of the class are citizens of states different from some Defendants, and also 

because two Defendants are citizens or subjects of a foreign state.

116. This Court has personal jurisdiction over Defendants because: (i) they transact 

business in the United States, including in this District; (ii) they have substantial aggregate contacts 

with the United States, including in this District; (iii) they engaged and are engaging in conduct 

that has and had a direct, substantial, reasonably foreseeable, and intended effect of causing injury 

to persons throughout the United States, including in this District, and purposely availed 

themselves of the laws of the United States.

117. This Court further has personal jurisdiction with respect the claims of the Illinois 

Subclass (defined below) because Defendants used and disseminated data derived directly from 

Illinois-based TikTok users and exposed residents of Illinois to ongoing privacy risks within 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 24 of 120 PageID #:1896
24

Illinois based on the collection, capture, obtainment, disclosure, redisclosure and dissemination of 

their biometric identifiers and information. Furthermore, many of the images Defendants used for 

their unlawful collection, capture and obtainment of biometric identifiers and information were 

created in Illinois, uploaded from Illinois, and/or managed via Illinois-based user accounts, 

computers, and mobile devices. Because of the scope and magnitude of Defendants’ conduct, 

Defendants knew that their collection, capture, obtainment, disclosure, redisclosure and 

dissemination of impacted individuals’ biometric identifiers and information would injure Illinois 

residents and citizens. Defendants knew or had reason to know that collecting, capturing, 

obtaining, disclosing, redisclosing and disseminating Illinois citizens’ and residents’ biometric 

identifiers and information without providing the requisite notice or obtaining the requisite releases 

would deprive Illinois citizens and residents of their statutorily-protected privacy rights, neutralize 

Illinois citizens’ and residents’ ability to control access to their biometric identifiers and 

information via their Illinois-managed devices and exposed minors in Illinois to potential 

surveillance and other privacy harms as they went about their lives within the state. 

118. Furthermore, through the TikTok app, Defendants actively collect information 

harvested from the Illinois-based devices of Illinois residents, including “location information”

based on users’ “SIM card and/or IP address.”

119. Defendants use this harvested information to “provide [users] with location-based 

services, such as advertising and other personalized content” directed toward Illinois. 

120. Defendants’ deliberate gathering of Illinois users’ personally identifiable 

information is intentionally targeted toward Illinois residents, including Plaintiffs and the Class, 

and constitutes purposeful activity directed at devices and individuals in Illinois.

121. Indeed, Defendants attract advertisers by touting the TikTok’s app’s ability to target 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 25 of 120 PageID #:1897
25

users by, among other things, location, stating that “[i]t has never been easier to reach potential 

customers by precisely targeting your audience. Using TikTok Ads, you can target your audience 

by gender, location, age, interests, and other unique variables.” TikTok expressly targets its 

advertisements by State, including, upon information and belief, within Illinois. Venue is proper 

under 28 U.S.C. § 1391(b)(2) because a substantial part of the acts or omissions giving rise to the 

claims alleged herein occurred in Illinois. Alternatively, venue is proper under 28 U.S.C. §

1391(b)(3) because this Court has personal jurisdiction over Defendants.

122. Venue is also proper because the Judicial Panel on Multi-District Litigation ordered 

that the various cases filed against Defendants be centralized in the Northern District of Illinois.

IV. THE GROWTH OF DEFENDANTS AND THEIR DANGEROUS APPS.

A. Defendant Beijing ByteDance Becomes A China-Based Tech Giant Focused

On Overseas Markets, Particularly In The United States.

123. Founded in 2012, Defendant Beijing ByteDance—the parent company of TikTok—

is one of China’s largest technology companies with an estimated valuation of $100 billion.16

ByteDance’s CEO, Zhang Yiming, was honored by an organization affiliated with the Chinese 

Communist Party as one of its “100 outstanding private entrepreneurs.”17 The list is “something 

of a guide to who is in the good books of the Chinese authorities.”18

124. Defendant Beijing ByteDance makes a variety of video and news-aggregation 

apps.19 It “regards its platforms as part of an artificial intelligence company powered by algorithms 

16 https://techcrunch.com/2020/08/10/bytedance-valuation-under-huge-pressure-as-tiktok-salenears.

17 https://www.weekinchina.com/2018/11/loyalty-points.

18 https://www.weekinchina.com/2018/11/loyalty-points.

19 https://www.wsj.com/articles/tiktoks-videos-are-goofy-its-strategy-to-dominate-social-mediais-serious-11561780861.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 26 of 120 PageID #:1898
26

that ‘learn’ each user’s interests and preferences through repeat interaction.”20 Because Defendant 

Beijing ByteDance emerged only after other China-based tech giants already had taken over the 

market in China, Defendant Beijing ByteDance has looked to overseas markets, including those in 

the United States, for growth.21

125. Defendant Beijing ByteDance had $7.2 billion in annual revenue for the year 2018. 

It far surpassed this number in 2019, booking $7 billion to $8.4 billion in revenue in a better-thanexpected result for the first half of 2019.22 Investors in Defendant Beijing ByteDance include 

Sequoia Capital China, Russian billionaire Yuri Milner, Japanese technology giant SoftBank, and 

big private-equity firms such as KKR, General Atlantic, and Hillhouse Capital Group.23

126. Most of Defendant Beijing ByteDance’s revenue is generated from advertising.24

“ByteDance has [] been doubling down on its advertising business as the company’s management 

sets increasingly ambitious revenue goals.”25 “As with pretty much all major social media and 

content startups, ByteDance monetises through advertising. Specifically, it runs targeted 

advertising within user feeds – providing them promotional content in between using the app.”26

20 https://www.law360.com/articles/1213180/sens-want-tiktok-investigated-for-national-securitythreats; https://www.cotton.senate.gov/?p=press_release&id=1239.

21 https://www.wsj.com/articles/tiktoks-videos-are-goofy-its-strategy-to-dominate-social-mediais-serious-11561780861.

22 https://www.cnbc.com/2019/09/30/tiktok-owner-bytedances-first-half-revenue-better-thanexpected-at-over-7-billion-sources.html.

23 https://www.wsj.com/articles/lip-syncing-app-musical-ly-is-acquired-for-as-much-as-1-

billion-1510278123; https://www.reuters.com/article/us-tiktok-cfius-exclusive/exclusive-usopens-national-security-investigation-into-tiktok-sources-idUSKBN1XB4IL.

24 https://www.bloomberg.com/news/articles/2019-01-15/bytedance-is-said-to-hit-lower-end-ofsales-goal-amid-slowdown.

25 https://technode.com/2019/09/20/bytedance-launches-video-ad-tools-for-tiktok-douyin/.

26 https://www.businessofapps.com/insights/bytedance-social-media-advertising-company/.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 27 of 120 PageID #:1899
27

B. The Musical.ly App Evolves Into The TikTok App.

127. Defendant Musical.ly (named, and now known as, TikTok, Ltd.) and Defendant 

Musical.ly, Inc. (named, and now known as, TikTok, Inc.) launched the highly popular social 

media and social networking app “Muscial.ly” in 2014. This app allows its users to (i) create video 

selfies of themselves dancing and/or lip-syncing with a musical soundtrack in the background, and 

(ii) share such videos with friends.27

128. There are simple tools provided by the Musical.ly app that users can use to create 

and edit these videos, and the app provides a large online music library from which users may

select their background music. The Musical.ly app was designed “to capture the YouTube 

phenomenon of teenagers sharing videos of themselves singing or dancing to popular music.”28

Beyond the creation and sharing of videos, the Musical.ly app provides a platform through which 

users can interact, including by commenting on other users’ videos and “following” other users’ 

accounts. Users also can send direct messages in order to communicate with other users on the 

app. By November 2017, the Musical.ly app had 60 million monthly active users.29

129. Meanwhile, in 2016, Defendant Beijing ByteDance launched its own app called

“Douyin” in China, which mimicked the Musical.ly app.30 By 2017, shortly before its purchase of 

Defendants Musical.ly and Musical.ly, Inc., Defendant Beijing ByteDance introduced an English27 https://www.wsj.com/articles/lip-syncing-app-musical-ly-is-acquired-for-as-much-as-1-

billion-1510278123.

28 https://www.wsj.com/articles/lip-syncing-app-musical-ly-is-acquired-for-as-much-as-1-

billion-1510278123.

29 https://www.wsj.com/articles/lip-syncing-app-musical-ly-is-acquired-for-as-much-as-1-

billion-1510278123; https://www.nytimes.com/2019/11/01/technology/tiktok-national-securityreview.html.

30 https://www.wsj.com/articles/tiktoks-videos-are-goofy-its-strategy-to-dominate-social-mediais-serious-11561780861.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 28 of 120 PageID #:1900
28

language version of the Douyin app outside China under the name “TikTok.” In August 2018, after 

having acquired Defendants Musical.ly and Musical.ly, Inc., Defendant Beijing ByteDance 

combined the Musical.ly app with its TikTok app, merging all existing accounts and data into a 

single app under the retained “TikTok” name.31

130. The Musical.ly and TikTok apps are hereafter collectively referred to as the 

“TikTok app,” and the Musical.ly and TikTok users are hereafter collectively referred to as the 

“TikTok users.”

C. The TikTok App Becomes A Global Phenomenon With A Strong Presence In 

The United States.

131. The TikTok app has become “one of the world’s fastest-growing social media 

platforms” and a “global phenomenon” with a massive American audience.32 In November 2019, 

the Washington Post reported that the TikTok app had been downloaded more than 1.3 billion 

times worldwide, and more than 120 million times in the United States.

33 However, by April 2020, 

TechCrunch reported that the TikTok app’s worldwide downloads already had surpassed 2 billion, 

and that in “the quarter that ended on March 31, TikTok was downloaded 315 million times — the 

highest number of downloads for any app in a quarter.”34 It is the most downloaded non-game app 

in the world.35 The TikTok app routinely outranks its top competitors – such as Facebook, 

31 http://culture.affinitymagazine.us/tik-tok-is-scamming-people-stealing-information/.

32 https://www.washingtonpost.com/technology/2019/11/05/inside-tiktok-culture-clash-whereus-views-about-censorship-often-were-overridden-by-chinese-bosses/.

33 https://www.washingtonpost.com/technology/2019/11/05/inside-tiktok-culture-clash-whereus-views-about-censorship-often-were-overridden-by-chinese-bosses/.

34 https://techcrunch.com/2020/04/29/tiktok-tops-2-billion-downloads/.

35 https://www.cnbc.com/2019/07/25/china-camera-apps-may-open-up-user-data-to-beijinggovernment-requests.html.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 29 of 120 PageID #:1901
29

Snapchat, and Instagram – on the Apple and Google app stores.36 In fact, it has been the most 

downloaded app on the Apple and Google app stores for months.37 As of August 2019, the TikTok 

and Douyin apps had 625 million monthly active users.38 The average user opened the TikTok app 

more than 8 times per day and spent approximately 45 minutes on the app daily as of March 2019.39

132. In January 2020, Barron’s reported on the TikTok app’s revenue: “The wildly 

popular short-video service generated $176.9 million in revenue in 2019—71% of the total $247.6 

million in revenue the app has ever generated, according to new data from the app-tracking firm 

SensorTower. In the fourth quarter alone, TikTok had revenue of $88.5 million, up two times from 

the third quarter and up six times year over year, most of that from advertising and in-app 

purchases, SensorTower reports. China accounted for about 69% of the company’s 2019 revenue, 

according to the firm, with U.S. revenues accounting for 20%.”40 Evidencing the TikTok app’s 

rapid growth, three months later, TechCrunch reported that: “Users have spent about $456.7 million 

on TikTok to date, up from $175 million five months ago. Much of this spending — about 72.3% 

— has happened in China. Users in the United States have spent about $86.5 million on the app, 

making the nation the second most important market for TikTok from the revenue standpoint.”41

133. As of August 2020, TikTok admitted to having more than 100 million monthly 

36 https://www.washingtonpost.com/technology/2019/11/05/inside-tiktok-culture-clash-whereus-views-about-censorship-often-were-overridden-by-chinese-bosses/.

37 https://thehill.com/policy/technology/469114-tiktok-faces-lawmaker-anger-over-china-ties.

38 https://thehill.com/policy/technology/469114-tiktok-faces-lawmaker-anger-over-china-ties.

39 https://www.wsj.com/articles/tiktoks-videos-are-goofy-its-strategy-to-dominate-social-mediais-serious-11561780861.

40 https://www.barrons.com/articles/beware-facebook-tiktok-revenues-are-exploding51579201752.

41 https://techcrunch.com/2020/04/29/tiktok-tops-2-billion-downloads/.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 30 of 120 PageID #:1902
30

active users in the United States.42 Some estimates indicate that there are 123.8 million active users 

of TikTok in the United States.43 In other words, over one-third of the United States’ population 

of 328.2 million has used TikTok, and approximately 50 million Americans use TikTok each 

day.44

134. This level of success globally and in the United States is rare for a China-based tech 

giant. Facebook CEO Mark Zuckerberg acknowledged as much, stating that the TikTok app “is 

really the first consumer internet product built by one of the Chinese tech giants that is doing quite 

well around the world. It’s starting to do well in the U.S., especially with young folks.”45 Indeed, 

Defendant TikTok, Inc. recently took over office space in Silicon Valley once occupied by 

Facebook’s WhatsApp messaging app, and is poaching employees from rival Facebook by offering 

salaries as much as 20% higher.46 Other competitors from whom Defendant TikTok, Inc. is hiring 

away employees include Snap, Hulu, Apple, YouTube, and Amazon.47

135. One key to Defendants’ financial success is the targeted advertising that they run 

through the TikTok app. Such targeted advertising relies heavily upon knowledge of each user’s 

preferences.

48

42 Complaint for Injunctive and Declaratory Relief, ¶ 19, TikTok Inc. v. Donald J. Trump et al., 

No. 2:20-cv-7672, (C.D. Cal. Aug. 24, 2020), ECF No. 1, available at: https://cdn.voxcdn.com/uploads/chorus_asset/file/21812645/document__1_.pdf (hereafter “TikTok v. Trump”).

43 See https://commercialfreechildhood.org/wp-content/uploads/2020/05/tik_tok_complaint.pdf. 

44 TikTok v. Trump, ¶ 21.

45 https://www.cnbc.com/2019/10/14/tiktok-has-mountain-view-office-near-facebook-poachingemployees.html.

46 https://www.cnbc.com/2019/10/14/tiktok-has-mountain-view-office-near-facebook-poachingemployees.html.

47 https://www.cnbc.com/2019/10/14/tiktok-has-mountain-view-office-near-facebook-poachingemployees.html.

48 https://www.digitaltrends.com/social-media/tiktok-advertiser-audience-network-targeted-ads/.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 31 of 120 PageID #:1903
31

136. Through a secretive and highly invasive information gathering campaign, 

Defendants have unlawfully accumulated private and personally identifiable data and content from

TikTok users that Defendants are monetizing. Thus, Defendants are unjustly profiting from their 

unlawful activities.

V. DEFENDANTS’ THEFT OF PRIVATE AND PERSONALLY IDENTIFIABLE 

TIKTOK USER DATA AND CONTENT.

A. Defendants’ Secret Taking and Disclosure of Private TikTok User Data

Without Notice Or Consent.

1. The TikTok app requires that users provide private and personally 

identifiable data upon sign-up.

137. In order to create and send videos, an individual can first create a TikTok profile 

by registering with TikTok using his or her phone number or email address, or Facebook, Google, 

or Twitter credentials.

138. Videos are shared either publicly (and then available to be viewed by all other 

TikTok users) or sent privately to selected users.

139. By default, TikTok profiles are set to “public,” which allows anyone to see a user’s 

profile, username, and videos. 

140. But users can set their TikTok profile to “private,” purportedly to ensure their 

profiles and videos do not appear in searches of TikTok content. A user with a private profile may 

access all of TikTok’s functions and features, and can share videos directly with friends through

the app.

141. As elaborated upon below, public videos are central to the TikTok experience. 

Through its “For You” page, TikTok curates content for each user, offering an endless feed of 

recommended videos that Defendants select based on algorithmic evaluation of each user’s 

interests. 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 32 of 120 PageID #:1904
32

142. These curated video feeds are integral to TikTok’s revenue model, which is heavily 

reliant on “microtargeted” advertisements. 

143. By prompting users to view videos with which they are more likely to engage (as 

determined by TikTok based on the vast amounts of data available it collects), TikTok has proven 

able to scale up its revenues at an extraordinary pace. 

144. And, of course, the more data TikTok has at its disposal, the more efficiently and 

effectively it can deploy advertising and grow its profits. 

2. The TikTok app secretly takes users’ private videos before users are 

given the choice whether to save or post them.

145. Unless publicly shared through the affirmative consent of the TikTok user, videos 

created using the TikTok app, which often include close-ups of faces and private acts unintended 

for public consumption, are inherently private, personal, and sensitive.

146. After using the TikTok app to record a video, a screen presents TikTok users with 

certain options, including the following: (i) an “x” button; (ii) a “next” button; and (iii) a button 

for effects. The “x” button takes TikTok users to a screen with options, including “reshoot” and 

“exit.” The “next” button takes TikTok users to a screen with options, including “save” and “post.”

The “effects” button takes TikTok users to a screen offering the ability to modify the video.

147. Once TikTok users click the “next” button, but before they click either the “save” 

or “post” buttons, their private videos that are neither saved nor posted (the “Private Videos”) are 

transferred from their mobile devices to the following domain owned and controlled by 

Defendants: muscdn.com. 

148. The “mus” portion of the domain name stands for Musical.ly, and the “cdn” portion 

of the domain name stands for content distribution network. During the secret transfer of TikTok 

users’ Private Videos to the domain and servers mentioned above, there is no progress bar or any 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 33 of 120 PageID #:1905
33

other indication that their Private Videos are being transferred. 

149. Nor is Defendants’ surreptitious taking of the Private Videos disclosed in any of 

Defendants’ privacy policies or other disclosure documentation. TikTok users are thus prevented 

from knowing that Defendants have taken their Private Videos. No user consent exists.

150. Additionally, the December 2019 version of the TikTok app transfers five 

thumbnail images uniformly distributed across each of the Private Videos (the “Private Video 

Images”) to byteoversea.net. The domain byteoversea.net is controlled by Defendants and has 

numerous sub-domains. Accordingly, when data and content arrives at byteoversea.net, it is routed 

to one or more of these sub-domains. The various sub-domains are spread across the globe, 

including within China.

151. Defendants’ taking of the Private Video Images is not disclosed in any of 

Defendants’ privacy policies or other disclosure documentation. TikTok users are thus prevented 

from knowing that Defendants have taken their Private Video Images as well. No user consent 

exists.

152. This highly invasive breach of TikTok users’ privacy is not the only harm that 

befalls such users as a result of Defendants’ theft of their Private Video Images. Defendants also 

can take highly sensitive and immutable biometric identifiers and information from these Private 

Video Images and unjustly profit from such activities.

3. The TikTok app covertly takes user and device information.

153. Also unknown to TikTok users is that the seemingly innocuous TikTok app

infiltrates their mobile devices and extracts a remarkably broad array of private and personally 

identifiable data and content that Defendants use to track and profile TikTok users for the purpose 

of, among other things, targeting them with advertisements from which Defendants unjustly profit.

154. Plaintiffs, the Class, and the Subclass have a reasonable expectation of privacy in 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 34 of 120 PageID #:1906
34

the private and personally identifiable data and content on their mobile device.

155. The United States Supreme Court has recognized that, in contemporary society, cell 

phones are so ubiquitous and inextricably intertwined with the user’s personal privacy that such 

devices have become “almost a ‘feature of human anatomy.’” Carpenter v. United States, 138 S.

Ct. 2206, 2218 (2018) (quoting Riley v. California, 573 U.S. 373, 385 (2014)). The United States 

Constitution thus provides a privacy right that protects individuals against unreasonable 

governmental searches of their physical movements through historical cell phone records in the 

possession of their service providers. Carpenter, 138 S. Ct. at 2218.

156. From each mobile device on which the TikTok app is installed, Defendants take a 

combination of, among other items, the following user identifiers and mobile device identifiers 

(“User/Device Identifiers”):

a. username, password, age/birthday, email address, and profile image;

b. user-generated content, including messages sent through the apps;

c. phone and social network contacts;

d. the mobile device’s WiFi MAC address (i.e., media access control address), which 

is the unique hardware number on the WiFi card adapter that tells the internet who 

is connected to it;

e. the mobile device’s International Mobile Equipment Identity (“IMEI”) number, 

which is a unique number given to every mobile device that is used to route calls 

to one’s phone, and that reflects information about the origin, model, and serial 

number of the mobile device;

f. the user’s International Mobile Subscriber Identity (“IMSI”) number, which is a 

unique number given to every subscriber to a mobile network;

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 35 of 120 PageID #:1907
35

g. the IP address (i.e., Internet Protocol address), which is a numerical label assigned 

to each user mobile device connected to a computer network that uses the Internet 

Protocol for communication. IP addresses allow the location of literally billions of 

digital devices that are connected to the Internet to be pinpointed and differentiated 

from all other such devices;

h. the device ID, which is a unique, identifying number or group of numbers assigned 

to the user’s individual mobile device that is separate from the hardware serial 

number;

i. the OS version, which is the operating system on the user’s mobile device;

j. the mobile device brand and model/version;

k. the hardware serial number, which is the unique, identifying number or group of 

numbers assigned to the user’s individual mobile device;

l. the Advertising ID, which is a unique ID for advertising that provides developers 

with a simple, standard system to monetize their apps;

m. mobile carrier information (e.g., the name of the phone company); 

n. network information, including the technology that the carrier uses;

o. browsing history;

p. cookies;

q. metadata; and

r. precise physical location, including based on SIM card, cell towers and/or GPS.

157. Such collection of physical and digital location tracking data is highly invasive of 

TikTok app users’ privacy rights. Two United States Senators observed that “[l]ocation data is 

among the most sensitive personal information that a user can share with a company ... Today, 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 36 of 120 PageID #:1908
36

modern smartphones can reveal location data beyond a mere street address. The technology is 

sophisticated enough to identify on which floor of a building the device is located.”49 Location 

data reveals private living patterns of TikTok users, including where they work, where they reside, 

where they go to school, and when they are at each of these locations. Location data, either standing 

alone or combined with other information, exposes deeply private and personal information about

TikTok users’ health, religion, politics and intimate relationships.

158. The TikTok app also invites users to sign in through Facebook, Google, and 

Twitter. What users do not know and what Defendants fail to adequately disclose is that this “single 

sign-on” option gives Defendants access to TikTok users’ private and personally identifiable data

and content stored on these other social media accounts, including User/Device Identifiers such 

as the user’s photos and friends/contacts information. What users also do not know and what 

Defendants fail to disclose is that Defendants transmit private and personally identifiable user 

information to third parties like Facebook and Google, as discussed below.

4. The TikTok App clandestinely transmits user video viewing histories 

to third parties.

159. Defendants use the TikTok app to distribute private and personally identifiable

information concerning TikTok users’ video viewing history to third parties Facebook and Google 

without user knowledge or consent.

160. For example, the TikTok app transmits the following information from TikTok 

users’ devices to Facebook’s domain graph.facebook.com: (1) when an individual TikTok user 

views a particular video, including the video’s ID; (2) when an individual TikTok user “likes” a 

particular video, including the video’s ID; (3) when an individual TikTok user “favorites” a 

49 https://www.law360.com/consumerprotection/articles/1221312/sens-prod-zuckerberg-whykeep-tracking-user-locations-.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 37 of 120 PageID #:1909
37

particular video, including the video’s ID; (4) the other TikTok users that the individual TikTok 

user “follows,” including the other TikTok users’ IDs; and (5) the individual TikTok user’s 

Facebook-assigned advertising ID linked to the individual TikTok user’s Facebook account. 

161. This advertising ID is linked to the user’s particular device and it identifies that user 

to an ordinary person without need for further cross-referencing or investigation because Facebook 

maintains a 1:1 correspondence of advertising IDs to individuals, a fact known to Defendants. 

162. Defendants do not disclose to TikTok users that Defendants transmit this private

and personally identifiable information to Facebook, nor do Defendants obtain user consent for 

such transmissions.

163. Also by way of example, the TikTok app transmits the following information from 

TikTok users’ devices to Google’s domain app-measurement.com: (1) the particular videos that 

an individual TikTok user “likes,” including the video ID and the individual TikTok user’s Googleassigned device ID and advertising ID, linked to the TikTok user’s Google account, which 

identifies the user to an ordinary person without need for further cross-referencing or investigation 

because Google maintains a 1:1 correspondence of device IDs and advertising IDs to individuals, 

a fact known to Defendants; and (2) the other TikTok users that the individual TikTok user 

“follows,” including the other users’ IDs and the individual TikTok user’s Google-assigned device 

ID and advertising ID, which are linked to the TikTok user’s Google account. Defendants do not 

disclose to TikTok users that Defendants transmit this private and personally identifiable

information to Google, nor do Defendants obtain user consent for such transmissions.

5. The TikTok App secretly collects data far beyond what Defendants 

disclose to users.

164. The TikTok app’s source code reveals that Defendants track each user’s specific 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 38 of 120 PageID #:1910
38

location, notwithstanding TikTok’s claim that it does so only if users consent.50

165. Specifically, TikTok “determine[s] as precise a location [for the user] as possible 

from the available location providers, including the Global Positioning System (GPS) as well as 

WiFi and mobile cell data.” Penetrum, a cybersecurity company that analyzed the TikTok app’s 

source code, concluded that because TikTok collects highly sensitive location data, the app 

provides a “dangerous[ly]” low level of protection for users.51

166. And although both Apple and Google prohibit apps from accessing the MAC 

address of mobile devices, TikTok accesses the MAC address on mobile devices running on an 

Android operating system. It does so by concealing the data the app gathers and transmits to 

Defendants by using custom encryptions allowing the data to “bypass detection by Apple or 

Google because if Apple or Google saw them passing those identifiers back they would almost 

certainly reject the app.”52 It thus can pinpoint users’ precise current locations, and well as those 

they often visit, using the devices’ MAC addresses.

167. In addition to device and network data, TikTok also collects data regarding users’ 

general habits and their devices—even when the TikTok app is not in use—and transmits the data 

to Defendants. The data that TikTok accesses includes user content and communications, cookies, 

metadata, and internet browsing history, all of which may contain highly sensitive, user-specific 

50: https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysis_whitepaper.pdf 

51

https://developer.android.com/reference/android/Manifest.permission#ACCESS_FINE_LOCATI

ON (noting that the code used by TikTok “allows an app to access precise location” and that the 

protection level of the particular code is “dangerous”).

52 https://www.wsj.com/articles/tiktok-tracked-user-data-using-tactic-banned-by-google11597176738.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 39 of 120 PageID #:1911
39

information.53

168. The app also attempts to ascertain the user’s gender, race, and age. To do this, as 

elaborated below, TikTok uses biometric identifiers and facial recognition algorithms to map the 

user’s face in both the user’s profile picture and videos featuring the user.54 TikTok frequently 

recommends that a user follow other users with similar profile pictures.55

169. Defendants accelerate their data harvesting efforts once users actually begin to 

engage with the TikTok app. TikTok uses AI and various algorithms to determine a user’s 

“interests” based on the user’s behavior when using the app. 

170. Defendants also intentionally share data with third parties, such as advertisers and 

other complementary social media services. 

171. For example, data protection researcher and journalist Matthias Eberl discovered 

that TikTok transmits certain data directly to third parties, such as Facebook and Appsflyer, 

including the user’s device information, which videos the users watched videos and actual usage 

time.56

172. The third parties may be sharing the data with additional entities.57

173. TikTok tracks which specific users watch particular videos and performs “highly 

controversial methods” of fingerprinting each device on which the app is installed by “combining 

53 https://www.tiktok.com/legal/privacy-policy?lang=en#privacy-us (last updated Jan. 1, 2020) 

(listing data that Defendants automatically collect even if the person who downloaded the app does 

not create an account).

54 https://www.nytimes.com/2020/08/14/technology/tiktok-underage-users-ftc.html.

55 https://www.vox.com/recode/2020/2/25/21152585/tiktok-recommendations-profile-look-alike.

56 https://rufposten.de/blog/2019/12/05/privacy-analysis-of-tiktoks-app-and-website.

57 See https://rufposten.de/blog/2019/12/05/privacy-analysis-of-tiktoks-app-and-website.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 40 of 120 PageID #:1912
40

unique hardware and browser characteristics.”58

174. The app also creates an audio fingerprint of the device by generating and recording 

internal sounds that are unique thereto.59

175. Fingerprinting the mobile devices could allow users and their devices to be tracked 

by Defendants and third parties (such as advertisers).

176. Not even users’ private messages to others are safe from Defendants. TikTok reads 

the private messages that users exchange with one another—it even scans draft messages that are 

not yet, and may never be, sent—and views (and, on information and belief, analyzes) videos users 

send to friends privately through the app, but which are not posted publicly.60

6. Defendants’ theft of private and personally identifiable user data and 

content begins even before users can choose whether to sign up with 

TikTok and create an account.

177. The TikTok app begins taking private and personally identifiable user data and 

content immediately upon the completion of the download process and before TikTok users even 

have the opportunity to sign up and create an account. TikTok users therefore do not have an 

opportunity to learn about the existence of, much less consent to, any of Defendants’ privacy 

policies or other disclosure documentation before the TikTok app begins mining their mobile 

devices for their data and content.

7. Defendants’ theft of private and personally identifiable data and 

content continues even after users close the TikTok app.

178. Even when TikTok users stop using the app and close it, Defendants continue to 

58 https://rufposten.de/blog/2019/12/05/privacy-analysis-of-tiktoks-app-and-website.

59 https://rufposten.de/blog/2019/12/05/privacy-analysis-of-tiktoks-app-and-website.

60 https://www.bloomberg.com/news/articles/2020-07-14/tiktok-s-massive-data-harvestingprompts-u-s-security-concerns; http://culture.affinitymagazine.us/tik-tok-is-scamming-peoplestealing-information.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 41 of 120 PageID #:1913
41

harvest private and personally identifiable data and content from such users’ mobile devices. There 

are no disclosures in any of Defendants’ privacy policies or other disclosure documentation that 

such surreptitious taking of private and personally identifiable user data and content occurs when 

the TikTok app is closed. TikTok users are thus prevented from knowing that Defendants have 

taken their private and personally identifiable data and content while the TikTok app is closed. No 

user consent exists.

8. Defendants’ theft of private and personally identifiable data and 

content extends to sources wholly unrelated to the TikTok app.

179. Defendants’ invasive, surreptitious, and unlawful data collection is not limited to 

the scope of the TikTok app.

180. Rather, Defendants have gone asfar as to track and collect private user data, created 

outside of and unrelated to the TikTok app, when the app is not in use. 

181. For example, TikTok has accessed the clipboard on users’ devices, allowing it to 

capture text and images that the user copied, even if in a different app, which could include 

passwords, financial information, or other sensitive, personally identifiable information.61

182. TikTok accessed a device’s clipboard every few keystrokes, presumably to ensure 

it captures every bit of information available.62

183. Apple’s iOS 14 beta operating system exposed that Defendants were engaging in 

unauthorized data-mining and surveillance of user devices through automated technologies which 

allow them to gain covert access to the Universal Clipboard. 

184. A user’s system clipboard is unlimited in the array of sensitive data and information 

61 https://www.forbes.com/sites/zakdoffman/2020/06/26/warning-apple-suddenly-catches-tiktoksecretly-spying-on-millions-of-iphone-users/#4a4ff00334ef.

62 See https://twitter.com/jeremyburge/status/1275896482433040386. 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 42 of 120 PageID #:1914
42

it may contain, such as: photos, text messages, audio recordings, e-mails, cryptographic keys,

medical records, and other personal information. 

185. Moreover, the clipboard on a user’s phone or tablet may contain content from other 

of the user’s devices, e.g., his or her laptop. For example, Apple’s continuity features—the 

“Handoff” function—facilitate seamless continuity and sharing between iOS and MacOS devices 

signed into the same iCloud account. Handoff is the default setting, and, unless disabled, a user’s 

shared devices will automatically discover nearby devices, send communications by and between 

devices, interface with Apple iCloud and transmit data and information between them. 

186. Handoff works with Calendar, Contacts, Pages, Safari, Messaging, News and Ebooks, music, system clipboard and various third-party apps. The Universal Clipboard transmits 

clipboard data to all nearby shared devices. The information, however, is typically only accessible 

for a 120-second timeout period. 

187. Defendants gained unauthorized, covert access to User’s Universal Clipboard by 

reading the system clipboard with every few keystrokes (if not even more often), thus 

circumventing the automatic 120-second timeout feature.

188. Defendants continuously accessed, intercepted, and otherwise used the data and 

information on the Universal Clipboard, including information from users’ other shared devices.

189. Defendants did not obtain permission from users to access their devices, social 

media accounts, system clipboards, messaging apps, safari apps or other such sensitive data and 

information. 

190. Defendants did not obtain permission from users to intercept, read, and use their 

electronic communications or inter-device communications. 

191. Upon information and belief, Defendants used various software, technologies, and 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 43 of 120 PageID #:1915
43

programs to covertly intercept, access, and otherwise use Plaintiffs and Class Members’ data and 

information stored on electronic devices. 

192. Defendant used various programs and technologies to conduct geo-tracking and 

other surveillance of Plaintiffs and Class Members, without authorization or permission. 

9. Defendants conceal their misconduct.

193. At the same time that Defendants utilize the TikTok app to covertly tap into a 

massive array of private and personally identifiable user data and content, they go to great lengths 

to hide their tracks. Plaintiffs’ investigation has revealed that Defendants do so by obfuscating the 

source code that would reveal their misconduct.

B. Defendants Settle An FTC Lawsuit Alleging They Unlawfully Collected And

Used Children’s Data.

194. On February 27, 2019, the United States, on behalf of the Federal Trade 

Commission (“FTC”), filed a lawsuit against Defendants Musical.ly and Musical.ly, Inc. alleging 

they had violated the Children’s Online Privacy Protection Act (“COPPA”) by collecting and using 

personal data from children under age 13 without the required notice and consent from parents or 

guardians.

63 According to the FTC, Defendants’ violations were knowing and willful, as 

Defendants received scores of complaints from concerned parents. In fact, in a two-week period 

in September 2016, Defendants received more than 300 complaints from angry parents demanding 

that Defendants close their children’s accounts. 64 While Defendants closed the accounts, they did 

not delete the minors’ videos or profile information from their servers.65

195. Shortly thereafter, Defendants Musical.ly and Musical.ly, Inc. stipulated to an order 

63 United States of America v. Musical.ly and Musical.ly, Inc., United States District Court, 

Central District of California, Case No. 2:19-cv-1439 [ECF No. 1]

64 Id. at ¶ 21.

65 Id.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 44 of 120 PageID #:1916
44

mandating, among other things, a civil penalty in the amount of $5.7 million and injunctive relief 

concerning the collection and destruction of children’s personal data.66 The $5.7 million fine is the 

largest civil penalty ever imposed for such a violation.67 The FTC also published a statement 

indicating that, “[i]n our view, these practices reflected the company’s willingness to pursue 

growth even at the expense of endangering children.”68

196. Defendants’ compliance with the FTC settlement terms is unclear and as recently 

as May 29, 2020, a bipartisan group of United States Senators and Representatives called for 

investigations into whether Defendants continue to violate COPPA. Their concerns are not 

unfounded: a coalition of 20 children’s privacy protection groups complained to the FTC that 

Defendants flout the settlement terms.

69

197. On December 14, 2020, the FTC renewed its interest in TikTok, issuing an order 

requiring TikTok to provide data on how it collects, uses, and presents users’ personal information, 

as well information on its advertising and user engagement practices, and how its practices affect 

children and teenagers.70

198. The FTC’s order included a joint statement explaining that social media companies 

like TikTok “have been able to exploit their user-surveillance capabilities to achieve such 

66 United States of America v. Musical.ly and Musical.ly, Inc., United States District Court, 

Central District of California, Case No. 2:19-cv-1439 [ECF No. 10].

67 https://www.wsj.com/articles/tiktoks-videos-are-goofy-its-strategy-to-dominate-social-mediais-serious-11561780861; https://www.techinasia.com/tiktok-owner-bytedance-gathers-1-billionmonthly-active-users-apps.

68 https://www.nbcnews.com/tech/tech-news/tiktok-pay-5-7-million-over-alleged-violationchild-privacy-n977186.

69 See https://commercialfreechildhood.org/wp-content/uploads/2020/05/tik_tok_complaint.pdf.

70 See https://www.ftc.gov/news-events/press-releases/2020/12/ftc-issues-orders-nine-socialmedia-video-streaming-services.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 45 of 120 PageID #:1917
45

significant financial gains that they are now among the most profitable companies in the world.”

Moreover, social media companies’ “constant access” to users’ mobile devices allows them “to 

monitor where users go, the people with whom they interact, and what they are doing.”71

199. TikTok has forty-five days from receipt of the order to respond.

C. Defendants Come Under United States Government Scrutiny.

1. The United States Government investigates Defendants’ stockpiling of

TikTok users’ private and personally identifiable data and content for 

the Chinese Government.

200. United States Senators Charles Schumer and Tom Cotton sent an October 2019

letter to the Acting Director of National Intelligence describing “national security” risks associated 

with the TikTok app. The Senators noted that there is evidence that Defendants may share private

and personally identifiable user data and content with the Chinese government:

TikTok’s terms of service and privacy policies describe how it 

collects data from its users and their devices, including user content 

and communications, IP address, location-related data, device 

identifiers, cookies, metadata, and other sensitive personal 

information. While the company has stated that TikTok does not

operate in China and stores U.S. user data in the U.S., ByteDance is 

still required to adhere to the laws of China.

Security experts have voiced concerns that China’s vague 

patchwork of intelligence, national security, and cybersecurity laws 

compel Chinese companies to support and cooperate with 

intelligence work controlled by the Chinese Communist Party. ...

With over 110 million downloads in the U.S. alone, TikTok is a 

potential counterintelligence threat we cannot ignore. Given these 

concerns, we ask that the Intelligence Community conduct an 

assessment of the national security risks posed by TikTok ... and 

brief Congress on these findings.72

71 https://www.ftc.gov/system/files/documents/reports/6b-orders-file-special-reports-socialmedia-video-streaming-serviceproviders/joint_statement_of_ftc_commissioners_chopra_slaughter_and_wilson_regarding_socia

l_media_and_video.pdf

72 https://www.law360.com/articles/1213180/sens-want-tiktok-investigated-for-national-securityCase: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 46 of 120 PageID #:1918
46

201. The Committee on Foreign Investment in the United States (“CFIUS”) is an interagency committee of the United States government that reviews the national security implications 

of foreign investments in United States companies or operations. Chaired by the United States 

Secretary of the Treasury, CFIUS includes representatives from 16 United States departments and 

agencies, including the Defense, State, Commerce and Homeland Security departments. CFIUS is 

reviewing Defendant Beijing ByteDance’s acquisition of Defendants Musical.ly and Musical.ly, 

Inc.73

202. Additionally, the Senate Judiciary Subcommittee on Crime and Terrorism held a 

hearing in November 2019 that Defendant TikTok, Inc. declined to attend although it had been 

invited. The Chairman, Senator Josh Hawley, stated in opening remarks that: “TikTok should 

answer ... to the millions of Americans who use their product with no idea of its risks.”74 Chairman

Hawley also told reporters that: “The idea that TikTok is not sharing data, is not taking direction 

from Beijing, that just does not appear to be true.”75

203. Indeed, the risk that Defendants sends TikTok user data to the Chinese government 

is so great that the U.S. Army has banned the app on government-owned devices. That decision 

was based on concerns specific to Defendants and their close relationship to the Chinese 

government. The Army banned the TikTok app despite the fact that it had been using it for 

recruiting purposes until it realized the risk.76 The U.S. Navy, Marines, Air Force and Coast Guard, 

threats; https://www.cotton.senate.gov/?p=press_release&id=1239.

73 https://www.washingtonpost.com/technology/2019/11/05/inside-tiktok-culture-clash-whereus-views-about-censorship-often-were-overridden-by-chinese-bosses/.

74 https://thehill.com/policy/technology/469114-tiktok-faces-lawmaker-anger-over-china-ties.

75 https://thehill.com/policy/technology/469114-tiktok-faces-lawmaker-anger-over-china-ties.

76 https://www.businessinsider.com/us-government-agencies-have-banned-tiktok-app-2020-2

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 47 of 120 PageID #:1919
47

as well as the Department of Defense and the Transportation Security Administration have 

likewise banned the TikTok app due to the risk that user data is being sent to China.77

204. Recognizing the serious ongoing threat posed by TikTok, prominent U.S. Senators 

wrote to the FTC on May 29, 2020 that, “[f]aced with compelling evidence that this wildly popular

social media platform is blatantly flouting binding U.S. privacy rules, the FTC should move 

swiftly to launch an investigation and forcefully hold violators accountable for their conduct.”

205. The U.S. Department of Defense recently expressed concern over TikTok’s 

“popularity with Western users, and its ability to convey location, image and biometric data to its 

Chinese parent company, which is legally unable to refuse to share data with the Chinese 

Government,” going so far as to issue an internal memo to encourage its employees to avoid 

installing the app.78

2. Defendants unpersuasively deny they transfer TikTok users’ private 

and personally identifiable data and content to the Chinese 

Government.

206. In July 2019, amid growing scrutiny, Defendant TikTok, Inc. retained consultants 

who opined that there is “no indication” that the Chinese government accessed TikTok users’ 

data.79 But the lead consultant admitted that the review and analysis was limited to a narrow and 

recent four-month period: “He added that in the analysis from July [2019] to October [2019], which 

included interviews with TikTok employees and a review of the app’s underlying computer code, 

77 https://www.businessinsider.com/us-government-agencies-have-banned-tiktok-app-2020-2#1-

the-navy-banned-tiktok-from-government-devices-1; https://www.engadget.com/2020-01-04-

nearly-whole-us-military-bans-tiktok.html

78 https://www.inc.com/jason-aten/the-department-of-defense-is-warning-people-not-to-usetiktok-over-national-security-concerns.html.

79 https://www.washingtonpost.com/technology/2019/11/05/inside-tiktok-culture-clash-whereus-views-about-censorship-often-were-overridden-by-chinese-bosses/.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 48 of 120 PageID #:1920
48

his team found no way TikTok could send data to China during those months.”80 And, the 

consultants did not address whether TikTok user data could be “accessed from,” as opposed to 

“sent to,” China.

207. Defendant TikTok, Inc. also issued a public statement in which it represented: 

“First, let’s talk about data privacy and security. We store all TikTok U.S. user data in the United 

States, with backup redundancy in Singapore. Our data centers are located entirely outside of 

China, and none of our data is subject to Chinese law.”81

208. This public statement is carefully couched in the present tense and studiously 

avoids mention of past practices. In fact, the statement does not actually say that no private and 

personally identifiable user data and content is transferred to China. Rather, it says that private and 

personally identifiable user data and content is stored in the United States (but not necessarily 

exclusively in the United States) and that Defendants’ current data centers are located outside 

China (but not whether these data centers transfer private and personally identifiable user data to 

China or make it accessible there).

209. Even Defendant TikTok, Inc.’s February 2019 Privacy Policy, which is not viewed 

by users in the ordinary course, states that “[w]e may share your information with a parent, 

subsidiary, or other affiliate of our corporate group.” Although this language is ambiguous, it 

apparently “means it would include China-based ByteDance.”82 Accordingly, Defendant TikTok, 

Inc.’s public statement (above) and its February 2019 Privacy Policy are, at best, highly 

80 https://www.nytimes.com/2019/11/01/technology/tiktok-national-security-review.html.

81 https://newsroom.tiktok.com/en-us/statement-on-tiktoks-content-moderation-and-datasecurity-practices.

82 https://www.cnbc.com/2019/07/25/china-camera-apps-may-open-up-user-data-to-beijinggovernment-requests.html.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 49 of 120 PageID #:1921
49

misleading.

D. Transfers Of Private And Personally Identifiable User Data And Content

From TikTok Users To China Without Notice Or Consent.

1. The TikTok app secretly transfers private and personally identifiable 

user data and content to servers in China.

210. On November 15, 2020, CBS News 60 Minutes published an investigative report 

entitled “Is TikTok a Harmless App or a Threat to U.S. Security: It’s billed itself as ‘the last sunny 

corner on the internet,’ but is TikTok really a tool for China to obtain troves of data on 

Americans?”

211. The report included discussions between CBC correspondent Bill Whittaker and

Klon Kitchen, who spent 15 years working for the U.S. intelligence community, including the 

CIA, and is now director of technology policy at the Heritage Foundation; Kara Frederick, who 

helped set up Facebook’s counterterrorism program after spending six years at the Pentagon, the 

National Security Agency, and in the armed forces; U.S. Senator and former Missouri Attorney 

General Josh Hawley; and TikTok interim CEO Vanessa Pappas.

212. In the report, Mr. Kitchen states, inter alia:

What makes TikTok particularly concerning is its relationship with 

the Chinese Communist Party in Beijing, the government of China. 

The Chinese have fused their government and their industry together 

so that they cooperate to achieve the ends of the state.

* * *

Imagine you woke up tomorrow morning and you saw a news report 

that China had distributed 100 million sensors around the United 

States, and that any time an American walked past one of these 

sensor, this sensor automatically collected off of your phone your 

name, your home address, your personal network, who you're 

friends with, your online viewing habits and a whole host of other 

pieces of information. Well, that's precisely what TikTok is. It has 

100 million U.S. users, it collects all of that information.

And more, like many U.S. social media companies, TikTok asks 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 50 of 120 PageID #:1922
50

users for access to their cameras, microphones, photos, videos, and 

contacts. More obscure data, like "keystroke patterns," are collected 

from everyone using the app.

213. Regarding keystrokes, Ms. Frederick stated: “The patterns and the rhythms of the 

way that you strike the keyboard, it can basically say, ‘This device belongs to this user.’ And you 

can do a lot with that if you are a foreign government. It's very, very invasive.”

214. Senator Hawley noted particular concerns stemming from TikTok’s ownership by 

Beijing ByteDance, “a Chinese parent company that has direct ties to the Chinese Communist 

Party. And we also know that under Chinese law, TikTok, ByteDance, the parent, is required to 

share data with the Chinese Communist Party.”

215. Affinity published an article entitled “TikTok is Scamming People & Stealing 

Information.” Quoting from a pre-2019 TikTok privacy policy, the article reports that “they store 

and process user data in United States of America, Singapore, Japan or to China.”83 The article 

also reports that Defendant TikTok, Inc. is “offering personal information to third parties and the 

Chinese government.”84

216. CNBC published an article entitled “China’s globally popular camera apps may 

open up user data to Beijing requests” in which it confirms that a TikTok privacy policy from 2018 

acknowledged transmission of private and personally identifiable user data and content to China: 

“TikTok’s 2018 privacy policy said the company can transfer international users’ data to China, 

according to archived versions of that web page.”85 Even Defendant TikTok, Inc.’s August 2018 

Privacy Policy, which is not seen by users and which by its own terms does not even apply to 

83 http://culture.affinitymagazine.us/tik-tok-is-scamming-people-stealing-information/.

84 http://culture.affinitymagazine.us/tik-tok-is-scamming-people-stealing-information/.

85 https://www.cnbc.com/2019/07/25/china-camera-apps-may-open-up-user-data-to-beijinggovernment-requests.html.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 51 of 120 PageID #:1923
51

United States users, states: “We will also share your information with any member or affiliate of 

our group, in China, for the purposes set out above, to assist in the improvement or optimisation 

of the Platform, ... increase user numbers, development, engineering and analysis of information 

or for our internal business purposes ....”

217. Quartz published an article by David Carroll entitled “Is TikTok a Chinese 

Cambridge Analytica data bomb waiting to explode?” Mr. Carroll is an associate professor at the 

Parsons School of Design in New York, and in 2017 he sued Cambridge Analytica in the United 

Kingdom. In his Quartz article, Mr. Carroll quoted from Defendant TikTok, Inc.’s August 2018 

Privacy Policy that reveals that private and personally identifiable user data and content is

transferred to China.86 Mr. Carroll further reported that, in emails between him and Defendant 

TikTok, Inc. in March and April 2019, Defendant TikTok, Inc. (i) confirmed that, at least prior to 

February 2019, U.S. TikTok user data may have been processed in China; and (ii) provided 

confusing answers about what happened after that, including that U.S. TikTok user data may have 

continued to be processed by systems operated by “one of our China registered entities,” and may 

exist there in some form, even where such user data is stored elsewhere.87

218. The New York Times has reported that a source “said the American government had 

evidence of the [TikTok] app sending data to China.”88

219. That explains why the Defense Department, Navy, Army, Marines, Air Force,

Coast Guard and Transportation Security Administration have taken the extraordinary step of 

prohibiting their members from using the TikTok app on any government-issued devices, and have 

86 https://qz.com/1613020/tiktok-might-be-a-chinese-cambridge-analytica-scale-privacy-threat/.

87 https://qz.com/1613020/tiktok-might-be-a-chinese-cambridge-analytica-scale-privacy-threat/.

88 https://www.nytimes.com/2019/11/01/technology/tiktok-national-security-review.html.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 52 of 120 PageID #:1924
52

advised that their children also remove the TikTok app from their devices.89 United States Senators 

also have proposed a bill banning federal employees from using the TikTok app on governmentissued phones because it “presents a major security risk.”90

a. Evidence of post-February 2019 transfers.

220. Even after Defendant TikTok, Inc. adopted its February 2019 Privacy Policy, the 

TikTok app secretly transferred private and personally identifiable user data and content to China 

where, under Chinese law, it is subject to collection and use by the Chinese government. 

Specifically, as Plaintiffs’ investigation reveals, Defendants used the TikTok app to transfer

private and personally identifiable user data and content to the following two servers in China as 

recently as April 2019: (i) bugly.qq.com and (ii) umeng.com.

221. Private and personally identifiable TikTok user data and content transferred to 

bugly.qq.com as recently as April 2019 includes at least the following items: (i) the OS version; 

(ii) the mobile device model; (iii) the WiFi MAC address; (iv) the hardware serial number; (v) the 

device ID and (vi) the IP address. Private and personally identifiable TikTok user data and content

transferred to umeng.com as recently as April 2019 includes these same six items, plus at least the 

following item: (vii) the number of bytes users’ mobile devices have uploaded and downloaded. 

b. Evidence of pre-February 2019 transfers.

222. Plaintiffs’ investigation further reveals that the TikTok app transferred private and 

personally identifiable TikTok user data and content to various servers in China prior to the 

February 2019 Privacy Policy, including to at least the following servers: (i) musemuse.cn; (ii) 

zhiliaoapp.com; (iii) mob.com; and (iv) umeng.com.

89 https://www.wsj.com/articles/u-s-military-bans-tiktok-over-ties-to-china-11578090613.

90 https://www.reuters.com/article/us-usa-china-tiktok/us-senators-seek-to-ban-federalemployees-from-using-tiktok-on-their-phones-idUSKBN20Z1E4.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 53 of 120 PageID #:1925
53

223. The private and personally identifiable TikTok user data and content transferred to 

one or more of these four China-based servers includes User/Device Identifiers. Additional private 

and personally identifiable TikTok user data and content transferred to one or more of these four 

China-based servers includes: (i) a list of the other apps installed on users’ mobile devices; and (ii) 

more specific location data.

224. Such information reveals TikTok users’ precise physical location, including 

possibly indoor locations within buildings, and TikTok users’ apps that possibly reveal mental or 

physical health, religious views, political views, and sexual orientation.

2. Defendants’ privacy policies do not constitute notice of or consent to 

the transfer of private and personally identifiable TikTok user data 

and content to servers in China.

225. TikTok users do not knowingly consent to Defendants’ privacy policies because 

notice and warnings of the privacy policies are not adequately displayed, as discussed above. 

Additionally, many provisions of the privacy policies are ambiguous, providing inadequate notice 

of what private and personally identifiable user data and content is taken and where it is being sent. 

Even scholars with expertise in such matters, such as Mr. Carroll (supra ¶ 217), cannot discern 

what is being taken and where it is going. Certainly, ordinary TikTok users cannot be expected to 

understand such baffling “disclosures.” This ambiguity further renders the notice inadequate to 

infer knowing user consent.

226. In addition to the above-stated deficiencies, privacy policy provisions stating that 

certain TikTok user data and content may be sent to servers in China is contradicted by Defendants’

public and misleading assurances that no such transfers occur. Moreover, TikTok users whose data 

and content is sent before they even have an opportunity to sign-up and create an account do not 

actually or constructively receive notice, and therefore cannot be deemed to have assented to, such 

transfers to China.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 54 of 120 PageID #:1926
54

3. The China-based tech giants also possess TikTok users’ private and 

personally identifiable data and content while they work cooperatively 

with the Chinese Government.

227. The bugly.qq.com server is owned and operated by China-based tech giant Tencent 

Holdings Limited (“Tencent”), and the umeng.com server is owned and operated by another 

China-based tech giant Alibaba Holding Group Limited (“Alibaba”). Tencent and Alibaba thus 

possess TikTok users’ private and personally identifiable data and content. Such data transfers to

Tencent and Alibaba servers were accomplished through Tencent and Alibaba source code that 

Defendants embedded within the TikTok app.

228. Also embedded within the TikTok app is source code from China-based tech giant 

Baidu, Inc. (“Baidu”) as well as source code from a China-based software development kit 

(“SDK”) known as Igexin. The Igexin SDK is notorious for causing the removal of some 500 apps

from the Google play store in 2017 after it was discovered that Igexin constituted a “secret 

backdoor” that allowed its operators “to install a range of spyware.”91 Specifically, Igexin “could 

update the app to include spyware at any time, with no warning. The most serious spyware installed 

on phones were packages that stole call histories, including the time a call was made, the number 

that placed the call, and whether the call went through. Other stolen data included GPS locations, 

lists of nearby Wi-Fi networks, and lists of installed apps.”92

229. Baidu, Alibaba, and Tencent – popularly known by the acronym “BAT” – are 

“China’s original tech titans”93 and dominate the fields of artificial intelligence, social media, and 

91 https://arstechnica.com/information-technology/2017/08/500-google-play-apps-with-100-

million-downloads-had-spyware-backdoor/.

92 https://arstechnica.com/information-technology/2017/08/500-google-play-apps-with-100-

million-downloads-had-spyware-backdoor/.

93 https://www.forbes.com/sites/rebeccafannin/2019/08/23/baidu-alibaba-tencent-clash-to-leadchinas-tech-future-while-a-new-b-arises/#18cc42e414d0.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 55 of 120 PageID #:1927
55

the internet in China. The private and personally identifiable TikTok user data and content they 

possess may well be used by the Chinese government in the future, if it has not already.

230. BAT routinely assist the Chinese government in the surveillance and control of its 

people through biometrics. “Biometric surveillance powered by artificial intelligence is 

categorically different than any surveillance we have seen before. It enables real-time location 

tracking and behavior policing of an entire population at a previously impossible scale.”94 The 

Chinese government is taking full advantage of China-based technology corporations like BAT to 

assist: “Beijing is embracing technologies like facial recognition and artificial intelligence to 

identify and track 1.4 billion people. It wants to assemble a vast and unprecedented national 

surveillance system, with crucial help from its thriving technology industry. ... China has become 

the world’s biggest market for security and surveillance technology, with analysts estimating the 

country will have almost 300 million cameras installed by 2020. Chinese buyers will snap up more 

than three-quarters of all servers designed to scan video footage for faces ....”95

231. The Chinese government relies on China-based technology companies like BAT to 

assist in government investigations of criminal activity and political dissent, as well as surveillance 

activities: “The Chinese police ‘request data from Alibaba for their own investigations, ... tapping 

into the trove of information the tech giant collects through its e-commerce and financial payment 

networks. ... Companies including Alibaba [], Tencent [], and Baidu [] are required to help China’s 

government hunt down criminal suspects and silence political dissent. Their technology is also 

being used to create cities wired for surveillance. ... Apple disclosed that more than 35,000 user 

accounts were affected by 24 Chinese law-enforcement requests in the first half of this year [2017], 

94 https://www.buzzfeednews.com/article/evangreer/dont-regulate-facial-recognition-ban-it.

95 https://www.nytimes.com/2018/07/08/business/china-surveillance-technology.html.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 56 of 120 PageID #:1928
56

many in connection with fraud investigations. It said it provided information on about 90% of 

them. Chinese companies don’t release any information on the number of requests from the 

government, the nature of the requests or the compliance rate.’”96

232. The Chinese government’s use of BAT to sort and analyze information, including 

information gathered from smartphones, is also well documented: “Along with access to online 

data, China’s government wants something else from tech companies – the cloud computing 

prowess to sort and analyze information. China wants to crunch data from surveillance cameras, 

smartphones, government databases and other sources to create so-called smart cities and safe 

cities. ... Police now work with Alibaba to use surveillance footage and data processing to identify 

‘persons of interest’ and keep them out, local police official Dai Jinming said at a recent conference 

sponsored by Alibaba. Tencent is working with police in the southern city of Guangzhou to build 

a cloud-based ‘early-warning system’ that can track and forecast the size and movement of crowds, 

according to a statement from the Guangzhou police bureau.”97

233. The Wall Street Journal has reported on the significant patronage that BAT receive 

from the Chinese government, the growing number of tech entrepreneurs who have become 

members of the legislature under President Xi Jinping (including, for example, Tencent’s Tony 

Ma), and BAT’s pledges of loyalty to the Chinese government.98 “‘The government is always the 

boss and the tech firms are there to serve the goals of the Chinese government.’”99

96 https://www.wsj.com/articles/chinas-tech-giants-have-a-second-job-helping-the-governmentsee-everything-1512056284.

97 https://www.wsj.com/articles/chinas-tech-giants-have-a-second-job-helping-the-governmentsee-everything-1512056284.

98 https://www.wsj.com/articles/the-godfathers-of-chinese-tech-get-an-offer-they-cant-refuse1520510404.

99 https://www.wsj.com/articles/the-godfathers-of-chinese-tech-get-an-offer-they-cant-refuse1520510404.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 57 of 120 PageID #:1929
57

234. Defendant Beijing ByteDance is emerging as a threat to BAT’s exclusive status:

“there’s a new B in the BAT trio on the horizon: the world’s highest-valued unicorn, ByteDance 

....”100 Like BAT, Defendant Beijing ByteDance is subject to the same cybersecurity laws 

mandating cooperation with the Chinese government that are described in Senator Schumer and 

Senator Cotton’s letter. 

235. Senator Hawley, according to the Wall Street Journal, described the resulting threat 

to TikTok users by stating: “all it takes is one knock on the door of their parent company 

[Defendant Beijing ByteDance], based in China, from a Communist Party official for that data 

[from Defendant TikTok, Inc.] to be transferred to the Chinese government’s hands, whenever 

they need it.”101 In the same Wall Street Journal article, a former TikTok employee from the Los 

Angeles office stated that: “We’re a Chinese company ... We answer to China.”102

236. A Washington Post opinion piece entitled “Could TikTok allow China to export 

repression?” describes the danger to TikTok users in the United States if Defendants provide such 

users’ private and personally identifiable data and content to the Chinese government: “TikTok’s 

leaders protest that they store local information locally, so whatever data the company has on the 

behavioral patterns or personal attributes of some of the most vulnerable American citizens are not 

‘subject to Chinese law.’ But it’s reasonable to wonder whether TikTok might not comply with 

targeted intelligence requests from the repressive regime ruling over its parent company 

ByteDance. TikTok’s younger users will be voting in the coming years; down the line, they may 

100 https://www.forbes.com/sites/rebeccafannin/2019/08/23/baidu-alibaba-tencent-clash-to-leadchinas-tech-future-while-a-new-b-arises/#18cc42e414d0.

101 https://www.wsj.com/articles/tiktok-looking-at-ways-to-shake-off-its-ties-to-china11574073001.

102 https://www.wsj.com/articles/tiktok-looking-at-ways-to-shake-off-its-ties-to-china11574073001.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 58 of 120 PageID #:1930
58

hold positions of power. A trove of their information is a valuable asset.”103

237. The Wall Street Journal, in an article entitled “U.S. Orders Chinese Firm to Sell 

Dating App Grindr Over Blackmail Risk,” also has reported on the dangers Americans face from 

the Chinese government’s accumulation of their private and personally identifiable data and 

content, including blackmail and other sinister scenarios: “U.S. national-security experts said 

Chinese government knowledge of an individual’s usage of Grindr could be used in certain cases 

to blackmail U.S. officials and others with security clearances, such as defense contractors, and 

force them to provide information or other support to China. They have also envisioned more 

elaborate scenarios. For example, one could use Grindr’s location data to discern that a certain 

user works at a telecommunications firm and pays regular visits to the same building in Northern 

Virginia that intelligence officials frequent. Chinese-intelligence officials could then determine 

that that individual is the telecommunications firm’s intelligence liaison, and they would know 

both whom to target and how to threaten that person with potentially compromising information.

... The risk has grown as the Chinese government acquires more large data sets through hacking 

and other means, allowing it to build databases with detailed profiles of targets.”104

VI. DEFENDANTS’ THEFT OF TIKTOK USER BIOMETRICS.

A. The Illinois Biometric Information Privacy Act Regulates Face Geometry 

Scans, Voiceprints And Information Derived Therefrom.

238. In 2008, Illinois enacted the Biometric Information Privacy Act (“BIPA”), 740 

ILCS 14/1, et seq. This was due to the “very serious need [for] protections for the citizens of 

Illinois when it [comes to their] biometric information.” Illinois House Transcript, 2008 Reg. Sess. 

103 https://www.washingtonpost.com/opinions/global-opinions/could-tiktok-allow-china-toexport-repression/2019/11/02/1729f038-fa79-11e9-8906-ab6b60de9124_story.html.

104 https://www.wsj.com/articles/u-s-orders-chinese-company-to-sell-grindr-app-11553717942.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 59 of 120 PageID #:1931
59

No. 276. The Illinois Legislature recognized the importance of protecting the privacy of 

individuals’ biometric data, finding that “[b]iometrics are unlike other unique identifiers that are 

used to access finances or other sensitive information.” 740 ILCS 14/5(c). “For example, social 

security numbers, when compromised, can be changed. Biometrics, however, are biologically 

unique to the individual; therefore, once compromised, the individual has no recourse [and] is at 

heightened risk for identity theft ....” Id.

239. BIPA thus focuses on “biometric identifiers” and “biometric information.” 

Biometric identifiers consist of “a retina or iris scan, fingerprint, voiceprint, or scan of hand or 

face geometry.” 740 ILCS 14/10. A “scan” under BIPA means to examine by observation or 

checking, or systematically in order to obtain data especially for display or storage. In re Facebook 

Biometric Information Privacy Litigation, 2018 WL 2197546, *3 (N.D. Cal. May 14, 2018). 

“Geometry” under BIPA is the relative arrangement of parts or elements. Id. Neither the term 

“scan” nor the term “geometry” require “actual or express measurements of spatial quantities like 

distance, depth, or angles.” Id. Biometric information constitutes “any information, regardless of 

how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used 

to identify an individual.” 740 ILCS 14/10.

B. Defendants Unlawfully Collect, Use And Profit From TikTok User 

Biometrics, Face Geometry Scans, Voiceprints And Information Derived 

Therefrom.

240. Defendants’ unlawful collection, possession, storage, dissemination, use and 

profiting from biometric identifiers, e.g., face geometry scans of TikTok users, and the biometric 

information derived therefrom, takes three forms.

241. First, Defendants’ BIPA and other biometrics-related violations are established by 

the functionality and code of the TikTok app itself. 

242. This functionality and code includes: (a) content recommendations based on 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 60 of 120 PageID #:1932
60

TikTok users’ race/ethnicity and age; (b) scans of face geometry to determine TikTok users’ age; 

(c) censoring video content to remove people Defendants consider “ugly”; (d) the augmented 

reality feature that scans face geometry while processing users’ videos; (e) code for deepfake 

videos; and (f) code for age, race/ethnicity and emotion recognition.

243. Second, Defendants’ BIPA and other biometrics-related violations are further 

established by their ongoing work in China, which includes: (a) the application of facial 

recognition technology105 to TikTok users’ videos by highly-trained engineers skilled in computer 

vision, convolutional neural network and machine learning; (b) patent applications for face, voice, 

age, race/ethnicity and emotion recognition technologies; and (c) the publicly known functionality 

of Douyin that allows its users to perform facial recognition on faces selected by such users from 

other users’ videos.

244. Third, Defendants’ BIPA and other biometrics-related violations are also 

established by Defendants’ legal and political obligations to accumulate and share vast troves of 

data, including biometrics, in order to assist the Chinese government in meeting two crucial and 

intertwined state objectives: (a) world dominance in artificial intelligence; and (b) population 

surveillance and control.

1. Defendants’ BIPA and other biometrics-related violations are 

evidenced by the TikTok app’s functionality and code.

245. There are at least six specific categories of functions and code within the TikTok 

app that reveal BIPA violations: (1) the race/ethnicity and age-based content recommendations; 

105 Facial recognition “is a technology capable of identifying or verifying a person from a digital 

image or a video frame from a video source. There are multiple methods in which facial 

recognition systems work, but in general, they work by comparing selected facial features from a 

given image with faces within a database.” See

https://en.wikipedia.org/wiki/Facial_recognition_system.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 61 of 120 PageID #:1933
61

(2) the scans to determine age; (3) the removal of so-called “ugly” videos; (4) the augmented 

reality feature; (5) the deepfake video code; and (6) the age, race/ethnicity and emotion recognition 

code.106 These also evidence violations of the other statutory, constitutional and common law 

claims set forth herein.

246. That the TikTok app violates BIPA and other laws is highlighted by comments from 

a “Bytedance representative” who confessed to The Verge that “TikTok makes use of the 

company’s AI technologies in various ways, from facial recognition for the filters through to the 

recommendation engine in the For You feed. ... We build intelligent machines that are capable of 

understanding and analyzing text, images and videos using natural language processing and 

computer vision technology. This enables us to serve users with the content that they find most 

interesting ....’”107

247. Similarly, Marketing Technology Insights reported on Defendants’ use of facial 

recognition technology in the TikTok app in violation of BIPA and other laws, stating that 

Defendant TikTok, Inc. and the TikTok app “deploy[] AI and Face Recognition technology to 

analyze user’s interests and preferences through their interactions with the content, and display a 

personalized content feed to each user.”108

a. Race/ethnicity and age-based content recommendations.

248. Marc Faddoul, a researcher at the University of California at Berkeley who studies 

artificial intelligence, conducted an experiment in or about February 2020 that revealed the TikTok 

106 These allegations also support the other statutory, constitutional, and common law causes of 

action herein.

107 https://www.theverge.com/2018/11/30/18107732/bytedance-valuation-tiktok-china-startup

(emphasis added).

108 https://martechseries.com/mts-insights/staff-writers/pay-attention-to-tiktok-content/

(emphasis added).

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 62 of 120 PageID #:1934
62

app recommends content based in part on race/ethnicity and age information that it gleans from 

TikTok users’ digital face images. Buzzfeed described his findings: “In the app, when a person 

follows a new account, they can click an arrow that then recommends other accounts to follow. 

Faddoul noticed that when he did this, the recommended accounts tended to look just like 

whoever he’d just followed — right down to ethnicity and hair color.”109

249. Recode also reported on Faddoul’s research in its article entitled “There’s 

Something Strange About TikTok Recommendations”:

When artificial intelligence researcher Marc Faddoul joined TikTok 

a few days ago, he saw something concerning: When he followed a 

new account, the profiles recommended by TikTok seemed eerily, 

physically similar to the profile picture of the first account. 

Following a young-looking blond woman, for instance, yielded 

recommendations to follow more young-looking blond women. ...

Following black men led to recommendations to follow more black 

men. Following white men with beards produced recommendations 

for more white men with beards. Following elderly people spawned 

recommendations for other elderly people. And on and on. ...

Faddoul also told Recode that he believes it’s more likely that 

TikTok is using something he calls automatic featurization. This 

type of recommendation algorithm could take “signals” from profile 

images to find profile pictures with similar attributes. These kinds 

of signals would be correlations between the pictures, which could 

correspond to anything from skin color to having a beard. The 

algorithm is simply looking for similarities in the photos or profiles. 

...

“What I suspect is happening is that TikTok is featurizing the profile 

picture,” he says, “and using these features in the recommendation 

engine.”110

109 https://www.buzzfeednews.com/article/laurenstrapagiel/tiktok-algorithim-racial-bias.

110 https://www.vox.com/recode/2020/2/25/21152585/tiktok-recommendations-profile-lookalike.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 63 of 120 PageID #:1935
63

b. Face scans to determine age.

250. Defendants also scan face images taken from TikTok user videos in order to 

determine TikTok users’ age. The Wall Street Journal has reported that “TikTok has built an 

artificial intelligence tool that scans faces in videos to estimate users’ ages.”111 Both Faddoul’s 

research and this Wall Street Journal article are consistent with evidence of Defendants’ work in 

China on TikTok user videos as well as their patent applications in China for face, voice, age, 

race/ethnicity and emotion recognition technologies (below).

c. Removal of videos of so-called “ugly” people.

251. Public reporting indicates that “the makers of TikTok ... instructed moderators to 

suppress posts created by users deemed too ugly .... Today, The Intercept and The Intercept Brasil

are publishing two internal TikTok moderation documents .... One ... describes algorithmic 

punishments for unattractive and impoverished users. The documents appear to have been 

originally drafted in Chinese and later — at times awkwardly — translated into English for use in 

TikTok’s global offices.”112 It appears therefore, that Defendant TikTok, Inc. uses artificial 

intelligence technology in its Culver City office to review and flag user content. Given the presence 

of this AI technology and the sheer volume of TikTok user videos that are reviewed for “ugliness,” 

Defendant TikTok, Inc. may be using facial recognition technology to identify and remove such 

users’ videos.

d. Augmented reality features.

252. The TikTok app uses an advanced video editor and camera face filters. Employing 

this technology, TikTok users edit their videos to, among other things, morph their face into 

111 https://www.wsj.com/articles/tiktok-wants-to-grow-up-but-finds-it-tough-to-keep-kids-out11581858006.

112 https://theintercept.com/2020/03/16/tiktok-app-moderators-users-discrimination/.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 64 of 120 PageID #:1936
64

another face; change the size, shape, height and width of their face; change particular features of 

their face (e.g., eyes, ears, nose, lips, mouth, cheeks), including the size and shape of such facial 

features; and so on. Users thereby create videos in which their faces and specific facial features 

take on cartoonish dimensions and appearances, and in which they can appear older, etc.

253. This functionality is a form of augmented reality (“AR”).113 To perform AR, the 

TikTok app examines, detects and localizes the face and the arrangement of its various parts (e.g., 

the eyes, ears, nose, lips, mouth, cheeks) relative to the other parts, and then also tracks the face 

and its various parts (and their relative arrangement) while in motion.

254. The following relevant code is located within the TikTok app: “FaceDetectManager”; 

“faceDetectMaxTime”; “faceDetectMinTime”; “Requirement_Face_3D_Detect”; “Requirement_Face_Detect”; 

“Requirement_Face_Track”; “face_track.model”; “maxScanTime”; “minScanTime”; and “faceID”. Additional code 

for pitch, yaw and roll – “the three dimensions of movement when an object moves through a 

medium”114 – is within the TikTok app as well.

255. This functionality and code reveal Defendants’ use of face geometry scans on 

TikTok users. While it is currently unclear whether Defendants upload such face geometry scans 

from TikTok users’ mobile devices, in addition to performing separate face geometry scans at the 

server level, this functionality and code demonstrate Defendants’ technological ability and 

113 AR “is an interactive experience of a real-world environment where the objects that reside in 

the real world are enhanced by computer-generated perceptual information .... AR can be 

defined as a system that fulfills three basic features: a combination of real and virtual worlds, 

real-time interaction, and accurate 3D registration of virtual and real objects. ... This experience 

is seamlessly interwoven with the physical world such that it is perceived as an immersive aspect 

of the real environment. In this way, augmented reality alters one’s ongoing perception of a realworld environment .... With the help of advanced AR technologies (e.g. adding computer vision, 

incorporating AR cameras into smartphone applications and object recognition) the information 

about the surrounding real world of the user becomes interactive and digitally manipulated.” See

https://en.wikipedia.org/wiki/Augmented_reality.

114 https://simple.wikipedia.org/wiki/Pitch,_yaw,_and_roll.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 65 of 120 PageID #:1937
65

willingness to perform such scans on TikTok users.

e. Code for deepfake videos.

256. There is code within the TikTok app, as well as within Douyin, for performing 

facial recognition. TechCrunch reported that there is “Face Swap” code within the TikTok app for 

“life-like deepfakes technology.” It “asks users to take a multi-angle biometric scan of their face, 

then choose from a selection of videos they want to add their face to and share.”115 Defendants 

admitted that such code is present in the TikTok app, but denied its use. A TikTok spokesperson 

“insisted that ‘after checking with the teams I can confirm this is definitely not a function in TikTok 

....’ They later told TechCrunch that ‘the inactive code fragments are being removed to eliminate 

any confusion,’ which implicitly confirms that Face Swap code was found in TikTok.”116

257. That the “Face Swap” code is present in the TikTok app demonstrates Defendants’ 

technological capacity to perform facial recognition on TikTok users. 

f. Code for age, race/ethnicity, and emotion recognition.

258. There is additional code within the TikTok app designed to recognize users’ age, 

race/ethnicity, and emotions. The code separates race/ethnicity into at least four categories: “Blac” 

[sic.]; “Indian”; “White”; and “Yellow.” The code also distinguishes between at least seven 

different ranges of emotion: “Angry”; “Disgust”; “Fear”; “Happy”; “Neutral”; “Sad”; and 

“Surprise.” 

259. The age, race/ethnicity, and emotion recognition code within the TikTok app is 

consistent with Faddoul’s research (above) and also directly correlates to Defendants’ China-based 

work on TikTok user videos and patent applications (below).

115 https://techcrunch.com/2020/01/03/tiktok-deepfakes-face-swap/.

116 https://techcrunch.com/2020/01/03/tiktok-deepfakes-face-swap/.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 66 of 120 PageID #:1938
66

2. Defendants’ BIPA and other biometrics-related violations are further 

evidenced by Defendants’ China-based operations.

260. Defendants’ BIPA violations are further established by the China-based 

Defendants’ ongoing work in China, which includes: (a) the application of facial recognition 

technology to TikTok users’ videos by highly-trained engineers skilled in computer vision, 

convolutional neural network, and machine learning; (b) patent applications for face, voice, age, 

race/ethnicity, and emotion recognition technologies; and (c) the Douyin app’s functionality that 

allows its users to perform facial recognition on faces selected by such users from other users’ 

videos. These factors also evidence violations of the other statutory, constitutional, and common 

law claims set forth herein.

a. Defendants’ China-based team includes highly skilled 

computer vision, convolutional neural network, and machine 

learning engineers.

261. Defendants’ artificial intelligence work within China, which is closely tied to its 

United States operations, is among the most sophisticated in the world. “ByteDance has received 

accolades for being a top AI innovator from CBInsight who recognized the company on its 2018 

AI 100 List as well as from Fast Company, who placed it on its most innovative companies list. In 

2016, it founded its AI Lab, a research division led by Wei-Ying Ma, formerly of Microsoft 

Research Asia. The Lab’s primary focus has been on developing innovative technologies to 

enhance ByteDance’s content platforms.”117

262. Defendants have a team of engineers in cutting-edge fields such as computer 

117 https://www.forbes.com/sites/bernardmarr/2018/12/05/ai-in-china-how-buzzfeed-rivalbytedance-uses-machine-learning-to-revolutionize-the-news/#6579bada40db.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 67 of 120 PageID #:1939
67

vision,118 convolutional neural network (“CNN”),119 and machine learning,120 all of which are 

foundational to the face geometry scans that Defendants conduct on and/or derive from the Private 

Videos and the posted videos of TikTok users.

263. Defendants’ China-based engineering team includes, among others: (i) a research 

scientist focused on facial recognition, object detection, computer vision and machine learning 

who has worked for Defendants since 2018; (ii) a computer vision and image processing algorithm 

engineer who has worked for Defendants since 2017; (iii) a computer vision algorithm engineer 

who has worked for Defendants since 2019; (iv) a machine learning and neural network engineer 

118 Computer vision “is an interdisciplinary scientific field that deals with how computers can 

gain high-level understanding from digital images or videos. ... Computer vision tasks include 

methods for acquiring, processing, analyzing and understanding digital images .... The classical 

problem in computer vision, image processing, and machine vision is that of determining 

whether or not the image data contains some specific object, feature, or activity. ... • Object 

recognition (also called object classification) – one or several pre-specified or learned objects or 

object classes can be recognized, usually together with their 2D positions in the image or 3D 

poses in the scene. ... • Identification – an individual instance of an object is recognized. 

Examples include identification of a specific person’s face or fingerprint .... • Detection – the 

image data are scanned for a specific condition. ... Currently, the best algorithms for such tasks 

are based on convolutional neural networks. ... Several specialized tasks based on recognition 

exist, such as: • Content-based image retrieval – finding all images in a larger set of images 

which have a specific content. ... • Facial recognition.” See

https://en.wikipedia.org/wiki/Computer_vision#Recognition.

119 CNN “is a class of deep neural networks, most commonly applied to analyzing visual 

imagery. ... They have applications in image and video recognition, recommender systems, 

[and] image classification .... CNNs use relatively little pre-processing compared to other image 

classification algorithms. This means that the network learns the filters that in traditional 

algorithms were hand-engineered. This independence from prior knowledge and human effort in 

feature design is a major advantage.” See

https://en.wikipedia.org/wiki/Convolutional_neural_network#Image_recognition.

120 Machine learning “is the study of computer algorithms that improve automatically through 

experience. It is seen as a subset of artificial intelligence. Machine learning algorithms build a 

mathematical model based on sample data, known as “training data”, in order to make 

predictions or decisions without being explicitly programmed to do so. Machine learning 

algorithms are used in a wide variety of applications, such as ... computer vision, where it is 

difficult or infeasible to develop conventional algorithms to perform the needed tasks.” See

https://en.wikipedia.org/wiki/Machine_learning.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 68 of 120 PageID #:1940
68

who has worked for Defendants since 2017; (v) an algorithm engineer who focuses on video 

retrieval and who has worked for Defendants since 2018; and (vi) an algorithm engineer who has 

worked for Defendants since 2017.

b. Facial recognition technology applied to TikTok videos.

264. Wei-Ying Ma is a ByteDance Vice President in Beijing and has led the AI Lab 

since 2017. He is known for having developed a highly respected image retrieval system called 

NeTra, which is a tool for navigating very large image databases. Ma recently delivered a keynote 

speech at a Taipei Web Conference in which he acknowledged that Defendants use facial 

recognition technology and face geometry scans on their enormous and ever-growing database of 

face images from user videos. During his speech, Ma used visual representations that show facial 

recognition and face geometry scans being performed on specific regions of face images. Chinese 

language text accompanying the face images indicate the type of facial expression and the age of 

the individuals represented by the face images. English language notes to the side of the face 

images refer to “emotion analysis,” “object detection and tracking,” and “content-based 

recommendation.” Ma made the following representations during his speech while these face 

images, accompanied by the aforementioned Chinese language and English language statements, 

were visually presented on the screen:

We are actually receiving a huge number of video created by users

every day, so it’s at the hundreds of millions of video per day. 

Imagine the amount of computation and also video understanding 

we need to do here. And here just to give you a glimpse of all kinds 

of video understanding tasks we need to run, and let me show you 

for example, you just saw that video, and for video like that we 

actually do all kind of analysis. We need to automatically classify 

and also do a lot tagging and understand the structure inside the 

video and also run copyright infringement detecting and duplicate 

detection and also object detection and tracking. So based on this 

video, we convert this video into a structural representation, and 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 69 of 120 PageID #:1941
69

here just to give you one of the examples.

121

265. Defendants’ team of engineers in China also includes a computer vision and 

machine learning engineer who has worked for Defendants since 2018. His job responsibilities 

have included face/body detection and face attribute recognition, including specifically on TikTok 

users’ videos. 

266. Within China, Defendant Beijing ByteDance makes no secret of its processing and 

analysis of users’ videos from around the world. TechNode reported that one of its vice presidents 

publicly told a gathering that “ByteDance” required more chips to continue uploading, processing 

and analyzing its vast database of videos accumulated from around the world. This vice president 

stated that “‘Bytedance has the largest number of users in the world whose videos need to be 

analyzed and processed and uploaded, and we are purchasing a large number of chips.’”122

267. Defendants’ wealth of video recordings from TikTok users is critical to Defendants’ 

success in making the TikTok app one of the most popular in the world: “The [TikTok] app heavily 

utilizes AI that is trained on the vast quantity of video footage to understand the preferences of 

users, while also using machine learning to make creating, editing, and promoting the videos as 

easy as possible.”123

268. Indeed, “all of ByteDance’s products use artificial intelligence and machine 

learning to deliver content that users want. The company’s intelligent machines use computer 

vision and natural language processing technology to understand and analyze written content, 

images and videos. Then, based upon what the machines know about each user, they deliver the 

121 https://www.youtube.com/watch?v=2D29f4-J2mw (at 18:18 – 19:17).

122 https://technode.com/2018/04/24/bytedance-jinri-toutiao-ai-chips/ (emphasis added).

123 https://dzone.com/articles/the-data-thats-driving-chinas-hidden-champions (emphasis added).

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 70 of 120 PageID #:1942
70

content it believes each user would want. As a user interacts with the content by taps, swipes, time 

spent with each article, comments and more, large-scale machine learning and deep learning 

algorithms continue to learn about a user’s preferences to refine its content delivery for the future. 

The end result is a high-quality content feed based upon each user’s preferences and interests. As 

more content is accumulated by the system, the better the algorithms get to enhance the content 

experience.”124 As the United States National Security Adviser noted, Defendants are “getting 

facial recognition” on millions of Americans as well as mapping their relationships, and then 

sending all of this “intimate data” back to China for processing.

125

c. Face, age, race/ethnicity, and emotion recognition patent 

applications.

269. One of Defendants’ engineers in China stands out for his inventions that form the 

basis of numerous patent applications filed by Defendants’ sister company Beijing ByteDance 

Network Technology Co., Ltd. The underlying technology in these patent applications involves 

age, race, and emotion detection through face images, including those derived from videos. The 

specific patent applications include, among others, the following:

a. Facial image identifying method.126

b. Use of face images and a facial recognition model to determine ethnic 

information, to then determine race, to ultimately determine age.127

c. Use of face and body images, and a facial recognition model, to determine 

124 https://www.forbes.com/sites/bernardmarr/2018/12/05/ai-in-china-how-buzzfeed-rivalbytedance-uses-machine-learning-to-revolutionize-the-news/#6579bada40db (emphasis added).

125 https://www.forbes.com/sites/zakdoffman/2020/07/15/tiktok-trump-warning-facialrecognition-data-sends-china-ban/#493e38852dea

126 Publication No. WO2020037963A1.

127 Publication No. CN110046571A.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 71 of 120 PageID #:1943
71

age.128

d. Use of image data sets and audio data sets to determine age.129

e. Use of face images extracted from videos to determine age.130

f. Use of face images extracted from videos to determine age.131

g. Human facial expression recognition method.132

h. Use of face images extracted from videos to determine emotions based on 

expression recognition.133

i. Use of face images extracted from video segments to identify a face 

characteristic by parsing the face image.134

270. This same engineer was one of the inventors involved in two earlier patent 

applications filed by a Chinese university that concern face attribute recognition135 and a face 

verification method that determines whether faces in two images are the same or distinct.136

271. “TikTok’s owner, Beijing-based ByteDance, is a hit app factory that has spent the 

last decade learning how to use artificial intelligence, machine learning, and facial recognition to 

figure out what people like and serve them endless streams of entertainment tailored to their 

interests and emotions. Its apps are used by billions of people, including 1.45 billion global 

128 Publication No. CN109993150A.

129 Publication No. CN110321863A.

130 Publication No. CN110163170A.

131 Publication No. CN110188660A.

132 Publication No. CN110097004A.

133 Publication No. CN110175565A.

134 Publication No. CN110163171A.

135 Publication No. CN106203395B.

136 Publication No. CN106203533B.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 72 of 120 PageID #:1944
72

downloads for TikTok alone. The company has years of data informing it on how people think, 

feel and act, making it an expert on what makes people tick and how to persuade them to watch, 

share or like certain content.”137

d. Voiceprint patent applications.

272. Beijing ByteDance Network Technology Co., Ltd. filed additional patent 

applications for a method for voice extraction involving voiceprints,138 a voice recognition 

method,139 and an age recognition method based on audio.140 This is consistent with reporting that 

Defendant Beijing ByteDance “uses various AI technologies in its services [including] voice 

recognition ....”141 In fact, during Wei-Ying Ma’s recent keynote speech at a Taipei Web 

Conference (above), he discussed the use of audio to identify speakers and he published a slide 

during his speech entitled “Speaker Identification” that stated: “Detect identity, age, gender of 

speakers.”142

e. The Douyin app’s facial recognition function.

273. The Douyin app provides its users with an “in-video” search tool that uses facial 

recognition technology. Users of Douyin can press the “Search” button while a video is playing, 

drag a rectangle around the target face in the video, and cause the Douyin app to perform a search 

(based on the face in question) for other videos in which the targeted person appears.143 This 

137 https://www.bloomberg.com/news/newsletters/2019-10-29/worries-that-tiktok-is-a-threat-tonational-security-have-merit (emphasis added).

138 Publication No. CN110503961A.

139 Publication No. WO2019214628A1.

140 Publication No. CN110335626A.

141 https://medium.com/syncedreview/intel-and-bytedance-partner-on-ai-lab-b678036cbda4

(emphasis added).

142 https://www.youtube.com/watch?v=2D29f4-J2mw (at 30:04).

143 https://radiichina.com/tiktok-new-video-search-function-is-from-the-future/.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 73 of 120 PageID #:1945
73

subjects anyone using the Douyin app to “behind-the-scenes facial recognition analysis.”144 While 

U.S. TikTok users cannot access this feature, there is evidence that they are subject to the same 

behind-the-scenes facial recognition analysis, as discussed herein.

3. Defendants’ BIPA and other biometrics-related violations are also 

evidenced by their obligation to accumulate and share data, including 

biometrics, with the Chinese Government.

274. Defendants’ BIPA violations are further established by the China-based

Defendants’ legal and political obligations to accumulate and share data, including biometrics, in 

order to assist the Chinese government in meeting two crucial and intertwined state objectives: (a) 

world dominance in artificial intelligence; and (b) population surveillance and control.145

a. The Chinese Government’s plan to become the world leader in 

artificial intelligence.

275. In 2017, the Chinese government released its Next Generation Artificial 

Intelligence Development Plan, in which it set 2030 as the temporal goal for becoming the world 

leader in artificial intelligence. To ensure achievement of its artificial intelligence goal, the Chinese 

government selected the five leading technology companies as “national champions” and assigned 

them particular areas of research and development within the artificial intelligence field. In 

exchange, these companies receive government support, including access to finance, preferential 

contract bidding and sometimes market share protection. The list of “national champions” has 

grown to at least 15 in recent years.146

276. The United States government has taken notice. Last November, Congress’s 

National Security Commission on Artificial Intelligence, chaired by former Google CEO Eric 

144 https://futurism.com/the-byte/tiktok-facial-recognition (emphasis added).

145 This evidence also constitutes a basis for the other statutory, constitutional, and common law 

causes of action herein.

146 https://fortune.com/longform/tiktok-app-artificial-intelligence-addictive-bytedance-china/.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 74 of 120 PageID #:1946
74

Schmidt, published an interim report warning that China was outpacing the United States in 

artificial intelligence spending.147

b. The Chinese Government’s program of population surveillance 

and control.

277. The Chinese government’s monitoring of and control over its own population are 

well known. Most notable is its pervasive use of artificial intelligence-enabled cameras to conduct 

video surveillance of its population.148 As the South China Morning Post reported: “China’s goal 

of becoming a global leader in artificial intelligence (AI) is nowhere more manifested than in how 

facial recognition technology has become a part of daily life in the world’s second-largest 

economy. Facial recognition systems, which are biometric computer applications that 

automatically identify an individual from a database of digital images, are now being used 

extensively in areas such as public security, financial services, transport and retail across the 

country.”149 In fact, the Chinese government employs a variety of biometrics for population

surveillance and control: “In addition to voice recognition, there are facial and pupil recognition, 

gathering of DNA samples—building the world’s largest DNA database—and fingerprint 

scans.”150

c. Data accumulation, including biometrics, through China-based 

technology companies is a critical part of achieving the Chinese 

Government’s twin goals.

278. Artificial intelligence algorithms feed on data to learn and improve – thus, the more 

147 https://fortune.com/longform/tiktok-app-artificial-intelligence-addictive-bytedance-china/.

148 https://fortune.com/longform/tiktok-app-artificial-intelligence-addictive-bytedance-china/.

149 https://www.scmp.com/tech/start-ups/article/2133234/meet-five-chinese-start-ups-pushingfacial-recognition-technology.

150 https://vlifestyle.org/codec-news/?l=business/content-2254742-china-gathers-people-s-voicesnew-identification-technology-drawing-concerns.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 75 of 120 PageID #:1947
75

data the better the development of the algorithms driving the advance of the artificial 

intelligence.151 With better artificial intelligence comes more effective population surveillance and 

control.

279. To advance these interrelated goals, the Chinese government has worked hand in 

glove with China-based technology companies to accumulate and share data. For example, the 

China-based company Megvii, a leader in computer vision, has the world’s largest open source 

database (Face++) for training other facial recognition algorithms. It has reportedly used 

government data banks to help compile this training program.152 As another example, the Chinese 

government partnered with the China-based technology firm d-Ear Technologies to build a 

database of voiceprints for voice recognition purposes.153

280. “Private [China-based] corporations and the [Chinese] Communist Party’s security 

apparatus have grown together, discovering how the same data sets can both cater to consumers 

and help commissars calibrate repression. ... Many [China-based] tech firms make a point of hiring 

the relatives of high party officials, and a vast state database of headshots might be shared with a 

private firm to train new facial recognition software, while the firm’s trove of real-time user data 

might be offered to police, for a panoramic view of potential ‘troublemakers.’”154

281. Such data accumulation is not confined to China’s borders. For example, the 

Chinese government is compiling a tremendous storehouse of private and personally identifiable

data on ordinary Americans. Recently, Chinese government-sponsored hackers stole data

151 https://fortune.com/longform/tiktok-app-artificial-intelligence-addictive-bytedance-china/.

152 https://fortune.com/longform/tiktok-app-artificial-intelligence-addictive-bytedance-china/.

153 https://vlifestyle.org/codec-news/?l=business/content-2254742-china-gathers-people-s-voicesnew-identification-technology-drawing-concerns.

154 https://www.nytimes.com/interactive/2019/05/02/opinion/will-china-export-its-illiberalinnovation.html.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 76 of 120 PageID #:1948
76

belonging to approximately 500 million Marriott International guests. “[M]achine learning is 

yielding uses for large data sets that humans alone could not imagine – or even understand – given 

that machine learning can generate correlations among data that the machine itself can’t explain. 

... Beijing’s plan may be simply to vacuum up as much data like this as possible and then see what 

today’s machine learning—or, better yet, tomorrow’s machine learning—can do with it.”155

282. The lengths to which the Chinese government will go to obtain such data about 

ordinary Americans is further evidenced by other large-scale hacking schemes, including one 

involving 145 million Americans whose data was held by Equifax,156 and another involving 78 

million Americans whose data was held by Anthem.157 “The United States assessed that China 

was building a vast database of who worked with whom in national security jobs, where they 

traveled and what their health histories were, according to American officials. Over time, China 

can use the data sets to improve its artificial intelligence capabilities to the point where it can 

predict which Americans will be primed for future grooming and recruitment ....”158 “The hacks, 

security researchers said, were an extension of China’s evolving algorithmic surveillance system, 

which has greatly expanded over the past few years.”159

283. The Chinese government’s goal of obtaining private and personally identifiable 

data (including biometrics) of ordinary citizens throughout the world is also evidenced by the deal 

struck by China-based CloudWalk Technology in Africa. CloudWalk, with the Chinese 

government’s blessing, entered into a strategic partnership agreement with Zimbabwe to begin a 

155 https://www.justsecurity.org/62187/weapons-mass-consumerism-china-personal-information/.

156 https://www.nytimes.com/2020/02/10/us/politics/equifax-hack-china.html.

157 https://www.nytimes.com/2019/05/09/technology/anthem-hack-indicted-breach.html.

158 https://www.nytimes.com/2020/02/10/us/politics/equifax-hack-china.html.

159 https://www.nytimes.com/2019/05/09/technology/anthem-hack-indicted-breach.html.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 77 of 120 PageID #:1949
77

large-scale facial recognition program. With access to a database containing millions of 

Zimbabwean faces, CloudWalk and the Chinese government intend to train their algorithms in 

order to further improve their facial recognition capabilities. “With the largest surveillance system 

already in place, China is also building one of the world’s most comprehensive facial recognition 

databases. Rolling out the technology in a majority black population will allow CloudWalk to 

more clearly identify other ethnicities, getting ahead of US and European developers.”160

4. Defendants are obligated by Chinese law and politics to accumulate 

and secretly share their data, including biometrics, with the Chinese

Government.

284. Given the Chinese government’s illegal extraction of massive quantities of private 

and personally identifiable data (including biometrics) from hundreds of millions of ordinary 

Americans and others, there is no reason to believe that the Chinese government has refrained from 

extracting the same type of U.S. TikTok user data from Defendants. 

285. In fact, to access that data, there is no need to hack major U.S. corporations or the 

China-based technology companies, like Defendants, that have surreptitiously amassed such 

information on their own. 

286. That is because such China-based companies are required by law to secretly

provide that data to the government upon demand:

The message contained in each of China’s state security laws passed 

since the beginning of 2014 is clear: everyone is responsible for the 

party-state’s security. According to the CCP’s definition of state 

security, the Party’s political leadership is central. ... And the party 

expects Chinese people and citizens to assist in collecting 

intelligence. The Intelligence Law states ‘any organization and 

citizen shall, in accordance with the law, support, provide 

assistance, and cooperate in national intelligence work, and guard 

the secrecy of any national intelligence work that they are aware 

160 https://qz.com/africa/1287675/china-is-exporting-facial-recognition-to-africa-ensuring-aidominance-through-diversity/ (emphasis added).

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 78 of 120 PageID #:1950
78

of...’ Not only is everyone required to participate in intelligence 

work when asked, but that participation must be kept secret.161

287. In an article entitled “Take China’s TikTok App Security Threat Seriously,”

Bloomberg reported that many “Hong Kong protesters say that regardless of whether TikTok is 

censoring content or not, they fear posting on a social media site owned by ByteDance, a Beijing 

company that must hand over user information to Chinese authorities if asked, just like all its 

compatriots.”162

288. In fact, Defendants in this action – including even the two based in the United States 

(Defendants TikTok, Inc. and ByteDance, Inc.) – have objected to Plaintiff Misty Hong’s requests 

for the production of relevant documents in this lawsuit “to the extent they seek state secrets or 

any other information that cannot be disclosed without violating Chinese law, including the 

People’s Republic of China on Guarding State Secrets and/or Civil Procedure Law of the People’s 

Republic of China (“State Secrets”).” Defendants apparently interposed this “State Secrets” 

objection in order to comply with China’s Intelligence Law requirement that “[n]ot only is 

everyone required to participate in intelligence work when asked, but that participation must be 

kept secret.”163 This “State Secrets” objection flatly contradicts Defendant TikTok, Inc.’s 

misleading public statement that “none of our data is subject to Chinese law.”164

289. Defendant Beijing ByteDance has a particularly strong incentive to cooperate with 

the Chinese government. In 2018, China’s State Administration of Radio and Television, an arm 

161 https://capx.co/britain-must-avoid-being-sucked-into-huaweis-moral-vacuum/. See also

https://www.lawfareblog.com/beijings-new-national-intelligence-law-defense-offense.

162 https://www.bloomberg.com/news/newsletters/2019-10-29/worries-that-tiktok-is-a-threat-tonational-security-have-merit.

163 https://capx.co/britain-must-avoid-being-sucked-into-huaweis-moral-vacuum/.

164 https://newsroom.tiktok.com/en-us/statement-on-tiktoks-content-moderation-and-datasecurity-practices.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 79 of 120 PageID #:1951
79

of the Chinese Communist Party, ordered Defendant Beijing ByteDance to shut down one of its 

apps due to “vulgar” content. That prompted the CEO of Defendant Beijing ByteDance to publicly 

apologize. His re-dedication to the Chinese Communist Party resulted in his being named one of 

the “100 outstanding private entrepreneurs” who were “chosen for being ‘emblematic of the 

country’s private economic development’, while also being people who ‘resolutely uphold the 

Party’s leadership ....’”165

290. In a further show of allegiance to the Chinese government, Defendant Beijing 

ByteDance actively supports and participates in the spreading of Communist Party propaganda. It 

signed a strategic cooperation agreement with the Ministry of Public Security’s Press and Publicity 

Bureau to promote the credibility of the police department, including within an area of China 

known for severe repression, demolition of mosques, and wide-spread detention centers for ethnic 

minorities. Under that agreement, “all levels and divisions of police units from the Ministry of 

Public Security to county-level traffic police would have their own Douyin account to disseminate 

propaganda. The agreement also reportedly says ByteDance would increase its offline cooperation 

with the police department ....”166

291. Combined with evidence of the TikTok’s app’s functionality and code, the 

application of facial recognition technology to TikTok user videos, the patent applications for 

facial, voice, age, race/ethnicity and emotion recognition technologies, and the Douyin app’s facial 

recognition feature, Defendants’ legal obligations and political ties to the Chinese government 

make clear their large-scale BIPA and other biometrics violations.

165 https://chinatechmap.aspi.org.au/#/company/bytedance.

166 https://chinatechmap.aspi.org.au/#/company/bytedance. See also

https://www.washingtonpost.com/world/tiktoks-owner-is-helping-chinas-campaign-ofrepression-in-xinjiang-report-finds/2019/11/28/98e8d9e4-119f-11ea-bf62-

eadd5d11f559_story.html.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 80 of 120 PageID #:1952
80

VII. DEFENDANTS UNJUSTLY PROFIT WHILE PLAINTIFFS, THE CLASS, AND 

THE SUBCLASS SUFFER HARM

292. Defendants possess User/Device Identifiers, the biometric identifiers and 

information, the Private Videos and Private Video Images, and the video viewing histories

sufficient to create a dossier of private and personally identifiable data and content for each TikTok 

user. Such living files can be supplemented over time with additional private and personally 

identifiable user data and content, and all of this private and personally identifiable data and

information has been, is, and will be used in the past, the present, and the future for economic and 

financial gain.

293. Defendants’ unlawful possession and control over this data and information make 

tracking and profiling TikTok users, and targeting them with advertising, much more efficient,

effective, and lucrative. Such private and personally identifiable data and content are used to 

analyze TikTok users’ income, consumption habits, and preferences. Such information provides 

guidance as to what methods of advertising will be most effective on particular TikTok users, what 

products – including Defendants’ own products – will be most attractive to particular TikTok users, 

and how much to spend on particular ads. Defendants unjustly have earned and continue to earn

substantial profits and revenues from such targeted advertising and from generating increased 

demand for and use of Defendants’ other products.

294. Defendants also unlawfully leverage the private and personally identifiable TikTok 

user data and content to improve their artificial intelligence technologies and file patent 

applications, thereby unjustly increasing their past, present and future profits and revenues – and 

their market value.

295. Meanwhile, Plaintiffs, the Class and the Subclass have incurred, and continue to 

incur, harm as a result of the invasion of privacy stemming from Defendants’ covert theft of their 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 81 of 120 PageID #:1953
81

private and personally identifiable data and content – including their User/Device Identifiers, 

biometric identifiers and information, Private Videos and Private Video Images, and video viewing 

histories. 

296. Plaintiffs, the Class and the Subclass also have suffered and continue to suffer harm 

in the form of diminution of the value of their private and personally identifiable data and content 

as a result of Defendants’ surreptitious and unlawful activities. 

297. Moreover, Plaintiffs, the Class and the Subclass have suffered and continue to 

suffer injuries to their mobile devices. The battery, memory, CPU and bandwidth of such devices 

have been compromised, and as a result the functioning of such devices has been impaired and 

slowed, due to Defendants’ clandestine and unlawful activities. 

298. Finally, Plaintiffs, the Class, and the Subclass have incurred additional data usage 

and electricity costs that they would not have incurred but for Defendants’ covert and unlawful 

actions.

VIII. FRAUDULENT CONCEALMENT AND TOLLING.

299. The applicable statutes of limitations are tolled as a result of Defendants’ knowing 

and active concealment of their unlawful conduct alleged above – through, among other things, 

their obfuscation of the source code, misleading public statements, and hidden and ambiguous

privacy policies and terms of use. Plaintiffs, the Class, and the Subclass were ignorant of the 

information essential to pursue their claims, without any fault or lack of diligence on their own 

part.

300. Also, at the time the action was filed, Defendants were under a duty to disclose the 

true character, quality, and nature of their activities to Plaintiffs, the Class and the Subclass. 

Defendants are therefore estopped from relying on any statute of limitations.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 82 of 120 PageID #:1954
82

301. Defendants’ fraudulent concealment is common to the Class and the Subclass.

IX. ADDITIONAL NAMED PLAINTIFF ALLEGATIONS.

302. During the time that the TikTok app was installed on plaintiffs’ mobile devices, 

Defendants surreptitiously performed the following actions without notice to or the knowledge 

and consent of plaintiffs or, in the case of the minor plaintiffs, their legal guardians: (i) Defendants 

took plaintiffs’ User/Device Identifiers and Private Videos from their mobile devices; (ii) 

Defendants took plaintiffs’ biometric identifiers and information (including face geometry scans) 

from plaintiffs’ and their friends’ mobile device and/or videos; (iii) Defendants shared plaintiffs’ 

video viewing history with third parties; (iv) Defendants took plaintiffs’ private and personally 

identifiable data and content from plaintiffs’ mobile devices before they had the opportunity to 

sign up and create an account; (v) Defendants took plaintiffs’ private and personally identifiable 

data and content from their mobile devices after they closed the TikTok app; and (vi) Defendants 

transferred some or all such stolen data and content to servers located in China – including to 

servers under the control of third parties who cooperate with the Chinese government.

303. Defendants performed these acts for the purpose of secretly collecting plaintiffs’ 

private and personally identifiable data and content – including their User/Device Identifiers, 

biometric identifiers and information, and Private Videos – and using such data and content to 

track, profile and target plaintiffs with advertisements. Further, Defendants have used plaintiffs’ 

private and personally identifiable data and content for the purpose of developing their artificial 

intelligence capabilities and patenting commercially valuable technologies. Defendants and others 

now have access to private and personally identifiable data and content regarding plaintiffs that 

can be used for further commercial advantage and other harmful purposes. Defendants have 

profited, and will continue to profit, from these activities.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 83 of 120 PageID #:1955
83

304. Meanwhile, plaintiffs have incurred harm as a result of Defendants’ invasion of 

their privacy rights through their covert taking of plaintiffs’ private and personally identifiable 

data and content – including their User/Device Identifiers, biometric identifiers and information, 

Private Videos and Private Video Images, and video viewing history. Plaintiffs also have suffered 

harm because Defendants’ actions have diminished the value of their private and personally 

identifiable data and content. Moreover, plaintiffs have suffered injury to their mobile devices. 

The battery, memory, CPU, and bandwidth of such devices have been compromised, and as a 

result, the functioning of those devices has been impaired and slowed, due to Defendants’ 

clandestine and unlawful activities. Finally, Plaintiffs have incurred additional data usage and 

electricity costs that they and/or their guardians would not have incurred but for Defendants’ covert 

and unlawful actions.

305. Neither Plaintiffs nor, in the case of the minor plaintiffs, their guardians, ever 

received notice that Defendants would collect, capture, receive, otherwise obtain, store, and/or use 

their biometric identifiers, face geometry scans, voiceprints or any of their other biometric 

information. Defendants never informed plaintiffs or their guardians of the specific purpose and 

length of time for which their biometric identifiers, face geometry scans, or any of their other 

biometric information would be collected, captured, received, otherwise obtained, stored, and/or 

used. Neither Plaintiffs nor, in the case of minors, their guardians, ever signed a written release 

authorizing Defendants to collect, capture, receive, otherwise obtain, store, and/or use their 

biometric identifiers, face geometry scans, voiceprints, or any of their other biometric information.

306. Based on counsel’s investigation and analysis, set forth in detail below, TikTok 

deliberately designed its Terms of Service and Privacy Policy to decrease the likelihood that a user 

will notice and comprehend its terms and conditions or could provide meaningful, express consent 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 84 of 120 PageID #:1956
84

to its conditions, in order to encourage users to sign up and not be deterred by accurate and truthful 

disclosures.

307. Plaintiffs did not know nor expect that Defendants would collect, store, and use 

their biometric identifiers and biometric information when they used the App

308. Plaintiffs did not receive notice from Defendants (written or otherwise) that 

Defendants would collect, store, and/or use their biometric identifiers or biometric information. 

Plaintiffs did not receive notice from Defendants of the specific purpose and length of time that 

Defendants would collect, store, and/or use her biometric identifiers or biometric information. 

Plaintiffs did not give authorization (written or otherwise) for Defendants to collect, store, and/or 

use her biometric identifiers or biometric information.

309. Plaintiffs were not aware of, nor do they recall seeing, a retention schedule setting 

out the guidelines for Defendants to permanently destroy biometric identifiers or biometric 

information.

X. DEFENDANTS’ PRIVACY POLICIES AND TERMS OF USE DO NOT 

CONSTITUTE NOTICE OF, NOR CONSENT TO, TIKTOK USER DATA 

THEFT, THE ARBITRATION PROVISION OR THE CLASS ACTION WAIVER.

310. Defendants have adopted various privacy policies and terms of use for the TikTok 

app over the years. Certain privacy policies, revealed by investigation of counsel but not seen in 

the ordinary course by users, purport to disclose that the TikTok app takes some (but not all) of 

the private and personally identifiable user data and content above. Certain terms of use, revealed 

by investigation of counsel but not seen in the ordinary course by users, purport to require 

arbitration and class action waivers.

311. Because the TikTok app begins taking private and personally identifiable user data 

and content – including User/Device Identifiers – immediately upon the completion of the 

download process, and before TikTok users are even presented with the option of signing-up for 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 85 of 120 PageID #:1957
85

and creating an account, TikTok users have no notice of, and cannot consent to, the privacy policies 

and terms of use prior to such theft. Moreover, because the TikTok app takes Private Videos and 

Private Video Images even if TikTok users have not signed up for an account, TikTok users who 

have not signed up for an account have no notice of, and cannot consent to, the privacy policies 

and terms of use prior to such theft.

312. Moreover, even at the point at which TikTok users have the option to sign-up and 

create an account, Defendants do not provide such users actual notice of privacy policies or terms 

of use. Nor do Defendants present TikTok users with conspicuously located and designed 

hyperlinks to their privacy policies and terms of use, much less conspicuous warnings 

accompanying such hyperlinks. The TikTok app thus allows users to utilize it without ever placing 

them on actual or constructive notice of the privacy policies and terms of use. This lack of actual 

or constructive notice deprives TikTok users of the opportunity to accept or reject TikTok’s 

privacy policies and terms of use, rendering such documents unenforceable.

313. Additionally, certain privacy policies and terms of use are ambiguous as to what 

conduct they purport to cover. Such privacy policies and terms of use are also substantively and 

procedurally unconscionable. The ambiguities render meaningless the purported disclosures and 

requirements in the remainder of these documents, and the substantive and procedural 

unconscionability render such documents unenforceable.

314. Moreover, even if TikTok users had knowingly accepted the terms of use (which 

they did not), the purported waiver of the right to seek public injunctive relief in a court of law is 

unenforceable under California law. See, e.g., McGill v. Citibank, 2 Cal. 5th 945 (2017); Blair v. 

Rent-A-Center, 928 F.3d 819 (9th Cir. 2019).

315. Any attempt to surreptitiously secure minor users’ “consent” to TikTok’s Terms of 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 86 of 120 PageID #:1958
86

Use is unlawful and invalid. 

316. Defendants do not make any attempt to secure the consent of parents or lawful 

guardians.

317. Defendants have not obtained consent from the parents or lawful guardians of 

minor Class Members for their accounts. 

318. Defendants fail to make reasonable efforts to ensure that a parent or lawful guardian 

of minor Class Members receives direct notice of their practices regarding the collection, use, or 

disclosure of personal and biometric information.

319. Defendants do not at any point contact the parents or lawful guardians of minor 

Class Members to give them notice and do not even ask for contact information for the parents or 

lawful guardians of Class Members. 

320. Thus, Defendants have no means of obtaining verifiable parental consent for minor 

class members, or the consent of any lawful guardian, before any collection, use, or disclosure of 

the personal information of minor Class Members, nor do Defendants obtain verifiable parental 

consent to any alleged arbitration or class action waiver provisions.

321. To the extent that Defendants attempt to claim that they obtained the minor

Plaintiffs’ consent, the minor Plaintiffs expressly disaffirm such consent.

XI. CLASS ALLEGATIONS.

322. Plaintiffs seek certification of the classes set forth herein pursuant to Federal Rule 

of Civil Procedure 23 (“Rule 23”). Specifically, Plaintiffs seek class certification of all claims for 

relief herein on behalf of a class and subclass defined as follows:

Nationwide Class: All persons who reside in the United States who used the TikTok app

and/or the Musical.ly app.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 87 of 120 PageID #:1959
87

Or, in the alternative,

Multi-State Consumer Protection Class: All persons who reside in California, Illinois,

or any state with materially similar consumer protection laws167 who used the TikTok app and/or 

the Musical.ly app.

Illinois Subclass: All persons who reside in Illinois and used the TikTok app and/or the 

Musical.ly app to create one or more videos.

323. Plaintiffs are the proposed class representatives for the Nationwide Class and the 

Multi-State Consumer Protection Class. Illinois Plaintiffs are the proposed class representatives 

for the Illinois Subclass.

324. Plaintiffs reserve the right to modify or refine the definitions of the Class and the

Subclass.

325. Excluded from the Class and the Subclass are: (i) any judge or magistrate judge 

167 While discovery may alter the following, Plaintiff asserts that the other states with similar 

consumer fraud laws under the facts of this case include but are not limited to: Arkansas (Ark. 

Code § 4-88-101, et seq.); California (Cal. Bus. & Prof. C. §§ 17200 and 17500 et seq.); 

Colorado (Colo. Rev. Stat. § 6-1-101, et seq.); Connecticut (Conn. Gen. Stat. § 42-110, et seq.);

Delaware (Del. Code tit. 6, § 2511, et seq.); District of Columbia (D.C. Code § 28-3901, et seq.); 

Florida (Fla. Stat. § 501.201, et seq.); Hawaii (Haw. Rev. Stat. § 480-1, et seq.); Idaho (Idaho 

Code § 48-601, et seq.); Illinois (815 ICLS § 505/1, et seq.); Maine (Me. Rev. Stat. tit. 5 § 205-

A, et seq.); Massachusetts (Mass. Gen. Laws Ch. 93A, et seq.); Michigan (Mich. Comp. Laws § 

445.901, et seq.); Minnesota (Minn. Stat. § 325F.67, et seq.); Missouri (Mo. Rev. Stat. § 

407.010, et seq.); Montana (Mo. Code. § 30-14-101, et seq.); Nebraska (Neb. Rev. Stat. § 59 

1601, et seq.); Nevada (Nev. Rev. Stat. § 598.0915, et seq,); New Hampshire (N.H. Rev. Stat. § 

358-A:1, et seq.); New Jersey (N.J. Stat. § 56:8-1, et seq.); New Mexico (N.M. Stat. § 57-12-1, et 

seq.); New York (N.Y. Gen. Bus. Law § 349, et seq.); North Dakota (N.D. Cent. Code § 51-15-

01, et seq.); Oklahoma (Okla. Stat. tit. 15, § 751, et seq.); Oregon (Or. Rev. Stat. § 646.605, et 

seq.); Rhode Island (R.I. Gen. Laws § 6-13.1-1, et seq.); South Dakota (S.D. Code Laws § 37-

24-1, et seq.); Texas (Tex. Bus. & Com. Code § 17.41, et seq.); Virginia (VA Code § 59.1-196, 

et seq.); Vermont (Vt. Stat. tit. 9, § 2451, et seq.); Washington (Wash. Rev. Code § 19.86.010, et 

seq.); West Virginia (W. Va. Code § 46A-6- 101, et seq.); and Wisconsin (Wis. Stat. § 100.18, et 

seq.). See Mullins v. Direct Digital, LLC, No. 13-cv-1829, 2014 WL 5461903 (N.D. Ill. Sept. 30, 

2014), aff’d, 795 F.3d 654 (7th Cir. 2015).

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 88 of 120 PageID #:1960
88

presiding over this action and members of their staff, as well as members of their families; (ii)

Defendants, Defendants’ predecessors, parents, successors, heirs, assigns, subsidiaries, and any 

entity in which any Defendant or its parents have a controlling interest, as well as Defendants’ 

current or former employees, agents, officers, and directors; (iii) persons who properly execute 

and file a timely request for exclusion from the class; (iv) persons whose claims in this matter have 

been finally adjudicated on the merits or otherwise released; (v) counsel for Defendants; and (vi)

the legal representatives, successors, and assigns of any such excluded persons.

326. Ascertainability. The proposed Class and Subclass are readily ascertainable 

because they are defined using objective criteria so as to allow Class and Subclass members to 

determine if they are part of the Class and/or one of the Subclass. Further, the Class and Subclass

can be readily identified through records maintained by Defendants.

327. Numerosity (Rule 23(a)(1)). The Class and Subclass are so numerous that joinder 

of individual members herein is impracticable. The exact number of Class and Subclass members, 

as herein identified and described, is not known, but download figures indicate that the TikTok 

app has been downloaded more than 120 million times in the United States.

328. Commonality (Rule 23(a)(2)). Common questions of fact and law exist for each 

cause of action and predominate over questions affecting only individual Class and Subclass 

members, including the following:

a) Whether Defendants engaged in the activities and practices referenced 

above;

b) Whether Defendants’ activities and practices referenced above constitute a 

violation of the Computer Fraud and Abuse Act, 18 U.S.C. § 1030;

c) Whether Defendants’ activities and practices referenced above constitute a 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 89 of 120 PageID #:1961
89

violation of the California Comprehensive Data Access and Fraud Act, Cal. Pen. C. § 502;

d) Whether Defendants’ activities and practices referenced above constitute a 

violation of the Right to Privacy under the California Constitution;

e) Whether Defendants’ activities and practices referenced above constitute an

intrusion upon seclusion;

f) Whether Defendants’ activities and practices referenced above constitute a 

violation of the California Unfair Competition Law, Bus. & Prof. C. §§ 17200 et seq.

g) Whether Defendants’ activities and practices referenced above constitute a 

violation of the California False Advertising Law, Bus. & Prof. C. §§ 17500 et seq.

h) Whether Defendants’ activities and practices referenced above constitute 

unjust enrichment concerning which restitution and/or disgorgement is warranted;

i) Whether Defendants’ activities and practices referenced above constitute a 

violation of the Illinois Biometric Information Privacy Act, 740 ILCS 14/1, et seq.;

j) Whether Defendants’ activities and practices referenced above constitute a 

violation of the Video Privacy Protection Act, 18 U.S.C. § 2710 et seq.;

k) Whether Plaintiffs and members of the Class and Subclass sustained 

damages as a result of Defendants’ activities and practices referenced above, and, if so, in 

what amount;

l) Whether Defendants profited from their activities and practices referenced 

above, and, if so, in what amount;

m) What is the appropriate injunctive relief to ensure that Defendants no longer 

unlawfully: (i) take private and personally identifiable TikTok user data and content –

including User/Device Identifiers, biometric identifiers and information, Private Videos

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 90 of 120 PageID #:1962
90

and Private Video Images, and video viewing histories; (ii) utilize private and personally 

identifiable TikTok user data and content to develop and patent commercially valuable 

artificial intelligence technologies; (iii) utilize private and personally identifiable TikTok 

user data and content to create consumer demand for and use of Defendants’ other products; 

(iv) transfer such private and personally identifiable TikTok user data and content to 

servers in China and to third parties either in China or whose data is accessible from within 

China; (v) cause the diminution in value of TikTok users’ private and personally 

identifiable data and content; (vi) cause injury and harm to TikTok users’ mobile devices;

(vii) cause TikTok users to incur higher data usage and electricity charges; (viii) retain the

unlawfully acquired private and personally identifiable data and content on TikTok users; 

and (ix) profile and target, based on the above activities, TikTok users with advertisements.

n) What is the appropriate injunctive relief to ensure that Defendants take 

reasonable measures to ensure that they and relevant third parties destroy unlawfullyacquired private and personally identifiable TikTok user data and content in their 

possession, custody or control.

329. Typicality (Rule 23(a)(3)). Plaintiffs’ claims are typical of the claims of members 

of the Class and Subclass because, among other things, Plaintiffs and members of the Class and

Subclass sustained similar injuries as a result of Defendants’ uniform wrongful conduct and their 

legal claims all arise from the same events and wrongful conduct by Defendants.

330. Adequacy (Rule 23(a)(4)). Plaintiffs will fairly and adequately protect the interests 

of the Class and Subclass. Plaintiffs’ interests do not conflict with the interests of the Class and 

Subclass members, and Plaintiffs have retained counsel experienced in complex class action and 

data privacy litigation to prosecute this case on behalf of the Class and Subclass.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 91 of 120 PageID #:1963
91

331. Predominance & Superiority (Rule 23(b)(3)). In addition to satisfying the 

prerequisites of Rule 23(a), Plaintiffs satisfy the requirements for maintaining a class action under 

Rule 23(b)(3). Common questions of law and fact predominate over any questions affecting only 

individual Class and Subclass members, and a class action is superior to individual litigation and 

all other available methods for the fair and efficient adjudication of this controversy. The amount 

of damages available to Plaintiffsis insufficient to make litigation addressing Defendants’ conduct 

economically feasible in the absence of the class action procedure. Individualized litigation also 

presents a potential for inconsistent or contradictory judgments, and increases the delay and 

expense presented by the complex legal and factual issues of the case to all parties and the court 

system. By contrast, the class action device presents far fewer management difficulties and 

provides the benefits of a single adjudication, economy of scale, and comprehensive supervision 

by a single court.

332. Final Declaratory or Injunctive Relief (Rule 23(b)(2)). Plaintiffs also satisfy the 

requirements for maintaining a class action under Rule 23(b)(2). Defendants have acted or refused 

to act on grounds that apply generally to the Class and Subclass, making final declaratory and/or 

injunctive relief appropriate with respect to the Class and Subclass as a whole.

333. Particular Issues (Rule 23(c)(4)). Plaintiffs also satisfy the requirements for 

maintaining a class action under Rule 23(c)(4). Their claims consist of particular issues that are 

common to all Class and Subclass members and are capable of class-wide resolution that will 

significantly advance the litigation.

XII. CALIFORNIA LAW APPLIES TO THE CLAIMS OF THE CLASS

334. With the exception of BIPA, which applies exclusively to the claims of the Illinois 

Subclass, California’s substantive laws apply to the statutory, constitutional and common law 

claims of every member of the Class, regardless of where in the United States the Class Member 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 92 of 120 PageID #:1964
92

resides. California’s substantive laws may be constitutionally applied to the claims of Plaintiff and 

the Class under the Due Process Clause, 14th Amend. §1, and the Full Faith and Credit Clause, 

Art. IV §1 of the U.S. Constitution. California has significant contacts, or significant aggregation 

of contacts, to the claims asserted by Plaintiff and all Class Members, thereby creating state 

interests that ensure that the choice of California state law is not arbitrary or unfair.

335. Defendants’ U.S. headquarters and principal places of business are located in 

California. Defendants also own property and conduct substantial business in California, and 

therefore California has an interest in regulating Defendants’ conduct under its laws. Defendants’

decision to reside in California and avail itself of California’s laws, and to engage in the challenged 

conduct from and emanating out of California, renders the application of California law to the 

claims herein constitutionally permissible.

336. California is also the state from which Defendants’ alleged misconduct emanated. 

This conduct similarly injured and affected Plaintiff and all other Class Members.

337. The application of California laws to the claims of the Class is also appropriate 

under California’s choice of law rules because California has significant contacts to the claims of 

Plaintiff and the proposed Class, and California has a greater interest in applying its laws here than 

any other interested state.

XIII. CAUSES OF ACTION.

FIRST CAUSE OF ACTION

Violation of the Computer Fraud and Abuse Act, 18 U.S.C. § 1030

(On Behalf of the Plaintiffs and the Class)

338. Plaintiffs repeat and incorporate by reference all preceding paragraphs as if fully 

set forth herein.

339. The Plaintiffs’ and the Class’s mobile devices are, and at all relevant times have 

been, used for interstate communication and commerce, and are therefore “protected computers” 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 93 of 120 PageID #:1965
93

under 18 U.S.C. § 1030(e)(2)(B).

340. Defendants have exceeded, and continue to exceed, authorized access to the 

Plaintiffs’ and the Class’s protected computers and obtained information thereby, in violation of 

18 U.S.C. § 1030(a)(2), (a)(2)(C).

341. Defendants’ conduct caused “loss to 1 or more persons during any 1-year period . . 

. aggregating at least $5,000 in value” under 18 U.S.C. § 1030(c)(4)(A)(i)(I), inter alia, because 

of the secret transmission of the Plaintiffs’ and the Class’s private and personally identifiable data

and content – including User/Device Identifiers, biometric identifiers and information, and Private 

Videos and Private Video Images never intended for public consumption.

342. Defendants’ conduct also constitutes “a threat to public health or safety” under 18 

U.S.C. § 1030(c)(4)(A)(i)(IV), due to the private and personally identifiable data and content of 

the Plaintiffs and the Class being made available to foreign actors, including foreign intelligence 

services, in locations without adequate legal privacy protections. That this threat is real and 

imminent is evidenced by the ban on the TikTok app instituted by the Defense Department, Navy, 

Army, Marines, Air Force, Coast Guard and Transportation Security Administration, as well as 

the proposed legislation by United States Senators that would ban federal employees from using 

the TikTok app. As Senators Schumer and Cotton wrote in an October 23, 2019 letter to the Acting 

Director of National Intelligence concerning TikTok, “[s]ecurity experts have voiced concerns that 

China’s vague patchwork of intelligence, national security, and cybersecurity laws compel Chinese 

companies to support and cooperate with intelligence work controlled by the Chinese Communist 

Party. Without an independent judiciary to review requests made by the Chinese government for 

data or other actions, there is no legal mechanism for Chinese companies to appeal if they disagree 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 94 of 120 PageID #:1966
94

with a request.”168

343. Accordingly, the Plaintiffs and the Class are entitled to “maintain a civil action 

against the violator to obtain compensatory damages and injunctive relief or other equitable relief.” 

18 U.S.C. § 1030(g).

SECOND CAUSE OF ACTION

Violation of the California Comprehensive Data Access and Fraud Act

Cal. Pen. C. § 502

(On Behalf of the Plaintiffs and the Class)

344. Plaintiffs repeat and incorporate by reference all preceding paragraphs as if fully 

set forth herein.

345. Defendants’ acts violate Cal. Pen. C. § 502(c)(1) because they have knowingly 

accessed, and continue to knowingly access, data and computers to wrongfully control or obtain 

data. The Plaintiffs’ and the Class’s private and personally identifiable data and content accessed 

by Defendants – including User/Device Identifiers, biometric identifiers and information, and 

Private Videos and Private Video Images never intended for public consumption – far exceeds any 

reasonable use of the Plaintiffs’ and the Class’s data and content to operate the TikTok app. There 

is no justification for Defendants’ surreptitious collection and transfer of the Plaintiffs’ and the 

Class’s private and personally identifiable data and content from their mobile devices and their

other social media accounts; for Defendants’ clandestine collection and transfer of the Plaintiffs’ 

and the Class’s private and personally identifiable data and content before they even sign-up and 

create an account; for Defendants’ covert collection and transfer of the Plaintiffs’ and the Class’s 

private and personally identifiable data and content when the TikTok app is closed; or for 

Defendants having embedded source code within the TikTok app that transfers the Plaintiffs’ and 

168 https://www.law360.com/articles/1213180/sens-want-tiktok-investigated-for-nationalsecurity-threats; https://www.cotton.senate.gov/?p=press_release&id=1239.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 95 of 120 PageID #:1967
95

the Class’s private and personally identifiable data and content to servers and third-party 

companies based in China where such servers and third-party companies are subject to Chinese 

law requiring the sharing of such data and content with the Chinese government.

346. Defendants’ acts violate Cal. Pen. C. § 502(c)(2) because they have knowingly 

accessed and without permission taken, copied, and made use of data from a computer – and they 

continue to do so. Defendants did not obtain permission to take, copy, and make use of the 

Plaintiffs’ and the Class’s private and personally identifiable data and content – including

User/Device Identifiers, biometric identifiers and information, and Private Videos and Private 

Video Images never intended for public consumption – from their mobile devices and their other 

social media accounts. Nor did Defendants obtain permission to take, copy, and make use of the 

Plaintiffs’ and the Class’s private and personally identifiable data and content from their mobile 

devices before they even sign-up and create an account. And Defendants did not obtain permission 

to take, copy, and make use of the Plaintiffs’ and the Class’s private and personally identifiable

data and content from their mobile devices when the TikTok app is closed. Finally, Defendants 

did not obtain permission to embed source code within the TikTok app that transfers the Plaintiffs’ 

and the Class’s private and personally identifiable data and content to servers and third-party 

companies based in China where such servers and third-party companies are subject to Chinese 

law requiring the sharing of such data and content with the Chinese government.

347. Accordingly, the Plaintiffs and the Class are entitled to compensatory damages, 

including “any expenditure reasonably and necessarily incurred by the owner or lessee to verify 

that a computer system, computer network, computer program, or data was or was not altered, 

damaged, or deleted by the access,” injunctive relief, and attorneys’ fees. Cal. Pen. C. § 502(e)(1), 

(2).

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 96 of 120 PageID #:1968
96

THIRD CAUSE OF ACTION

Violation of the Right to Privacy – California Constitution

(On Behalf of the Plaintiffs and the Class)

348. Plaintiffs repeat and incorporate by reference all preceding paragraphs as if fully 

set forth herein.

349. Plaintiffs and the Class hold, and at all relevant times held, a legally protected 

privacy interest in their private and personally identifiable data and content – including 

User/Device Identifiers, biometric identifiers and information, and Private Videos and Private 

Video Images never intended for public consumption – on their mobile devices and in their other 

social media accounts that Defendants have taken.

350. There is a reasonable expectation of privacy concerning Plaintiffs’ and the Class’s

data and content under the circumstances present. 

351. The reasonableness of Plaintiffs’ and the Class’s expectation of privacy is 

supported by the undisclosed, hidden, and non-intuitive nature of Defendants’ taking of private 

and personally identifiable data and content – including User/Device Identifiers, biometric 

identifiers and information, and Private Videos and Private Video Images never intended for public 

consumption – from Plaintiffs’ and the Class’s mobile devices and other social media accounts.

352. Defendants’ conduct constitutes and, at all relevant times, constituted a serious 

invasion of privacy, as Defendants either did not disclose at all, or failed to make an effective 

disclosure, that they would take and make use of – and allow third-party companies based in China 

to take and make use of – Plaintiffs’ and the Class’s private and personally identifiable data and 

content. Defendants intentionally invaded Plaintiffs’ and the Class’s privacy interests by 

intentionally designing the TikTok app, including all associated code, to surreptitiously obtain, 

improperly gain knowledge of, review, and retain their private and personally identifiable data and 

content.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 97 of 120 PageID #:1969
97

353. These intrusions are highly offensive to a reasonable person, as evidenced by 

substantial research, literature, and governmental enforcement and investigative efforts to protect 

consumer privacy against surreptitious technological intrusions. The offensiveness of Defendants’ 

intrusion is heightened by Defendants’ making Plaintiffs’ and the Class’s private and personally 

identifiable data and content available to third parties, including foreign governmental entities 

whose interests are opposed to those of United States citizens. The offensiveness of Defendants’ 

intrusion is further heightened by Defendants’ secret collection and transfer of Plaintiffs’ and the 

Class’s private and personally identifiable data and content before they even sign-up and create an 

account; by Defendants’ covert collection and transfer of Plaintiffs’ and the Class’s private and 

personally identifiable data and content when the TikTok app is closed; and by Defendants’ 

clandestine collection and transfer of Plaintiffs’ and the Class’s private and personally identifiable

data and content from their other social media accounts. The intentionality of Defendants’ conduct, 

and the steps they have taken to disguise and deny it, also demonstrate the highly offensive nature 

of their conduct. Further, Defendants’ conduct targeted Plaintiffs’ and the Class’s mobile devices, 

which the United States Supreme Court has characterized as almost a feature of human anatomy, 

and which contain Plaintiffs’ and the Class’s private and personally identifiable data and content.

354. Plaintiffs and the Class were harmed by, and continue to suffer harm as a result of,

the intrusion as detailed throughout this First Amended Complaint.

355. Defendants’ conduct was a substantial factor in causing the harm suffered by 

Plaintiffs and the Class.

356. Plaintiffs and the Class seek nominal and punitive damages as a result of 

Defendants’ actions. Punitive damages are warranted because Defendants’ malicious, oppressive, 

and willful actions were calculated to injure the Plaintiffs and the Class, and were made in 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 98 of 120 PageID #:1970
98

conscious disregard of their rights. Punitive damages are also warranted to deter Defendants from 

engaging in future misconduct.

357. Plaintiffs and the Class seek injunctive relief to rectify Defendants’ actions, 

including but not limited to requiring Defendants to stop taking more private and personally 

identifiable data and content of Plaintiffs and the Class from their mobile devices and their other 

social media accounts than is reasonably necessary to operate the TikTok app; to make clear 

disclosures of Plaintiffs’ and the Class’s private and personally identifiable data and content that 

is reasonably necessary to operate the TikTok app; to obtain Plaintiffs’ and the Class’s consent to 

the taking of their private and personally identifiable data and content; to stop transferring 

Plaintiffs’ and the Class’s private and personally identifiable data and content to China, to servers 

located in China, or to servers or companies whose data is accessible from within China; and to

recall and destroy Plaintiffs’ and the Class’s private and personally identifiable data and content

already taken in contravention of Plaintiffs’ and the Class’s right to privacy under the California 

Constitution.

358. The Plaintiffs and the Class seek restitution and disgorgement for Defendants’ 

violation of their privacy rights. A person acting in conscious disregard of the rights of another is 

required to disgorge all profit because disgorgement both benefits the injured parties and deters 

the perpetrator from committing the same unlawful actions again. Disgorgement is available for 

conduct that constitutes “conscious interference with a claimant’s legally protected interests,” 

including tortious conduct or conduct that violates another duty or prohibition. Restatement (3rd) 

of Restitution and Unjust Enrichment, §§ 40, 44.

FOURTH CAUSE OF ACTION

Intrusion upon Seclusion

(On Behalf of the Plaintiffs and the Class)

359. Plaintiffs repeat and incorporate by reference all preceding paragraphs as if fully 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 99 of 120 PageID #:1971
99

set forth herein.

360. “One who intentionally intrudes, physically or otherwise, upon the solitude or 

seclusion of another or his private affairs or concerns, is subject to liability to the other for invasion 

of his privacy, if the intrusion would be highly offensive to a reasonable person.” Restatement 

(2nd) of Torts § 652B.

361. The Plaintiffs and the Class have, and at all relevant times had, a reasonable 

expectation of privacy in their mobile devices and their other social media accounts, and their

private affairs include their past, present and future activity on their mobile devices and their other 

social media accounts.

362. The reasonableness of the Plaintiffs’ and the Class’s expectations of privacy is 

supported by the undisclosed, hidden, and non-intuitive nature of Defendants’ taking of private 

and personally identifiable data and content from the Plaintiffs’ and the Class’s mobile devices

and other social media accounts.

363. Defendants intentionally intruded upon the Plaintiffs’ and the Class’s solitude, 

seclusion, and private affairs – and continue to do so – by intentionally designing the TikTok app, 

including all associated code, to surreptitiously obtain, improperly gain knowledge of, review, and 

retain the Plaintiffs’ and the Class’s private and personally identifiable data and content – including 

User/Device Identifiers, biometric identifiers and information, and Private Videos and Private 

Video Images never intended for public consumption.

364. These intrusions are highly offensive to a reasonable person, as evidenced by 

substantial research, literature, and governmental enforcement and investigative efforts to protect

consumer privacy against surreptitious technological intrusions. The offensiveness of Defendants’ 

intrusion is heightened by Defendants’ making the Plaintiffs’ and the Class’s private and 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 100 of 120 PageID #:1972
100

personally identifiable data and content available to third parties, including foreign governmental 

entities whose interests are opposed to those of United States citizens. The offensiveness of 

Defendants’ intrusion is further heightened by Defendants’ secret collection and transfer of the 

Plaintiffs’ and the Class’s private and personally identifiable data and content before they even 

sign-up and create an account; by Defendants’ covert collection and transfer of the Plaintiffs’ and 

the Class’s private and personally identifiable data and content when the TikTok app is closed;

and by Defendants’ clandestine collection and transfer of the Plaintiffs’ and the Class’s private 

and personally identifiable data and content from their other social media accounts. The 

intentionality of Defendants’ conduct, and the steps they have taken to disguise and deny it, also 

demonstrate the highly offensive nature of their conduct. Further, Defendants’ conduct targeted 

the Plaintiffs’ and the Class’s mobile devices, which the United States Supreme Court has 

characterized as almost a feature of human anatomy, and which contain the Plaintiffs’ and the 

Class’s private and personally identifiable data and content.

365. The Plaintiffs and the Class were harmed by, and continue to suffer harm as a result 

of, the intrusion as detailed throughout this First Amended Complaint.

366. Defendants’ conduct was a substantial factor in causing the harm suffered by the 

Plaintiffs and the Class.

367. The Plaintiffs and the Class seek nominal and punitive damages as a result of 

Defendants’ actions. Punitive damages are warranted because Defendants’ malicious, oppressive, 

and willful actions were calculated to injure the Plaintiffs and the Class, and were made in 

conscious disregard of their rights. Punitive damages are also warranted to deter Defendants from 

engaging in future misconduct.

368. The Plaintiffs and the Class seek injunctive relief to rectify Defendants’ actions, 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 101 of 120 PageID #:1973
101

including but not limited to requiring Defendants to stop taking more private and personally 

identifiable data and content from the Plaintiffs’ and the Class’s mobile devices and other social 

media accounts than is reasonably necessary to operate the TikTok app; to make clear disclosures 

of the Plaintiffs’ and the Class’s private and personally identifiable data and content that is 

reasonably necessary to operate the TikTok app; to obtain the Plaintiffs’ and the Class’s consent 

to the taking of such private and personally identifiable data and content; to stop transferring the 

Plaintiffs’ and the Class’s private and personally identifiable data and content to China, to servers 

located in China, or to servers or companies whose data is accessible from within China; and to 

recall and destroy the Plaintiffs’ and the Class’s private and personally identifiable data and 

content already taken in contravention of the Plaintiffs’ and the Class’s privacy rights.

369. Plaintiffs and the Class seek restitution and disgorgement for Defendants’ intrusion 

upon seclusion. A person acting in conscious disregard of the rights of another is required to 

disgorge all profit because disgorgement both benefits the injured parties and deters the perpetrator 

from committing the same unlawful actions again. Disgorgement is available for conduct that 

constitutes “conscious interference with a claimant’s legally protected interests,” including 

tortious conduct or conduct that violates another duty or prohibition. Restatement (3rd) of 

Restitution and Unjust Enrichment, §§ 40, 44.

FIFTH CAUSE OF ACTION

Violation of the California Unfair Competition Law,

Bus. & Prof. C. §§ 17200 et seq.

(On Behalf of the Plaintiffs and the Class)

370. Plaintiffs repeat and incorporate by reference all preceding paragraphs as if fully 

set forth herein.

371. The Unfair Competition Law, California Business & Professions Code §§ 17200, 

et seq. (the “UCL”), prohibits any “unlawful,” “unfair,” or “fraudulent” business act or practice, 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 102 of 120 PageID #:1974
102

which can include false or misleading advertising.

372. Defendants violated, and continue to violate, the “unlawful” prong of the UCL 

through violation of statutes, constitutional provisions, and common law, as alleged herein.

373. Defendants violated, and continue to violate, the “unfair” prong of the UCL because 

they took private and personally identifiable data and content – including User/Device Identifiers, 

biometric identifiers and information, and Private Videos and Private Video Images never intended 

for public consumption – from the Plaintiffs’ and the Class’s mobile devices and other social media 

accounts under circumstances in which the Plaintiffs and the Class would have no reason to know 

that such data and content was being taken.

374. Plaintiffs and the Class had no reason to know because (i) there was no disclosure 

of Defendants’ collection and transfer of the Plaintiffs’ and the Class’s biometric identifiers and

information, and Private Videos and Private Video Images not intended for public consumption;

(ii) there was no disclosure of Defendants’ collection and transfer of the Plaintiffs’ and the Class’s 

private and personally identifiable data and content before they even sign-up and create an account;

(iii) there was no disclosure of Defendants’ collection and transfer of the Plaintiffs’ and the Class’s 

private and personally identifiable data and content when the TikTok app is closed; (iv) there was 

no disclosure that Defendants had embedded source code within the TikTok app that transfers the 

Plaintiffs’ and the Class’s private and personally identifiable data and content to servers and thirdparty companies based in China where such servers and third-party companies are subject to 

Chinese law requiring the sharing of such data and content with the Chinese government; and (v) 

there was no effective disclosure of the wide range of the private and personally identifiable data

and content, including User/Device Identifiers, that Defendants took from the Plaintiffs’ and the 

Class’s mobile devices and other social media accounts.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 103 of 120 PageID #:1975
103

375. Defendants violated, and continue to violate, the “fraudulent” prong of the UCL 

because (i) Defendants made it appear that the Plaintiffs’ and the Class’s User/Device Identifiers, 

biometric identifiers and information, and Private Videos and Private Video Images would not be 

collected and transferred unless the Plaintiffs and the Class chose to do so, but in fact Defendants 

collected and transferred such data and content without notice or consent; (ii) Defendants made it 

appear that the Plaintiffs’ and the Class’s private and personally identifiable data and content 

would not be collected and transferred before they had signed-up and created an account, but in 

fact Defendants collected and transferred such data and content before sign-up and account 

creation without notice or consent; (iii) Defendants made it appear that the Plaintiffs’ and the 

Class’s private and personally identifiable data and content would not be collected or transferred

while the TikTok app is closed, but in fact Defendants clandestinely collected and transferred such 

data and content when the app was closed without notice or consent; (iv) Defendants made it 

appear that the Plaintiffs’ and the Class’s private and personally identifiable data and content

would not be transferred to servers and third-party companies based in China where such servers 

and third-party companies are subject to Chinese law requiring the sharing of such data and content

with the Chinese government, but in fact Defendants covertly transferred such data and content to 

servers and third-party companies based in China without notice or consent; and (v) Defendants 

have intentionally refrained from disclosing the use to which the Plaintiffs’ and the Class’s private 

and personally identifiable data and content has been put, while simultaneously providing 

misleading reassurances about Defendants’ data collection and use practices. The Plaintiffs and

the Class were misled by Defendants’ concealment, and had no reason to believe that Defendants 

had taken the private and personally identifiable data and content that they had taken.

376. Plaintiffs and the Class have been harmed and have suffered economic injury as a 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 104 of 120 PageID #:1976
104

result of Defendants’ UCL violations. First, Plaintiffs and the Class have suffered harm in the form 

of diminution of the value of their private and personally identifiable data and content. Second, 

they have suffered harm to their mobile devices. The battery, memory, CPU and bandwidth of 

such devices have been compromised, and as a result the functioning of such devices has been 

impaired and slowed. Third, they have incurred additional data usage and electricity costs that they 

would not otherwise have incurred. Fourth, they have suffered harm as a result of the invasion of

privacy stemming from Defendants’ covert theft of their private and personally identifiable data 

and content – including User/Device Identifiers, biometric identifiers and information, and Private 

Videos and Private Video Images.

377. Defendants, as a result of their conduct, have been able to reap unjust profits and 

revenues in violation of the UCL. This includes Defendants’ profits and revenues from their 

targeted-advertising, improvements to their artificial intelligence technologies, their patent 

applications, and the increased consumer demand for and use of Defendants’ other products. 

Plaintiffs and the Class seek restitution and disgorgement of these unjust profits and revenues.

378. Unless restrained and enjoined, Defendants will continue to misrepresent their 

private and personally identifiable data and content collection and use practices, and will not recall 

and destroy Plaintiffs’ and the Class’s wrongfully collected private and personally identifiable data

and content. Accordingly, injunctive relief is appropriate.

SIXTH CAUSE OF ACTION

Violation of the California False Advertising Law, 

Bus. & Prof. C. §§ 17500 et seq.

(On Behalf of the Plaintiffs and the Class)

379. Plaintiffs repeat and incorporate by reference all preceding paragraphs as if fully 

set forth herein.

380. California’s False Advertising Law (the “FAL”) – Cal. Bus. & Prof. Code §§ 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 105 of 120 PageID #:1977
105

17500, et seq. – prohibits “any statement” that is “untrue or misleading” and made “with the intent 

directly or indirectly to dispose of” property or services.

381. Defendants’ advertising is, and at all relevant times was, highly misleading. 

Defendants do not disclose at all, or do not meaningfully disclose, the private and personally 

identifiable data and content – including User/Device Identifiers, biometric identifiers and 

information, and Private Videos and Private Video Images never intended for public consumption 

– that they have collected and transferred from the Plaintiffs’ and the Class’s mobile devices and 

other social media accounts. Defendants also do not advertise that Defendants secretly take private 

and personally identifiable data and content from the Plaintiffs’ and the Class’s mobile devices 

before they even sign up and create an account, or that Defendants covertly take private and 

personally identifiable data and content from the Plaintiffs’ and the Class’s mobile devices even 

when the TikTok app is closed. Nor do Defendants disclose that the Plaintiffs’ and the Class’s

private and personally identifiable data and content has been made available to foreign entities, 

including foreign government entities. As United States Senator Josh Hawley said on November 

18, 2019: “If your child uses TikTok, there’s a chance the Chinese Communist Party knows where 

they are, what they look like, what their voices sound like, and what they’re watching” . . . “That’s 

a feature TikTok doesn’t advertise.”169

382. Reasonable consumers, like the Plaintiffs and the Class, are – and at all relevant 

times were – likely to be misled by Defendants’ misrepresentations. Reasonable consumers lack 

the means to verify Defendants’ representations concerning their data and content collection and 

use practices, or to understand the fact or significance of Defendants’ data and content collection 

169 https://www.law360.com/articles/1220783/no-more-data-storage-in-china-gop-senator-s-billsays.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 106 of 120 PageID #:1978
106

and use practices.

383. Plaintiffs and the Class have been harmed and have suffered economic injury as a 

result of Defendants’ misrepresentations. First, they have suffered harm in the form of diminution 

of the value of their private and personally identifiable data and content. Second, they have 

suffered harm to their mobile devices. The battery, memory, CPU and bandwidth of such devices 

have been compromised, and as a result the functioning of such devices has been impaired and 

slowed. Third, they have incurred additional data usage and electricity costs that they would not 

otherwise have incurred. Fourth, they have suffered harm as a result of the invasion of privacy 

stemming from Defendants’ covert theft of their private and personally identifiable data and 

content – including User/Device Identifiers, biometric identifiers and information, and Private 

Videos and Private Video Images never intended for public consumption.

384. Defendants, as a result of their misrepresentations, have been able to reap unjust 

profits and revenues. This includes Defendants’ profits and revenues from their targetedadvertising, improvements to their artificial intelligence technologies, their patent applications, 

and the increased consumer demand for and use of Defendants’ other products. Plaintiffs and the 

Class seek restitution and disgorgement of these unjust profits and revenues.

385. Unless restrained and enjoined, Defendants will continue to misrepresent their 

private and personally identifiable data and content collection and use practices, and will not recall 

and destroy Plaintiffs’ and the Class’s wrongfully collected private and personally identifiable data 

and content. Accordingly, injunctive relief is appropriate.

SEVENTH CAUSE OF ACTION

Restitution / Unjust Enrichment

(On Behalf of the Plaintiffs and the Class)

386. Plaintiffs repeat and incorporate by reference all preceding paragraphs as if fully 

set forth herein.

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 107 of 120 PageID #:1979
107

387. Plaintiffs and the Class have conferred substantial benefits on Defendants by 

downloading and using the TikTok app. These include the Defendants’ collection and use of the 

Plaintiffs’ and the Class’s private and personally identifiable data and content – including 

User/Device Identifiers, biometric identifiers and information, and Private Videos and Private 

Video Images never intended for public consumption. Such benefits also include the revenues and 

profits resulting from Defendants’ collection and use of such data and content for Defendants’

targeted-advertising, improvements to their artificial intelligence technologies, their patent 

applications, and the increased consumer demand for and use of Defendants’ other products.

388. Defendants have knowingly and willingly accepted and enjoyed these benefits.

389. Defendants either knew or should have known that the benefits rendered by the 

Plaintiffs and the Class were given with the expectation that Defendants would not take and use 

the Plaintiffs’ and the Class’s private and personally identifiable data and content that Defendants

have taken and used without permission. For Defendants to retain the aforementioned benefits 

under these circumstances is inequitable.

390. Through deliberate violation of the Plaintiffs’ and the Class’s privacy interests, and 

statutory and constitutional rights, Defendants each reaped benefits that resulted in each Defendant 

wrongfully receiving profits.

391. Equity demands disgorgement of Defendants’ ill-gotten gains. Defendants will be 

unjustly enriched unless they are ordered to disgorge those profits for the benefit of the Plaintiffs

and the Class.

392. As a direct and proximate result of Defendants’ wrongful conduct and unjust 

enrichment, the Plaintiffs and the Class are entitled to restitution from Defendants and institution 

of a constructive trust disgorging all profits, benefits, and other compensation obtained by 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 108 of 120 PageID #:1980
108

Defendants through this inequitable conduct.

EIGHTH CAUSE OF ACTION

Violation of the Video Privacy Protection Act, 18 U.S.C. § 2710, et seq.

(On Behalf of Plaintiffs and the Class)

393. Plaintiffs repeat and incorporate by reference all preceding paragraphs as if fully 

set forth herein.

394. The VPPA provides that “a video tape service provider who knowingly discloses, 

to any person, personally identifiable information concerning any consumer shall be liable to the 

aggrieved person for the relief provided in subsection (d).” 18 U.S.C. § 2710(b)(1). Defendants 

violated the VPPA by knowingly disclosing such “personally identifiable information” to 

Facebook and Google. 

395. Defendants are “video tape service providers” under 18 U.S.C. § 2710(a)(4) because 

they “engaged in the business, in or affecting interstate or foreign commerce, of rental, sale, or

delivery of prerecorded video cassette tapes or similar audio-visual materials.” Defendants are

engaged in the business of delivering video content and services to Plaintiffs and the Class.

Defendants’ platform allows TikTok users to create, post, share, view, and otherwise engage

with videos. Defendants’ platform is built to deliver video content to consumers, and Defendants

regularly delivered videos to Plaintiffs and the Class by making those materials electronically

available to Plaintiffs and the Class on Defendants’ platform. Defendants also allowed TikTok 

users to create and share videos with a non-public audience.

396. Plaintiffs and the Class are “consumers” under 18 U.S.C. § 2710(a)(1) because

they are “subscriber[s] of goods or services” from Defendants. Plaintiffs and the Class are

registered TikTok users who use the TikTok app through interaction with it. Plaintiffs and the Class 

were required to provide “personally identifiable information” to TikTok, including date of birth,

in order to sign up, become registered users, establish user profiles, to subscribe to “follow” other

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 109 of 120 PageID #:1981
109

accounts, and to contribute to TikTok’s video streaming content. By signing up for accounts

with TikTok, becoming registered users, establishing user profiles, providing TikTok with

personal information, and spending time and attention using and contributing to TikTok’s video 

streaming platform, Plaintiffs and the Class entered into transactions with Defendants to obtain 

access to TikTok’s content and services and for the purpose of subscribing to TikTok’s video 

streaming content and services.

397. The VPPA defines “personally identifiable information” to “include[] information 

which identifies a person as having requested or obtained specific video materials or services from 

a video tape service provider.” 18 U.S.C. § 2710(a)(1)(3). Defendants “knowingly disclose[d]” to 

Facebook and Google each TikTok user’s “personally identifiable information,” including: (1) 

what specific videos each TikTok user has watched; (2) whether each TikTok user has engaged 

with a specific video by “liking” and/or “favoriting” it; and (3) the identities of other TikTok users 

that each TikTok user “follows.” Defendants also disclosed each TikTok user’s device ID and 

advertising ID to Facebook and Google, which personally identifies each TikTok user to an 

ordinary person and matches each TikTok user to their video viewing history when transmitted to 

Facebook and Google.

398. Defendants’ pairing of the TikTok user’s device ID and advertising ID with that 

user’s video viewing history violatesthe VPPA because it discloses to Facebook and Google the videos 

that a specific TikTok user has requested or obtained. While the VPPA permits the disclosure of such 

“personally identifiable information” to third parties by “informed written consent,” the requisite 

consent must be “in a form distinct and separate from any form setting forth other legal or financial 

obligations of the consumer.” 18 U.S.C. § 2710(b)(2)(B)(i). No such consent was obtained by 

Defendants. Nor can this defect be cured after-the-fact. The VPPA provides that the requisite 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 110 of 120 PageID #:1982
110

written consent must (at the election of the consumer) be “given at the time the disclosure is

sought” or “given in advance for a set period of time, not to exceed 2 years or until consent is

withdrawn by the consumer, whichever is sooner.” 18 U.S.C. § 2710(b)(2)(B)(ii).

399. Defendants’ disclosures to Facebook and Google are not subject to a statutory 

exception for disclosures that are incident to “the ordinary course of business of the video tape 

provider,” see 18 U.S.C. § 2710(b)(2)(E), which exception is limited to debt collection activities, 

order fulfillment, request processing, and the transfer of ownership. 18 U.S.C. § 2710(a)(2). 

Facebook and Google are not involved in any such activities here. 

400. The VPPA also requires that “[a] person subject to the section shall destroy 

personally identifiable information as soon as practicable, but no later than one year from the date 

the information is no longer necessary for the purposes for which it was collected . . . .” 18 U.S.C. 

§ 2710(e). In violation of the VPPA, Defendants have not destroyed this “personally identifiable 

information” and instead continue to maintain it.

401. Plaintiffs and the Class seek to recover actual damages, not less than liquidated 

damages in the amount of $2,500 per Plaintiff/Class member, punitive damages, attorneys’ fees 

and costs, and such other preliminary and equitable relief as the Court determines to be appropriate. 

18 U.S.C. § 2710(c)(2)(A)-(D).

NINTH CAUSE OF ACTION

Violation of Illinois’s Biometric Information Privacy Act, 740 ILCS 14/1, et seq.

(On Behalf of the Illinois Plaintiffs and the Illinois Subclass)

402. Plaintiffs repeat and incorporate by reference all preceding paragraphs as if fully 

set forth herein.

403. BIPA makes it unlawful for any private entity to, among other things, “collect, 

capture, purchase, receive through trade, or otherwise obtain a person’s or a customer’s biometric 

identifiers or biometric information, unless it first: (1) informs the subject . . . in writing that a 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 111 of 120 PageID #:1983
111

biometric identifier or biometric information is being collected or stored; (2) informs the subject . 

. . in writing of the specific purpose and length of term for which a biometric identifier or biometric 

information is being collected, stored, and used; and (3) receives a written release executed by the 

subject of the biometric identifier or biometric information or the subject’s legally authorized 

representative.” 740 ILCS 14/15(b).

404. At all relevant times, the Illinois Plaintiffs were residents of Illinois and each is a 

“person” and/or a “customer” within the meaning of BIPA. 740 ILCS 14/15(b). The minor Illinois 

Plaintiffs’ legal guardians are their “legally authorized representative[s]” within the meaning of 

BIPA, and served in such capacity at all times relevant to this action. Id.

405. Each Defendant is, and at all relevant times was, a “corporation, limited liability 

company, association, or other group, however organized,” and thus is, and at all relevant times 

was, a “private entity” under the BIPA. 740 ILCS 14/10.

406. The Illinois Plaintiffs and the Illinois Subclass had their “biometric identifiers,” 

including their face geometry scans, as well as their “biometric information” collected, captured, 

received, or otherwise obtained by Defendants as a result of the Illinois Plaintiffs’ and the Illinois 

Subclass’s use of the TikTok app. 740 ILCS 14/10.

407. At all relevant times, Defendants systematically and surreptitiously collected, 

captured, received or otherwise obtained the Illinois Plaintiffs’ and the Illinois Subclass’s

“biometric identifiers” and “biometric information” without first obtaining signed written releases, 

as required by 740 ILCS 14/15(b)(3), from any of them or their “legally authorized 

representatives.”

408. In fact, Defendants failed to properly inform the Illinois Plaintiffs and the Illinois 

Subclass, or any of their parents, legal guardians, or other “legally authorized representatives,” in 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 112 of 120 PageID #:1984
112

writing (or in any other way) that the Illinois Plaintiffs’ and the Illinois Subclass’s “biometric 

identifiers” and “biometric information” were being “collected or stored” by Defendants. Nor did 

Defendants inform the Illinois Plaintiffs and the Illinois Subclass, or any of their parents, legal 

guardians, or other “legally authorized representatives,” in writing of the specific purpose and 

length of term for which the Illinois Plaintiffs’ and the Illinois Subclass’s “biometric identifiers” 

and “biometric information” were being “collected, stored and used” as required by 740 ILCS 

14/15(b)(1)-(2).

409. BIPA also makes it unlawful for a private entity “in possession of a biometric 

identifier or biometric information” to “sell, lease, trade, or otherwise profit from a person’s or a 

customer’s biometric identifier or biometric information.” 740 ILCS 14/15(c).

410. Defendants are, and at all relevant times were, “in possession of” the Illinois 

Plaintiffs’ and the Illinois Subclass’s “biometric identifiers,” including but not limited to their face 

geometry scans, and “biometric information.” Defendants profited from such “biometric 

identifiers” and “biometric information” by using them for targeted advertising, improvements to 

Defendants’ artificial intelligence technologies, Defendants’ patent applications, and the 

generation of increased demand for and use of Defendants’ other products. 740 ILCS 14/15(c).

411. Finally, BIPA prohibits private entities “in possession of a biometric identifier or 

biometric information” from “disclos[ing], redisclos[ing], or otherwise disseminat[ing] a person’s 

or a customer’s biometric identifier or biometric information unless” any one of four enumerated 

conditions are met. 740 ILCS 14/15(d)(1)-(4). None of such conditions are met here.

412. Defendants disclose, redisclose and disseminate, and at all relevant times disclosed, 

redisclosed and disseminated, the Illinois Plaintiffs’ and the Illinois Subclass’s “biometric 

identifiers,” including but not limited to their face geometry scans, and “biometric information” 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 113 of 120 PageID #:1985
113

without the consent of any of them or their “legally authorized representatives.” 740 ILCS 

14/15(d)(1). Moreover, the disclosures and redisclosures did not “complete[] a financial 

transaction requested or authorized by” the Illinois Plaintiffs, the Illinois Subclass or any of their 

legally authorized representatives. 740 ILCS 14/15(d)(2). Nor are, or at any relevant times were, 

the disclosures and redisclosures “required by State or federal law or municipal ordinance.” 740 

ILCS 14/15(d)(3). Finally, at no point in time were the disclosures ever “required pursuant to a 

valid warrant or subpoena issued by a court of competent jurisdiction.” 740 ILCS 14/15(d)(4).

413. BIPA mandates that a private entity “in possession of biometric identifiers or 

biometric information” “develop a written policy, made available to the public, establishing a 

retention schedule and guidelines for permanently destroying biometric identifiers and biometric 

information when the initial purpose for collecting or obtaining such identifiers or information has 

been satisfied or within 3 years of the individual’s last interaction with the private entity, whichever 

occurs first.” 740 ILCS 14/15(a). 

414. But Defendants do not publicly provide any written policy establishing any

retention schedule or guidelines for permanently destroying the Illinois Plaintiffs’ and the Illinois 

Subclass’s “biometric identifiers” and “biometric information.” 740 ILCS 14/15(a).

415. BIPA also commands private entities “in possession of a biometric identifier or 

biometric information” to: (1) store, transmit, and protect from disclosure all biometric identifiers 

and biometric information using the reasonable standard of care within the private entity’s 

industry; and (2) store, transmit, and protect from disclosure all biometric identifiers and biometric 

information in a manner that is the same as or more protective than the manner in which the private 

entity stores, transmits and protects other confidential and sensitive information. 740 ILCS 

14/15(e). Based on the facts alleged herein, including Defendants’ lack of a public written policy, 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 114 of 120 PageID #:1986
114

their failure to inform TikTok users that Defendants obtain such users’ “biometric identifiers” and 

“biometric information,” their failure to obtain written consent to collect or otherwise obtain 

TikTok users’ “biometric identifiers” and “biometric information,” and their unauthorized 

dissemination of TikTok users’ “biometric identifiers” and “biometric information,” Defendants 

have violated this provision too.

416. Defendants recklessly or intentionally violated each of BIPA’s requirements and 

infringed the Illinois Plaintiffs’ and the Illinois Subclass’s rights to keep their immutable and 

uniquely identifying biometric identifiers and biometric information private. As individuals 

subjected to each of Defendants’ BIPA violations above, the Illinois Plaintiffs and the Illinois 

Subclass are and have been aggrieved. 740 ILCS 14/20.

417. On behalf of themselves and the Illinois Subclass, the Illinois Plaintiffs seek: (1) 

injunctive and equitable relief as is necessary to protect the interests of the Illinois Plaintiffs and 

the Illinois Subclass by requiring Defendants to comply with BIPA’s requirements; (2) $1,000.00

or actual damages, whichever is greater, for each negligent violation of BIPA by Defendants; (3) 

$5,000.00 or actual damages, whichever is greater, for each intentional or reckless violation of 

BIPA by Defendants; and (4) reasonable attorneys’ fees and costs, including expert witness fees 

and other litigation expenses. 740 ILCS 14/20(1)-(4).

TENTH CAUSE OF ACTION

Violation of the State Consumer Protection Statutes

(On Behalf of Plaintiffs and the Multi-State Consumer Protection Class)

418. Plaintiffs incorporate and reallege by reference each and every allegation contained 

in paragraphs 1-333 as if fully set forth herein.

419. In the alternative to a nationwide class, Plaintiffs bring this action individually and 

on behalf of the Multi-State Consumer Protection Class.

420. Plaintiffs and Class members have been injured as a result of Defendants’ violations 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 115 of 120 PageID #:1987
115

of the state consumer protection statutes listed above in paragraph 322 and footnote 167, which 

also provide a basis for redress to Plaintiffs and Class members based on Defendants’ fraudulent, 

deceptive, unfair and unconscionable acts, practices and conduct.

421. Defendants’ conduct as alleged herein violates the consumer protection, unfair 

trade practices and deceptive acts laws of each of the jurisdictions encompassing the Multi-State 

Consumer Protection Class.

422. Defendants committed unfair and deceptive acts by surreptitiously accessing, 

collecting, storing, and/or disclosing Plaintiffs’ and the Class’s private information and data.

423. Defendants violated the Multi-State Consumer Protection Class states’ unfair and 

deceptive acts and practices laws by engaging in these unfair or deceptive acts or practices.

424. Plaintiffs and the Class were injured and have suffered damages as a direct and 

proximate result of Defendants’ unfair acts and practices.

425. Plaintiffs and the other Multi-State Consumer Protection Class Members’ injuries 

were proximately caused by Defendant’s unfair and deceptive business practices.

426. As a result of Defendants’ violations, Defendants have been unjustly enriched.

427. Pursuant to the aforementioned states’ unfair and deceptive practices laws, 

Plaintiffs and Class members are entitled to recover compensatory damages, restitution, punitive 

and special damages including but not limited to treble damages, reasonable attorneys’ fees and 

costs and other injunctive or declaratory relief as deemed appropriate or permitted pursuant to the 

relevant law.

XIV. PRAYER FOR RELIEF

WHEREFORE, Plaintiffs respectfully request relief against Defendants as set forth below:

a) entry of an order certifying the proposed class and subclass pursuant to Federal Rule of 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 116 of 120 PageID #:1988
116

Civil Procedure 23;

b) entry of an order appointing Plaintiffs as representatives of the class and subclass;

c) entry of an order appointing Plaintiffs’ counsel as co-lead counsel for the class and 

subclass;

d) entry of an order for injunctive and declaratory relief as described herein, including but 

not limited to:

i. enjoining Defendants, their affiliates, associates, officers, employees and 

agents from transmitting TikTok user data and content to China, to other 

locations or facilities where such TikTok user data and content is accessible 

from within China, and/or to anyone outside the defendant companies;

ii. enjoining Defendants, their affiliates, associates, officers, employees and 

agents from taking TikTok users’ private draft videos (including any frames,

digital images or other content from such videos) and biometric identifiers 

and information without advanced notice to, and the prior written consent of, 

such TikTok users or their legally authorized representatives (and, for the 

Illinois Subclass, without being in compliance with BIPA);

iii. enjoining Defendants, their affiliates, associates, officers, employees and 

agents from taking physical/digital location tracking data, device ID data, 

personally identifiable data and any other TikTok user data and content 

except that for which appropriate notice and consent is provided and which 

Defendants can show to be reasonably necessary for the lawful operation of 

the TikTok app within the United States;

iv. enjoining Defendants, their affiliates, associates, officers, employees and 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 117 of 120 PageID #:1989
117

agents from sharing TikTok users’ video viewing histories unless in 

compliance with the Video Privacy Protection Act;

v. mandating that Defendants, their affiliates, associates, officers, employees 

and agents recall and destroy the TikTok user data and content already taken 

in violation of law;

vi. mandating that Defendants, their affiliates, associates, officers, employees 

and agents remove from the TikTok app all SDKs based in China or whose 

data is otherwise accessible from within China;

vii. mandating that Defendants, their affiliates, associates, officers, employees 

and agents implement protocols to ensure that no TikTok user data and 

content is transmitted to, or otherwise accessible from within, China;

viii. mandating that Defendants, their affiliates, associates, officers, employees 

and agents hire third-party monitors for a period of at least three years to 

ensure that all of the above steps have been taken; and

ix. mandating that Defendants, their affiliates, associates, officers, employees 

and agents provide written verifications on a quarterly basis to the court and 

counsel for the Plaintiffs in the form of a declaration under oath that the 

above steps have been satisfied.

e) entry of judgment in favor of each class and subclass member for damages suffered as 

a result of the conduct alleged herein, including compensatory, statutory, and punitive 

damages, restitution, and disgorgement, to include interest and prejudgment interest;

f) award Plaintiffs reasonable attorneys’ fees and costs; and

g) grant such other and further legal and equitable relief as the court deems just and 

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 118 of 120 PageID #:1990
118

equitable.

XV. DEMAND FOR JURY TRIAL.

Plaintiffs demand a trial by jury on all issues so triable.

Dated: December 18, 2020 Respectfully submitted,

/s/ Elizabeth A. Fegan

Elizabeth A. Fegan

FEGAN SCOTT LLC

150 South Wacker Drive

24th Floor

Chicago, IL 60606

Tel: (312) 741-1019

beth@feganscott.com

Katrina Carroll

CARLSON LYNCH, LLP

111 W. Washington Street

Suite 1240

Chicago, IL 60602

Tel: (312) 750-1265

kcarroll@carlsonlynch.com

Ekwan E. Rhow

BIRD, MARELLA, BOXER, 

WOLPERT, NESSIM, DROOKS, 

LINCENBERG & RHOW, P.C.

1875 Century Park East, 23rd Floor

Tel: (310) 201-2100

erhow@birdmarella.com

Co-Lead Counsel for Plaintiffs and the 

Class

-andJonathan M. Jagher

FREED KANNER LONDON & 

MILLEN LLC

923 Fayette St.

Conshohocken, PA 19428

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 119 of 120 PageID #:1991
119

Tel.: (610) 234-6487

Fax: (224) 632-4521

jjagher@fklmlaw.com

Megan E. Jones

HAUSFELD LLP

1700 K Street NW, Suite 650

Washington, D.C. 20006

(202) 540-7200

Michael Gervais

SUSMAN GODFREY LLP

1900 Avenue of the Stars

Suite 1400

Los Angeles, CA 90067

Tel: (310) 789-3100

mgervais@susmangodfrey.com

Amanda Klevorn

BURNS CHAREST LLP

365 Canal Street, Suite 1170

New Orleans, Louisiana 70115

Tel: (504) 779-2845

aklevorn@burnscharest.com

Albert Y. Chang

BOTTINI & BOTTINI, INC.

7817 Ivanhoe Avenue

Suite 102

La Jolla, CA 92037

Tel: (858) 914-2001

achang@bottinilaw.com

Plaintiffs’ Steering Committee

-andShannon Marie McNulty 

CLIFFORD LAW OFFICES, P.C. 

120 North LaSalle Street, Suite 3100 

Chicago, IL 60602 

(312) 899-9090 

smm@cliffordlaw.com

Plaintiffs’ Liaison Counsel

Case: 1:20-cv-04699 Document #: 114 Filed: 12/18/20 Page 120 of 120 PageID #:1992