UNITED STATES DISTRICT COURT 

NORTHERN DISTRICT OF ILLINOIS 

EASTERN DIVISION 

IN RE TIKTOK, INC. PRIVACY 

LITIGATION 

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

MDL No. 2948 

This Document Relates to: 

Case No. 1:20-cv-04723 

CONSOLIDATED AMENDED CLASS 

ACTION COMPLAINT BY INTERIM 

LEAD COUNSEL FOR THE NORTHERN 

DISTRICT OF CALIFORNIA FOR: 

(1) Violation of the Computer Fraud and 

Abuse Act, 18 U.S.C. § 1030 

(2) Violation of the California 

Comprehensive Data Access and Fraud 

Act, Cal. Pen. C. § 502 

(3) Violation of the Right to Privacy - 

California Constitution 

(4) Intrusion upon Seclusion 

(5) Violation of the California Unfair 

Competition Law, Bus. & Prof. C. §§ 

17200 et seq. 

(6) Violation of the California False 

Advertising Law, Bus. & Prof. C. §§ 17500 

et seq. 

(7) Negligence 

(8) Restitution / Unjust Enrichment 

(9) Violation of the Illinois Biometric 

Information Privacy Act, 740 ILCS 14/1, 

et seq. 

(10) Violation of the Video Privacy 

Protection Act, 18 U.S.C. § 2710 et seq.

DEMAND FOR JURY TRIAL 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 1 of 113 PageID #:1063
 1 

I. INTRODUCTION. 

1. TikTok is one of the most popular entertainment apps for mobile devices in the 

United States. It has acquired one of the largest installed user bases in the country on the strength 

of its popular 15-second videos of fun activities like dancing, lip-syncing, and stunts. Unknown 

to its users, however, the TikTok app also includes China-based surveillance software. The 

TikTok app clandestinely has vacuumed up and transferred to servers in China (and to other 

servers accessible from within China) vast quantities of private and personally-identifiable user 

data and content that can be employed to identify, profile and track the physical and digital 

location and activities of United States users now and in the future. 

2. The TikTok app also surreptitiously has taken TikTok users’ private draft videos 

they never intended for publication – without notice or consent. Defendants and their 

sophisticated China-based engineering team covertly mine these private videos, as well as 

publicly posted TikTok user videos, for highly sensitive and immutable biometric identifiers and 

information. In addition to this mining of TikTok user videos at the server level in China, the 

functionality and code of the TikTok app itself evidences Defendants’ collection and use of 

TikTok users’ biometric identifiers and information – again without notice or consent. 

3. Defendants also covertly transmit personally identifiable information about each 

TikTok user’s video viewing history to third parties without notice or consent, in violation of the 

Video Privacy Protection Act (“VPPA”), resulting in billions of dollars in statutory damages 

given the over 100 million members of the class. 

4. In short, the TikTok app’s lighthearted fun comes at a heavy cost. Meanwhile, 

Defendants unjustly profit from the secret harvesting of this massive array of private and 

personally-identifiable TikTok user data and content by using it for targeted advertising, 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 2 of 113 PageID #:1064
 2 

improvements to Defendants’ artificial intelligence technologies, the filing of patent applications, 

and the development of consumer demand for, and use of, Defendants’ other products. 

Defendants also put their users at risk by making their data available to the Chinese government, 

in order to assist the Chinese government in meeting two crucial and intertwined state objectives: 

(a) world dominance in artificial intelligence; and (b) population surveillance and control 

Defendants’ conduct violates statutory, constitutional, and common law privacy, data, biometrics 

and consumer protections, and it should be stopped. 

II. THE PARTIES. 

A. The Plaintiffs. 

5. Plaintiff Misty Hong is, and at all relevant times was, an individual and resident 

of Palo Alto, California. 

6. Plaintiff A.S., a minor, is, and at all relevant times was, an individual and resident 

of Stevenson Ranch, California. A.S. brings this suit by and through her mother and legal 

guardian, Laurel Slothower, who is, and at all relevant times was, an individual and resident of 

Stevenson Ranch, California. 

7. Plaintiff A.R., a minor, is, and at all relevant times was, an individual and resident 

of Pasadena, California. A.R. brings this suit by and through her mother and legal guardian, 

Gilda Avila, who is, and at all relevant times was, an individual and resident of Pasadena, 

California.1

8. Plaintiff Meghan Smith is, and at all relevant times was, an individual and 

resident of Champagne, Illinois. 

9. Plaintiffs C.W., a minor, and I.W., a minor, are, and at all relevant times were, 

 

1

 Plaintiffs Misty Hong, A.S. and A.R. are collectively referred to as the “California Plaintiffs.” 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 3 of 113 PageID #:1065
 3 

individuals and residents of Chicago, Illinois. C.W. and I.W. bring this suit by and through their 

mother and legal guardian, Mikhaila Woodall, who is, and at all relevant times was, an 

individual and resident of Chicago, Illinois. 

10. Plaintiff R.P., a minor, is, and at all relevant times was, an individual and resident 

of Chicago, Illinois. R.P. brings this suit by and through her mother and legal guardian, Lynn 

Pavalon, who is, and at all relevant times was, an individual and resident of Chicago, Illinois. 

11. Plaintiff P. S., a minor, is, and at all relevant times was, an individual and resident 

of Illinois. P. S. brings this suit by and through her legal guardian, Cherise Slate, who is, and at 

all relevant times was, an individual and resident of Carpentersville, Illinois. 

12. Plaintiff M. T. W., a minor, is, and at all relevant times was, an individual and 

resident of Illinois. M. T. W. brings this suit by and through her legal guardian, Brenda 

Washington, who is, and at all relevant times was, an individual and resident of Country Club 

Hills, Illinois.2

B. The Defendants. 

13. Defendant ByteDance, Inc. is, and at all relevant times was, a Delaware 

corporation with its principal place of business in Palo Alto, California. Defendant ByteDance, 

Inc. is a wholly-owned subsidiary of ByteDance, Ltd., a Cayman Islands corporation. 

14. Defendant TikTok, Inc. f/k/a Musical.ly, Inc. (“TikTok, Inc.”) is, and at all 

relevant times was, a California corporation with its principal place of business in Culver City, 

California.3

 Defendant TikTok, Inc. also maintains offices in Palo Alto, California and Mountain 

 

2

 Plaintiffs Meghan Smith, C.W., I.W., R.P., P.S. and M.T.W. are collectively referred to as the 

“Illinois Plaintiffs.” The California Plaintiffs and the Illinois Plaintiffs are collectively referred to 

as the “Plaintiffs.” The amendments herein are on behalf of Plaintiffs other than Misty Hong. 

3 https://www.cnbc.com/2019/10/14/tiktok-has-mountain-view-office-near-facebook-poachingCase: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 4 of 113 PageID #:1066
 4 

View, California.4

 The name change from Musical.ly, Inc. to TikTok, Inc. occurred in May 2019. 

Defendant TikTok, Inc. is a wholly-owned subsidiary of TikTok, LLC, which in turn is a whollyowned subsidiary of TikTok, Ltd. And TikTok, Ltd. – like Defendant ByteDance, Inc. – is a 

wholly owned subsidiary of ByteDance, Ltd. 

15. Defendant Musical.ly n/k/a TikTok, Ltd. is, and at all relevant times was, a 

Cayman Island corporation with its principal place of business in Shanghai, China. Defendant 

Musical.ly was the parent company of Musical.ly, Inc. Defendant Musical.ly changed its name to 

TikTok, Ltd. and, as noted above, is a wholly-owned subsidiary of ByteDance, Ltd. 

16. Defendant Beijing ByteDance Technology Co. Ltd. (“Beijing ByteDance”) is, and 

at all relevant times was, a privately held company headquartered in Beijing, China. Defendant 

Beijing ByteDance is a wholly-owned subsidiary of ByteDance Co., Ltd., which is also 

headquartered in Beijing, China. ByteDance Co., Ltd. is owned by founder Zhang Yiming 

(98.8%) and Zhang Lidong (1.2%). Defendant Beijing ByteDance and ByteDance Co., Ltd. 

operate as one company. 

17. ByteDance, Ltd. owns 100% of ByteDance (HK) Co., Ltd., which is 

headquartered in Hong Kong. ByteDance (HK) Co., Ltd. in turn owns 100% of Beijing 

ByteDance Network Technology Co., Ltd., which is headquartered in Beijing, China. 

C. Alter Ego And Single Enterprise Allegations. 

18. At all relevant times, Defendants TikTok, Inc. and ByteDance, Inc. have shared 

 

employees.html. 

4 https://www.washingtonpost.com/technology/2019/11/05/inside-tiktok-culture-clash-where-usviews-about-censorship-often-were-overridden-by-chinese-bosses/; 

https://www.cnbc.com/2019/10/14/tiktok-has-mountain-view-office-near-facebook-poachingemployees.html. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 5 of 113 PageID #:1067
 5 

offices in Silicon Valley5

 and also have shared employees. U.S. and China-based employees of 

the ByteDance family of companies perform work on and concerning the TikTok app that is at 

the center of this lawsuit, including the functionality and operation of the TikTok app and the 

Chinese version of the app (“Douyin”) that Defendant Beijing ByteDance operates in China. One 

Director of Engineering in the Mountain View office leads an “augmented reality” team that is 

tasked with transforming state-of-the-art artificial intelligence and augmented reality 

technologies into “fun features” and “creative tools” for both the TikTok and Douyin apps. 

19. At all relevant times, Defendant Beijing ByteDance has directed the operations of 

Defendants TikTok, Inc. and ByteDance, Inc. with respect to the TikTok app, and Defendants 

TikTok, Inc. and ByteDance, Inc. have reported to Defendant Beijing ByteDance. In fact, at all 

relevant times, Defendant Beijing ByteDance has collected and analyzed data from the United 

States regarding the performance of various features of the TikTok app, and has worked with 

Defendants TikTok, Inc. and Defendant ByteDance, Inc. to address performance issues. 

Additionally, at all relevant times, Defendant Beijing ByteDance and its engineers have done 

significant coding for the TikTok app and its many versions and updates. 

20. At certain relevant times, with respect to Defendants’ monitoring and censorship 

of content on the TikTok app, management in China has determined content review policies 

enforced in Defendant TikTok, Inc.’s Culver City office; a content review manager in the same 

Culver City office was reporting to someone in China; and another content reviewer was 

required to seek authorization from someone in China in order to access non-published 

information about user accounts when content concerns arose. Also, at certain relevant times 

 

5

 In addition to ByteDance-TikTok cross-listed personnel in Palo Alto, TikTok logos and 

paraphernalia are found in the ByteDance, Inc. Palo Alto office. See

https://www.youtube.com/watch?v=RymGJG0miv0. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 6 of 113 PageID #:1068
 6 

Defendant Beijing ByteDance employed a vast number of content reviewers in China to review 

TikTok videos uploaded by United States users, and these reviewers in China had authority to 

take down any such videos if the content was deemed inappropriate or illegal. 

21. These facts are consistent with public reporting. For example, “[m]ultiple TikTok 

sources, who spoke with The Intercept on the condition of anonymity ..., emphasized the 

primacy of ByteDance’s Beijing HQ over the global TikTok operation, explaining that their 

ever-shifting decisions about what’s censored and what’s boosted are dictated by Chinese 

staff, whose policy declarations are then filtered around TikTok’s 12 global offices, translated 

into rough English, finally settling into a muddle of Beijing authoritarianism crossed with the 

usual Silicon Valley prudishness.”6

22. Defendant Beijing ByteDance employees have collected TikTok users’ feedback 

regarding upgraded and/or newly-introduced features, and the departments responsible for 

managing and monitoring TikTok user experience have been based in China. Employees in these 

departments reported to their supervisors in China, who in turn shared their findings with 

Defendant TikTok, Inc. in the United States. Defendant Beijing ByteDance employees also 

distributed questionnaires to TikTok users, and collected and recorded reports from such users 

about problems they were experiencing. Employees in the United States contacted TikTok users, 

and took notes regarding such users’ experiences. These notes were translated into Chinese and 

sent to Defendant Beijing ByteDance executives to review and analyze. 

23. Defendant Beijing ByteDance made key strategy decisions for Defendants 

TikTok, Inc. and ByteDance, Inc., as well as for offices elsewhere in the world, and Defendants 

TikTok, Inc., ByteDance, Inc. and the other offices were tasked with executing such decisions. A 

 

6 https://theintercept.com/2020/03/16/tiktok-app-moderators-users-discrimination/. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 7 of 113 PageID #:1069
 7 

publicly-available interview of Isaac Bess and Gregory Justice on YouTube is consistent with 

these facts. In that interview, Isaac Bess identifies himself as responsible for leading 

“ByteDance” business development from Los Angeles, and Gregory Justice identifies himself as 

part of Defendant TikTok, Inc.’s content team in Los Angeles. Both discuss having regular allhands bi-monthly meetings with the CEO in China to discuss global strategy with the “local 

teams.”7

24. At all relevant times, and in connection with the matters alleged herein, each 

Defendant acted as an agent, servant, partner, joint venturer and/or alter ego of each of the other 

Defendants, and acted in the course and scope of such agency, partnership, and relationship 

and/or in furtherance of such joint venture. Each Defendant acted with the knowledge and 

consent of each of the other Defendants and/or directed, authorized, affirmed, consented to, 

ratified, encouraged, approved, adopted, and/or participated in the acts or transactions of the 

other Defendants. 

25. At all relevant times, and in connection with the matters alleged herein, 

Defendants were controlled and largely-owned by the same person, founder Zhang Yiming, and 

constitute a single enterprise with a unity of interest. Recognition of the privilege of separate 

existence under such circumstances would promote injustice. 

III. JURISDICTION AND VENUE. 

26. This Court has subject matter jurisdiction over this action pursuant to 28 U.S.C. § 

1332(d) & 1367 because: (i) this is a class action in which the matter in controversy exceeds the 

sum of $5,000,000, exclusive of interest and costs; (ii) there are 100 or more class members; and 

(iii) some members of the class are citizens of states different from some Defendants, and also 

 

7 https://www.youtube.com/watch?v=lKV6wsdI4-A (at 0:20 – 0:54; 15:59 – 17:08). 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 8 of 113 PageID #:1070
 8 

because two Defendants are citizens or subjects of a foreign state. 

27. This Court has personal jurisdiction over Defendants because: (i) they transact 

business in the United States, including in this District; (ii) they have substantial aggregate 

contacts with the United States, including in this District; (iii) they engaged and are engaging in 

conduct that has and had a direct, substantial, reasonably foreseeable, and intended effect of 

causing injury to persons throughout the United States, including in this District, and purposely 

availed themselves of the laws of the United States. 

28. In accordance with 28 U.S.C. § 1391, venue is proper in this District because: (i) 

a substantial part of the conduct giving rise to the claims occurred in and/or emanated from this 

District; (ii) Defendants transact business in this District; (iii) one Defendant has its principal 

place of business in this District; (iv) two Defendants have offices in this District; and (v) 

Plaintiff Misty Hong resides in this District. 

IV. THE GROWTH OF DEFENDANTS AND THEIR DANGEROUS APPS. 

A. Defendant Beijing ByteDance Becomes A China-Based Tech Giant Focused 

On Overseas Markets, Particularly In The United States. 

29. Defendant Beijing ByteDance was founded in 2012 and makes a variety of video 

and news-aggregation apps.8

 It “regards its platforms as part of an artificial intelligence company 

powered by algorithms that ‘learn’ each user’s interests and preferences through repeat 

interaction.”9

 Because Defendant Beijing ByteDance emerged only after other China-based tech 

giants already had taken over the market in China, Defendant Beijing ByteDance has looked to 

 

8 https://www.wsj.com/articles/tiktoks-videos-are-goofy-its-strategy-to-dominate-social-mediais-serious-11561780861. 

9 https://www.law360.com/articles/1213180/sens-want-tiktok-investigated-for-national-securitythreats; https://www.cotton.senate.gov/?p=press_release&id=1239. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 9 of 113 PageID #:1071
 9 

overseas markets, including those in the United States, for growth.10

30. Defendant Beijing ByteDance had $7.2 billion in annual revenue for the year 

2018. It far surpassed this number in 2019, booking $7 billion to $8.4 billion in revenue in a 

better-than-expected result for the first half of 2019.11 Defendant Beijing ByteDance currently is 

worth between $75 billion and $78 billion.12 Investors in Defendant Beijing ByteDance include 

Sequoia Capital China, Russian billionaire Yuri Milner, Japanese technology giant SoftBank, 

and big private-equity firms such as KKR, General Atlantic, and Hillhouse Capital Group.13

31. Most of Defendant Beijing ByteDance’s revenue is generated from advertising.14

“ByteDance has [] been doubling down on its advertising business as the company’s 

management sets increasingly ambitious revenue goals.”15 “As with pretty much all major social 

media and content startups, ByteDance monetises through advertising. Specifically, it runs 

targeted advertising within user feeds – providing them promotional content in between using the 

app.”16

 

10 https://www.wsj.com/articles/tiktoks-videos-are-goofy-its-strategy-to-dominate-social-mediais-serious-11561780861. 

11 https://www.cnbc.com/2019/09/30/tiktok-owner-bytedances-first-half-revenue-better-thanexpected-at-over-7-billion-sources.html. 

12 https://www.washingtonpost.com/technology/2019/11/05/inside-tiktok-culture-clash-whereus-views-about-censorship-often-were-overridden-by-chinese-bosses/; 

https://www.reuters.com/article/us-tiktok-cfius-exclusive/exclusive-us-opens-national-securityinvestigation-into-tiktok-sources-idUSKBN1XB4IL. 

13 https://www.wsj.com/articles/lip-syncing-app-musical-ly-is-acquired-for-as-much-as-1-

billion-1510278123; https://www.reuters.com/article/us-tiktok-cfius-exclusive/exclusive-usopens-national-security-investigation-into-tiktok-sources-idUSKBN1XB4IL. 

14 https://www.bloomberg.com/news/articles/2019-01-15/bytedance-is-said-to-hit-lower-end-ofsales-goal-amid-slowdown. 

15 https://technode.com/2019/09/20/bytedance-launches-video-ad-tools-for-tiktok-douyin/. 

16 https://www.businessofapps.com/insights/bytedance-social-media-advertising-company/. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 10 of 113 PageID #:1072
 10 

B. The Musical.ly App Evolves Into The TikTok App. 

32. Defendant Musical.ly (named, and now known as, TikTok, Ltd.) and Defendant 

Musical.ly, Inc. (named, and now known as, TikTok, Inc.) launched the highly-popular social 

media and social networking app “Muscial.ly” in 2014. This app allows its users to (i) create 

video selfies of themselves dancing and/or lip-syncing with a musical soundtrack in the 

background, and (ii) share such videos with friends.17 There are simple tools provided by the 

Musical.ly app that users can utilize to create and edit these videos, and the app provides a large 

online music library from which users may select their background music. The Musical.ly app 

was designed “to capture the YouTube phenomenon of teenagers sharing videos of themselves 

singing or dancing to popular music.”18 Beyond the creation and sharing of videos, the 

Musical.ly app provides a platform through which users can interact, including by commenting 

on other users’ videos and “following” other users’ accounts. Users also can send direct 

messages in order to communicate with other users on the app. By November 2017, the 

Musical.ly app had 60 million monthly active users.19

33. Meanwhile, in 2016, Defendant Beijing ByteDance launched its own app called 

“Douyin” in China, which mimicked the Musical.ly app.20 By 2017, shortly before its purchase 

of Defendants Musical.ly and Musical.ly, Inc., Defendant Beijing ByteDance introduced an 

 

17 https://www.wsj.com/articles/lip-syncing-app-musical-ly-is-acquired-for-as-much-as-1-

billion-1510278123. 

18 https://www.wsj.com/articles/lip-syncing-app-musical-ly-is-acquired-for-as-much-as-1-

billion-1510278123. 

19 https://www.wsj.com/articles/lip-syncing-app-musical-ly-is-acquired-for-as-much-as-1-

billion-1510278123; https://www.nytimes.com/2019/11/01/technology/tiktok-national-securityreview.html. 

20 https://www.wsj.com/articles/tiktoks-videos-are-goofy-its-strategy-to-dominate-social-mediais-serious-11561780861. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 11 of 113 PageID #:1073
 11 

English-language version of the Douyin app outside China under the name “TikTok.” In August 

2018, after having acquired Defendants Musical.ly and Musical.ly, Inc., Defendant Beijing 

ByteDance combined the Musical.ly app with its TikTok app, merging all existing accounts and 

data into a single app under the retained “TikTok” name.21

34. The Musical.ly and TikTok apps are hereafter collectively referred to as the 

“TikTok app,” and the Musical.ly and TikTok users are hereafter collectively referred to as the 

“TikTok users.” 

C. The TikTok App Becomes A Global Phenomenon With A Strong Presence In 

The United States. 

35. The TikTok app has become “one of the world’s fastest-growing social media 

platforms” and a “global phenomenon” with a massive American audience.22 In November 2019, 

the Washington Post reported that the TikTok app had been downloaded more than 1.3 billion 

times worldwide, and more than 120 million times in the United States.23 However, by April 

2020, TechCrunch reported that the TikTok app’s worldwide downloads already had surpassed 2 

billion, and that in “the quarter that ended on March 31, TikTok was downloaded 315 million 

times — the highest number of downloads for any app in a quarter.”24 It is the most downloaded 

non-game app in the world.25 The TikTok app routinely outranks its top competitors – such as 

 

21 http://culture.affinitymagazine.us/tik-tok-is-scamming-people-stealing-information/. 

22 https://www.washingtonpost.com/technology/2019/11/05/inside-tiktok-culture-clash-whereus-views-about-censorship-often-were-overridden-by-chinese-bosses/. 

23 https://www.washingtonpost.com/technology/2019/11/05/inside-tiktok-culture-clash-whereus-views-about-censorship-often-were-overridden-by-chinese-bosses/. 

24 https://techcrunch.com/2020/04/29/tiktok-tops-2-billion-downloads/. 

25 https://www.cnbc.com/2019/07/25/china-camera-apps-may-open-up-user-data-to-beijinggovernment-requests.html. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 12 of 113 PageID #:1074
 12 

Facebook, Snapchat, and Instagram – on the Apple and Google app stores.26 In fact, it has been 

the most downloaded app on the Apple and Google app stores for months.27 As of August 2019, 

the TikTok and Douyin apps had 625 million monthly active users.28 The average user opened 

the TikTok app more than 8 times per day and spent approximately 45 minutes on the app daily 

as of March 2019.29

36. In January 2020, Barron’s reported on the TikTok app’s revenue: “The wildly 

popular short-video service generated $176.9 million in revenue in 2019—71% of the total 

$247.6 million in revenue the app has ever generated, according to new data from the apptracking firm SensorTower. In the fourth quarter alone, TikTok had revenue of $88.5 million, up 

two times from the third quarter and up six times year over year, most of that from advertising 

and in-app purchases, SensorTower reports. China accounted for about 69% of the company’s 

2019 revenue, according to the firm, with U.S. revenues accounting for 20%.”30 Evidencing the 

TikTok app’s rapid growth, three months later, TechCrunch reported that: “Users have spent 

about $456.7 million on TikTok to date, up from $175 million five months ago. Much of this 

spending — about 72.3% — has happened in China. Users in the United States have spent about 

$86.5 million on the app, making the nation the second most important market for TikTok from the 

 

26 https://www.washingtonpost.com/technology/2019/11/05/inside-tiktok-culture-clash-whereus-views-about-censorship-often-were-overridden-by-chinese-bosses/. 

27 https://thehill.com/policy/technology/469114-tiktok-faces-lawmaker-anger-over-china-ties. 

28 https://thehill.com/policy/technology/469114-tiktok-faces-lawmaker-anger-over-china-ties. 

29 https://www.wsj.com/articles/tiktoks-videos-are-goofy-its-strategy-to-dominate-social-mediais-serious-11561780861. 

30 https://www.barrons.com/articles/beware-facebook-tiktok-revenues-are-exploding51579201752. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 13 of 113 PageID #:1075
 13 

revenue standpoint.”31

37. This level of success globally and in the United States is rare for a China-based 

tech giant. Facebook CEO Mark Zuckerberg acknowledged as much, stating that the TikTok app 

“is really the first consumer internet product built by one of the Chinese tech giants that is doing 

quite well around the world. It’s starting to do well in the U.S., especially with young folks.”32

Indeed, Defendant TikTok, Inc. recently took over office space in Silicon Valley once occupied 

by Facebook’s WhatsApp messaging app, and is poaching employees from rival Facebook by 

offering salaries as much as 20% higher.33 Other competitors from whom Defendant TikTok, 

Inc. is hiring away employees include Snap, Hulu, Apple, YouTube and Amazon.34

38. One key to Defendants’ financial success is the targeted advertising that they run 

through the TikTok app. Such targeted advertising relies heavily upon knowledge of each user’s 

preferences.35 Through a secretive and highly-invasive information gathering campaign, 

Defendants have unlawfully accumulated private and personally-identifiable data and content on 

TikTok users that Defendants are assembling in user profiles or dossiers and monetizing for the 

purpose of unjustly profiting from their unlawful activities. 

 

31 https://techcrunch.com/2020/04/29/tiktok-tops-2-billion-downloads/. 

32 https://www.cnbc.com/2019/10/14/tiktok-has-mountain-view-office-near-facebook-poachingemployees.html. 

33 https://www.cnbc.com/2019/10/14/tiktok-has-mountain-view-office-near-facebook-poachingemployees.html. 

34 https://www.cnbc.com/2019/10/14/tiktok-has-mountain-view-office-near-facebook-poachingemployees.html. 

35 https://www.digitaltrends.com/social-media/tiktok-advertiser-audience-network-targeted-ads/. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 14 of 113 PageID #:1076
 14 

V. DEFENDANTS’ THEFT OF PRIVATE AND PERSONALLY-IDENTIFIABLE 

TIKTOK USER DATA AND CONTENT. 

A. Defendants’ Secret Taking Of Private TikTok User Videos and TikTok 

User/Device Identifiers Without Notice Or Consent. 

1. Defendants Settle An FTC Lawsuit Alleging They Unlawfully 

Collected And Used Children’s Data. 

39. On February 27, 2019, the United States, on behalf of the Federal Trade 

Commission (“FTC”), filed a lawsuit against Defendants Musical.ly and Musical.ly, Inc. alleging 

they had violated the Children’s Online Privacy Protection Act by collecting and using personal 

data from children under age 13 without the required notice and consent.36

40. On the same date, Defendants Musical.ly and Musical.ly, Inc. stipulated to an 

order mandating, among other things, a civil penalty in the amount of $5.7 million and injunctive 

relief concerning the collection and destruction of children’s personal data.37

41. This is the largest civil penalty ever imposed for such a violation.38 The FTC also 

published a statement indicating that, “[i]n our view, these practices reflected the company’s 

willingness to pursue growth even at the expense of endangering children.”39

 

36 United States of America v. Musical.ly and Musical.ly, Inc., United States District Court, 

Central District of California, Case No. 2:19-cv-1439. 

37 United States of America v. Musical.ly and Musical.ly, Inc., United States District Court, 

Central District of California, Case No. 2:19-cv-1439. 

38 https://www.wsj.com/articles/tiktoks-videos-are-goofy-its-strategy-to-dominate-social-mediais-serious-11561780861; https://www.techinasia.com/tiktok-owner-bytedance-gathers-1-billionmonthly-active-users-apps. 

39 https://www.nbcnews.com/tech/tech-news/tiktok-pay-5-7-million-over-alleged-violationchild-privacy-n977186. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 15 of 113 PageID #:1077
 15 

2. The TikTok App Secretly Takes Users’ Private Videos Before Users 

Are Given The Choice Whether To Save Or Post Them. 

42. Unless shared through the affirmative consent of the TikTok user, videos created 

using the TikTop app, which often include close-ups of faces and private acts unintended for 

public consumption, are inherently private, personal, and sensitive. 

43. After using the TikTok app to record a video, a screen presents TikTok users with 

certain options, including the following: (i) an “x” button; (ii) a “next” button; and (iii) a button 

for effects. The “x” button takes TikTok users to a screen with options, including “reshoot” and 

“exit.” The “next” button takes TikTok users to a screen with options, including “save” and 

“post.” The “effects” button takes TikTok users to a screen offering the ability to modify the 

video. 

44. Once TikTok users click the “next” button, but before they click either the “save” 

or “post” buttons, their private videos that are neither saved nor posted (the “Private Videos”) 

are transferred from their mobile devices to the following domain owned and controlled by 

Defendants: muscdn.com. The “mus” portion of the domain name stands for Musical.ly, and the 

“cdn” portion of the domain name stands for content distribution network. 

45. During the secret transfer of TikTok users’ Private Videos to the domain and 

servers mentioned above, there is no progress bar or any other indication that their Private 

Videos are being transferred. Nor is Defendants’ surreptitious taking of the Private Videos 

disclosed in any of Defendants’ privacy policies or other disclosure documentation. TikTok users 

are thus prevented from knowing that Defendants have taken their Private Videos. No user 

consent exists. 

46. This highly invasive breach of TikTok users’ privacy is not the only harm that 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 16 of 113 PageID #:1078
 16 

befalls such users as a result of Defendants’ theft of their Private Videos. Defendants also take 

highly sensitive and immutable biometric identifiers and information from these Private Videos, 

as discussed below, and unjustly profit from such activities. 

47. Defendants released a December 2019 version of the TikTok app that transfers 

five thumbnail images uniformly distributed across each of the Private Videos (the “Private 

Video Images”) to byteoversea.net. The domain byteoversea.net is controlled by Defendants and 

has numerous sub-domains. Accordingly, when data and content arrives at byteoversea.net, it is 

routed to one or more of these sub-domains. The various sub-domains are spread across the 

globe, including within China. 

48. Defendants’ taking of the Private Video Images is not disclosed in any of 

Defendants’ privacy policies or other disclosure documentation. TikTok users are thus prevented 

from knowing that Defendants have taken their Private Video Images as well. No user consent 

exists. 

3. The TikTok App Covertly Takes User/Device Identifiers. 

49. Also unknown to TikTok users is that the seemingly innocuous TikTok app 

infiltrates their mobile devices and extracts a remarkably broad array of private and personallyidentifiable data and content that Defendants use to track and profile TikTok users for the 

purpose of, among other things, targeting them with advertisements from which Defendants 

unjustly profit. 

50. This unlawful secret taking of private and personally-identifiable data and content 

from TikTok users’ mobile devices is contrary to American norms. The United States Supreme 

Court has recognized that, in contemporary society, cell phones are so ubiquitous and 

inextricably intertwined with the user’s personal privacy that such devices have become “almost 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 17 of 113 PageID #:1079
 17 

a ‘feature of human anatomy.’” Carpenter v. United States, 138 S.Ct. 2206, 2218 (2018) 

(quoting Riley v. California, 573 U.S. 373, 385 (2014)). The United States Constitution thus 

provides a privacy right that protects individuals against unreasonable governmental searches of 

their physical movements through historical cell phone records in the possession of their service 

providers. Carpenter, 138 S.Ct. at 2218. 

51. From each mobile device on which the TikTok app is installed, Defendants take a 

combination of, among other items, the following user identifiers and mobile device identifiers 

(“User/Device Identifiers”): 

 a. username, password, age/birthday, email address, and profile image; 

 b. user-generated content, including messages sent through the apps; 

 c. phone and social network contacts; 

 d. the mobile device’s WiFi MAC address (i.e., media access control 

address), which is the unique hardware number on the WiFi card adapter that tells the internet 

who is connected to it; 

 e. the mobile device’s International Mobile Equipment Identity (“IMEI”) 

number, which is a unique number given to every mobile device that is used to route calls to 

one’s phone, and that reflects information about the origin, model, and serial number of the 

mobile device; 

 f. the user’s International Mobile Subscriber Identity (“IMSI”) number, 

which is a unique number given to every subscriber to a mobile network; 

 g. the IP address (i.e., Internet Protocol address), which is a numerical label 

assigned to each user mobile device connected to a computer network that uses the Internet 

Protocol for communication. IP addresses allow the location of literally billions of digital devices 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 18 of 113 PageID #:1080
 18 

that are connected to the Internet to be pinpointed and differentiated from all other such devices; 

 h. the device ID, which is a unique, identifying number or group of numbers 

assigned to the user’s individual mobile device that is separate from the hardware serial number; 

 i. the OS version, which is the operating system on the user’s mobile device; 

 j. the mobile device brand and model/version; 

 k. the hardware serial number, which is the unique, identifying number or 

group of numbers assigned to the user’s individual mobile device; 

 l. the Advertising ID, which is a unique ID for advertising that provides 

developers with a simple, standard system to monetize their apps; 

 m. mobile carrier information (e.g., the name of the phone company); 

 n. network information, including the technology that the carrier uses; 

 o. browsing history; 

 p. cookies; 

 q. metadata; and 

 r. precise physical location, including based on SIM card, cell towers and/or 

GPS. 

52. Theft of physical and digital location tracking data is highly invasive of TikTok 

users’ privacy rights. Two United States Senators observed that “[l]ocation data is among the 

most sensitive personal information that a user can share with a company ... Today, modern 

smartphones can reveal location data beyond a mere street address. The technology is 

sophisticated enough to identify on which floor of a building the device is located.”40 Location 

 

40 https://www.law360.com/consumerprotection/articles/1221312/sens-prod-zuckerberg-whykeep-tracking-user-locations-. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 19 of 113 PageID #:1081
 19 

data reveals private living patterns of TikTok users, including where they work, where they 

reside, where they go to school, and when they are at each of these locations. Location data, 

either standing alone or combined with other information, exposes deeply-private and personal 

information about TikTok users’ health, religion, politics and intimate relationships. 

53. The TikTok app also invites users to sign in through Facebook, Google, and 

Twitter. What users do not know and what Defendants fail to disclose is that this “single signon” option gives Defendants access to TikTok users’ private and personally-identifiable data and 

content stored on these other social media accounts, including User/Device Identifiers such as 

the user’s photos and friends/contacts information. 

4. The TikTok App Clandestinely Transmits User Video Viewing 

Histories To Third Parties. 

54. Defendants use the TikTok app to distribute private and personally-identifiable 

information concerning TikTok users’ video viewing history to Facebook and Google without 

user knowledge or consent. 

55. The TikTok app transmits the following information from TikTok users’ devices 

to Facebook’s domain graph.facebook.com: (1) when an individual TikTok user views a 

particular video, including the video’s ID; (2) when an individual TikTok user “likes” a 

particular video, including the video’s ID; (3) when an individual TikTok user “favorites” a 

particular video, including the video’s ID; (4) the other TikTok users that the individual TikTok 

user “follows,” including the other TikTok users’ IDs; and (5) the individual TikTok user’s 

advertising ID. This advertising ID is linked to the user’s particular device and it identifies that 

user to an ordinary person without need for further cross-referencing or investigation because 

Facebook maintains a 1:1 correspondence of advertising IDs to individuals, a fact known to 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 20 of 113 PageID #:1082
 20 

Defendants. Defendants do not disclose to TikTok users that Defendants transmit this private and 

personally-identifiable information to Facebook, nor do Defendants obtain user consent for such 

transmissions. 

56. The TikTok app also transmits the following information from TikTok users’ 

devices to Google’s domain app-measurement.com: (1) the particular videos that an individual 

TikTok user “likes,” including the video ID and the individual TikTok user’s device ID and 

advertising ID, which identifies the user to an ordinary person without need for further crossreferencing or investigation because Google maintains a 1:1 correspondence of device IDs and 

advertising IDs to individuals, a fact known to Defendants; and (2) the other TikTok users that 

the individual TikTok user “follows,” including the other users’ IDs and the individual TikTok 

user’s device ID and advertising ID. Defendants do not disclose to TikTok users that Defendants 

transmit this private and personally-identifiable information to Google, nor do Defendants obtain 

user consent for such transmissions. 

57. The VPPA, as discussed below, forbids Defendants from making these 

surreptitious transfers of TikTok users’ private and personally-identifiable video viewing history 

to Facebook and Google without disclosure and user consent. 18 U.S.C. § 2710 et seq.

5. Defendants’ Theft Of Private And Personally-Identifiable User Data 

And Content Begins Even Before Users Can Choose Whether To Sign 

Up With TikTok And Create An Account. 

58. The TikTok app begins taking private and personally identifiable user data and 

content immediately upon the completion of the download process and before TikTok users even 

have the opportunity to sign-up and create an account. TikTok users therefore do not have an 

opportunity to learn about the existence of, much less consent to, any of Defendants’ privacy 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 21 of 113 PageID #:1083
 21 

policies or other disclosure documentation before the TikTok app begins mining their mobile 

devices for their data and content. 

6. Defendants’ Theft Of Private And Personally-Identifiable Data And 

Content Continues Even After Users Close The TikTok App. 

59. Even when TikTok users stop using the app and close it, Defendants continue to 

harvest private and personally-identifiable data and content from such users’ mobile devices. 

There are no disclosures in any of Defendants’ privacy policies or other disclosure 

documentation that such surreptitious taking of private and personally-identifiable user data and 

content occurs when the TikTok app is closed. TikTok users are thus prevented from knowing 

that Defendants have taken their private and personally-identifiable data and content while the 

TikTok app is closed. No user consent exists. 

7. Defendants Carefully Conceal Their Misconduct. 

60. At the same time that Defendants utilize the TikTok app to covertly tap into a 

massive array of private and personally-identifiable user data and content, they go to great 

lengths to hide their tracks. They do so by obfuscating the source code that would reveal the 

private and personally-identifiable user data and content actually taken from users’ mobile 

devices. 

8. Defendants’ Privacy Policies And Terms Of Use Do Not Constitute 

Notice Of, Nor Consent To, TikTok User Data Theft, The Arbitration 

Provision Or The Class Action Waiver. 

61. Defendants have adopted various privacy policies and terms of use for the TikTok 

app over the years. Certain privacy policies, revealed by investigation of counsel but not seen in 

the ordinary course by users, purport to disclose that the TikTok app takes some (but not all) of 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 22 of 113 PageID #:1084
 22 

the private and personally-identifiable user data and content above. Certain terms of use, 

revealed by investigation of counsel but not seen in the ordinary course by users, purport to 

require arbitration and class action waivers. 

62. Because the TikTok app begins taking private and personally-identifiable user 

data and content – including User/Device Identifiers – immediately upon the completion of the 

download process, and before TikTok users are even presented with the option of signing-up for 

and creating an account, TikTok users have no notice of, and cannot consent to, the privacy 

policies and terms of use prior to such theft. Moreover, because the TikTok app takes Private 

Videos and Private Video Images even if TikTok users have not signed up for an account, 

TikTok users who have not signed up for an account have no notice of, and cannot consent to, 

the privacy policies and terms of use prior to such theft. 

63. Moreover, even at the point at which TikTok users have the option to sign-up and 

create an account, Defendants do not provide such users actual notice of privacy policies or 

terms of use. Nor do Defendants present TikTok users with conspicuously-located and designed 

hyperlinks to their privacy policies and terms of use, much less conspicuous warnings 

accompanying such hyperlinks. The TikTok app thus allows users to utilize it without ever 

placing them on actual or constructive notice of the privacy policies and terms of use. This lack 

of actual or constructive notice deprives TikTok users of the opportunity to accept or reject 

TikTok’s privacy policies and terms of use, rendering such documents unenforceable. See, e.g., 

Colgate v. Juul Labs, Inc., 402 F.Supp.3d 728 (N.D. Cal. 2019); Arena v. Intuit Inc., 2020 WL 

1189849 (N.D. Cal. 2020). 

64. Additionally, certain privacy policies and terms of use are ambiguous as to what 

conduct they purport to cover. Such privacy policies and terms of use are also substantively and 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 23 of 113 PageID #:1085
 23 

procedurally unconscionable. The ambiguities render meaningless the purported disclosures and 

requirements in the remainder of these documents, and the substantive and procedural 

unconscionability render such documents unenforceable. 

65. Moreover, even if TikTok users in California had knowingly accepted the terms 

of use (which they did not), the purported waiver of the right to seek public injunctive relief in a 

court of law is unenforceable under California law. See, e.g., McGill v. Citibank, 2 Cal.5th 945 

(2017); Blair v. Rent-A-Center, 928 F.3d 819 (9th Cir. 2019). 

B. Defendants Come Under United States Government Scrutiny. 

1. The United States Government Investigates Defendants’ Stockpiling 

Of TikTok Users’ Private And Personally-Identifiable Data And 

Content For The Chinese Government. 

66. United States Senators Charles Schumer and Tom Cotton sent an October 2019 

letter to the Acting Director of National Intelligence describing “national security” risks 

associated with the TikTok app. The Senators noted that there is evidence that Defendants may 

share private and personally-identifiable user data and content with the Chinese government: 

TikTok’s terms of service and privacy policies describe how it collects data from 

its users and their devices, including user content and communications, IP 

address, location-related data, device identifiers, cookies, metadata, and other 

sensitive personal information. While the company has stated that TikTok does 

not operate in China and stores U.S. user data in the U.S., ByteDance is still 

required to adhere to the laws of China. 

Security experts have voiced concerns that China’s vague patchwork of 

intelligence, national security, and cybersecurity laws compel Chinese companies 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 24 of 113 PageID #:1086
 24 

to support and cooperate with intelligence work controlled by the Chinese 

Communist Party. ... With over 110 million downloads in the U.S. alone, TikTok 

is a potential counterintelligence threat we cannot ignore. Given these concerns, 

we ask that the Intelligence Community conduct an assessment of the national 

security risks posed by TikTok ... and brief Congress on these findings.41

67. The Committee on Foreign Investment in the United States (“CFIUS”) is an interagency committee of the United States government that reviews the national security 

implications of foreign investments in United States companies or operations. Chaired by the 

United States Secretary of the Treasury, CFIUS includes representatives from 16 United States 

departments and agencies, including the Defense, State, Commerce and Homeland Security 

departments. CFIUS is reviewing Defendant Beijing ByteDance’s acquisition of Defendants 

Musical.ly and Musical.ly, Inc.42

68. Additionally, the Senate Judiciary Subcommittee on Crime and Terrorism held a 

hearing in November 2019 that Defendant TikTok, Inc. declined to attend although it had been 

invited. The Chairman, Senator Josh Hawley, stated in opening remarks that: “TikTok should 

answer ... to the millions of Americans who use their product with no idea of its risks.”43

Chairman Hawley also told reporters that: “The idea that TikTok is not sharing data, is not taking 

direction from Beijing, that just does not appear to be true.”44

69. Indeed, the risk that Defendants sends TikTok user data to the Chinese 

 

41 https://www.law360.com/articles/1213180/sens-want-tiktok-investigated-for-national-securitythreats; https://www.cotton.senate.gov/?p=press_release&id=1239. 

42 https://www.washingtonpost.com/technology/2019/11/05/inside-tiktok-culture-clash-whereus-views-about-censorship-often-were-overridden-by-chinese-bosses/. 

43 https://thehill.com/policy/technology/469114-tiktok-faces-lawmaker-anger-over-china-ties. 

44 https://thehill.com/policy/technology/469114-tiktok-faces-lawmaker-anger-over-china-ties. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 25 of 113 PageID #:1087
 25 

government is so great that the U.S. Army has banned the app on government-owned devices. 

That decision was based on concerns specific to Defendants and their close relationship to the 

Chinese government. The Army banned the TikTok app despite the fact that it had been using it 

for recruiting purposes until it realized the risk.45 The U.S. Navy, Marines, Air Force and Coast 

Guard, as well as the Department of Defense and the Transportation Security Administration 

have likewise banned the TikTok app due to the risk that user data is being sent to China.46

2. Defendants Unpersuasively Deny They Transfer TikTok Users’ 

Private And Personally-Identifiable Data And Content To The 

Chinese Government. 

70. In July 2019, amid growing scrutiny, Defendant TikTok, Inc. retained consultants 

who opined that there is “no indication” that the Chinese government accessed TikTok users’ 

data.47 But the lead consultant admitted that the review and analysis was limited to a narrow and 

recent four-month period: “He added that in the analysis from July [2019] to October [2019], 

which included interviews with TikTok employees and a review of the app’s underlying 

computer code, his team found no way TikTok could send data to China during those months.”48

And, the consultants did not address whether TikTok user data could be “accessed from,” as 

opposed to “sent to,” China. 

71. Defendant TikTok, Inc. also issued a public statement in which it represented: 

 

45 https://www.businessinsider.com/us-government-agencies-have-banned-tiktok-app-2020-2

46 https://www.businessinsider.com/us-government-agencies-have-banned-tiktok-app-2020-2#1-

the-navy-banned-tiktok-from-government-devices-1; https://www.engadget.com/2020-01-04-

nearly-whole-us-military-bans-tiktok.html

47 https://www.washingtonpost.com/technology/2019/11/05/inside-tiktok-culture-clash-whereus-views-about-censorship-often-were-overridden-by-chinese-bosses/. 

48 https://www.nytimes.com/2019/11/01/technology/tiktok-national-security-review.html. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 26 of 113 PageID #:1088
 26 

“First, let’s talk about data privacy and security. We store all TikTok U.S. user data in the United 

States, with backup redundancy in Singapore. Our data centers are located entirely outside of 

China, and none of our data is subject to Chinese law.”49

72. This public statement is carefully couched in the present tense and studiously 

avoids mention of past practices. In fact, the statement does not actually say that no private and 

personally-identifiable user data and content is transferred to China. Rather, it says that private 

and personally-identifiable user data and content is stored in the United States (but not 

necessarily exclusively in the United States) and that Defendants’ current data centers are 

located outside China (but not whether these data centers transfer private and personallyidentifiable user data to China or make it accessible there). Even Defendant TikTok, Inc.’s 

February 2019 Privacy Policy, which is not viewed by users in the ordinary course, states that 

“[w]e may share your information with a parent, subsidiary, or other affiliate of our corporate 

group.” Although this language is ambiguous, it apparently “means it would include China-based 

ByteDance.”50 Accordingly, Defendant TikTok, Inc.’s public statement (above) and its February 

2019 Privacy Policy are, at best, highly misleading. 

C. Transfers Of Private And Personally-Identifiable User Data And Content 

From TikTok Users To China Without Notice Or Consent. 

1. The TikTok App Secretly Transfers Private And PersonallyIdentifiable User Data And Content To Servers In China. 

73. Affinity published an article entitled “TikTok is Scamming People & Stealing 

 

49 https://newsroom.tiktok.com/en-us/statement-on-tiktoks-content-moderation-and-datasecurity-practices. 

50 https://www.cnbc.com/2019/07/25/china-camera-apps-may-open-up-user-data-to-beijinggovernment-requests.html. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 27 of 113 PageID #:1089
 27 

Information.” Quoting from a pre-2019 TikTok privacy policy, the article reports that “they store 

and process user data in United States of America, Singapore, Japan or to China.”51 The article 

also reports that Defendant TikTok, Inc. is “offering personal information to third parties and the 

Chinese government.”52

74. CNBC published an article entitled “China’s globally popular camera apps may 

open up user data to Beijing requests” in which it confirms that a TikTok privacy policy from 

2018 acknowledged transmission of private and personally-identifiable user data and content to 

China: “TikTok’s 2018 privacy policy said the company can transfer international users’ data to 

China, according to archived versions of that web page.”53 Even Defendant TikTok, Inc.’s 

August 2018 Privacy Policy, which is not seen by users and which by its own terms does not 

even apply to United States users, states: “We will also share your information with any member 

or affiliate of our group, in China, for the purposes set out above, to assist in the improvement or 

optimisation of the Platform, ... increase user numbers, development, engineering and analysis 

of information or for our internal business purposes ....” 

75. Quartz published an article by David Carroll entitled “Is TikTok a Chinese 

Cambridge Analytica data bomb waiting to explode?” Mr. Carroll is an associate professor at the 

Parsons School of Design in New York, and in 2017 he sued Cambridge Analytica in the United 

Kingdom. In his Quartz article, Mr. Carroll quoted from Defendant TikTok, Inc.’s August 2018 

Privacy Policy that reveals that private and personally-identifiable user data and content is 

 

51 http://culture.affinitymagazine.us/tik-tok-is-scamming-people-stealing-information/. 

52 http://culture.affinitymagazine.us/tik-tok-is-scamming-people-stealing-information/. 

53 https://www.cnbc.com/2019/07/25/china-camera-apps-may-open-up-user-data-to-beijinggovernment-requests.html. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 28 of 113 PageID #:1090
 28 

transferred to China.54 Mr. Carroll further reported that, in emails between him and Defendant 

TikTok, Inc. in March and April 2019, Defendant TikTok, Inc. (i) confirmed that, at least prior to 

February 2019, U.S. TikTok user data may have been processed in China; and (ii) provided 

confusing answers about what happened after that, including that U.S. TikTok user data may 

have continued to be processed by systems operated by “one of our China registered entities,” 

and may exist there in some form, even where such user data is stored elsewhere.55 

76. The New York Times has reported that a source “said the American government 

had evidence of the [TikTok] app sending data to China.”56 That explains why the Defense 

Department, Navy, Army, Marines, Air Force, Coast Guard and Transportation Security 

Administration have taken the extraordinary step of prohibiting their members from using the 

TikTok app on any government-issued devices, and have advised that their children also remove 

the TikTok app from their devices.57 United States Senators also have proposed a bill banning 

federal employees from using the TikTok app on government-issued phones because it “presents 

a major security risk.”58

a. Evidence Of Post-February 2019 Transfers. 

77. Even after Defendant TikTok, Inc. adopted its February 2019 Privacy Policy, the 

TikTok app secretly transferred private and personally-identifiable user data and content to 

China where, under Chinese law, it is subject to collection and use by the Chinese government. 

Specifically, Defendants used the TikTok app to transfer private and personally-identifiable user 

 

54 https://qz.com/1613020/tiktok-might-be-a-chinese-cambridge-analytica-scale-privacy-threat/. 

55 https://qz.com/1613020/tiktok-might-be-a-chinese-cambridge-analytica-scale-privacy-threat/. 

56 https://www.nytimes.com/2019/11/01/technology/tiktok-national-security-review.html. 

57 https://www.wsj.com/articles/u-s-military-bans-tiktok-over-ties-to-china-11578090613. 

58 https://www.reuters.com/article/us-usa-china-tiktok/us-senators-seek-to-ban-federalemployees-from-using-tiktok-on-their-phones-idUSKBN20Z1E4. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 29 of 113 PageID #:1091
 29 

data and content to the following two servers in China as recently as April 2019: (i) 

bugly.qq.com and (ii) umeng.com. 

78. Private and personally-identifiable TikTok user data and content transferred to 

bugly.qq.com as recently as April 2019 includes at least the following items: (i) the OS version; 

(ii) the mobile device model; (iii) the WiFi MAC address; (iv) the hardware serial number; (v) 

the device ID and (vi) the IP address. Private and personally-identifiable TikTok user data and 

content transferred to umeng.com as recently as April 2019 includes these same six items, plus at 

least the following item: (vii) the number of bytes users’ mobile devices have uploaded and 

downloaded. 

b. Evidence Of Pre-February 2019 Transfers. 

79. The TikTok app transferred private and personally-identifiable TikTok user data 

and content to various servers in China prior to the February 2019 Privacy Policy, including to at 

least the following servers: (i) musemuse.cn; (ii) zhiliaoapp.com; (iii) mob.com; and (iv) 

umeng.com. 

80. The private and personally-identifiable TikTok user data and content transferred 

to one or more of these four China-based servers includes biometrics and User/Device 

Identifiers. Additional private and personally-identifiable TikTok user data and content 

transferred to one or more of these four China-based servers includes: (i) a list of the other apps 

installed on users’ mobile devices; and (ii) more specific location data. Such information reveals 

TikTok users’ precise physical location, including possibly indoor locations within buildings, 

and TikTok users’ apps that possibly reveal mental or physical health, religious views, political 

views, and sexual orientation. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 30 of 113 PageID #:1092
 30 

2. Defendants’ Privacy Policies Do Not Constitute Notice Of Or Consent 

To The Transfer Of Private And Personally-Identifiable TikTok User 

Data And Content To Servers In China. 

81. TikTok users do not knowingly consent to Defendants’ privacy policies because 

notice and warnings of the privacy policies are not adequately displayed, as discussed above. 

Additionally, many provisions of the privacy policies are ambiguous, providing inadequate 

notice of what private and personally-identifiable user data and content is taken and where it is 

being sent. Even scholars with expertise in such matters, such as Mr. Carroll (supra ¶ 75), cannot 

discern what is being taken and where it is going. Certainly, ordinary TikTok users cannot be 

expected to understand such baffling “disclosures.” This ambiguity further renders the notice 

inadequate to infer knowing user consent. 

82. In addition to the above-stated deficiencies, privacy policy provisions stating that 

certain TikTok user data and content will be sent to servers in China is contradicted by 

Defendants’ public and misleading assurances that no such transfers occur. Moreover, TikTok 

users whose data and content is sent before they even have an opportunity to sign-up and create 

an account do not actually or constructively receive notice, and therefore cannot be deemed to 

have assented to, such transfers to China. 

3. The China-Based Tech Giants Also Possess TikTok Users’ Private 

And Personally-Identifiable Data And Content While They Work 

Cooperatively With The Chinese Government. 

83. The bugly.qq.com server is owned and operated by China-based tech giant 

Tencent Holdings Limited (“Tencent”), and the umeng.com server is owned and operated by 

another China-based tech giant Alibaba Holding Group Limited (“Alibaba”). Tencent and 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 31 of 113 PageID #:1093
 31 

Alibaba thus possess TikTok users’ private and personally-identifiable data and content. Such 

data transfers to Tencent and Alibaba servers were accomplished through Tencent and Alibaba 

source code that Defendants embedded within the TikTok app. 

84. Also embedded within the TikTok app is source code from China-based tech giant 

Baidu, Inc. (“Baidu”) as well as source code from a China-based software development kit 

(“SDK”) known as Igexin. The Igexin SDK is notorious for causing the removal of some 500 

apps from the Google play store in 2017 after it was discovered that Igexin constituted a “secret 

backdoor” that allowed its operators “to install a range of spyware.”59 Specifically, Igexin “could 

update the app to include spyware at any time, with no warning. The most serious spyware 

installed on phones were packages that stole call histories, including the time a call was made, 

the number that placed the call, and whether the call went through. Other stolen data included 

GPS locations, lists of nearby Wi-Fi networks, and lists of installed apps.”60

85. Baidu, Alibaba, and Tencent – popularly known by the acronym “BAT” – are 

“China’s original tech titans”61 and dominate the fields of artificial intelligence, social media, 

and the internet in China. The private and personally-identifiable TikTok user data and content 

they possess may well be used by the Chinese government in the future, if it has not already. 

86. BAT routinely assist the Chinese government in the surveillance and control of its 

people through biometrics. “Biometric surveillance powered by artificial intelligence is 

categorically different than any surveillance we have seen before. It enables real-time location 

 

59 https://arstechnica.com/information-technology/2017/08/500-google-play-apps-with-100-

million-downloads-had-spyware-backdoor/. 

60 https://arstechnica.com/information-technology/2017/08/500-google-play-apps-with-100-

million-downloads-had-spyware-backdoor/. 

61 https://www.forbes.com/sites/rebeccafannin/2019/08/23/baidu-alibaba-tencent-clash-to-leadchinas-tech-future-while-a-new-b-arises/#18cc42e414d0. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 32 of 113 PageID #:1094
 32 

tracking and behavior policing of an entire population at a previously impossible scale.”62 The 

Chinese government is taking full advantage of China-based technology corporations like BAT 

to assist: “Beijing is embracing technologies like facial recognition and artificial intelligence to 

identify and track 1.4 billion people. It wants to assemble a vast and unprecedented national 

surveillance system, with crucial help from its thriving technology industry. ... China has 

become the world’s biggest market for security and surveillance technology, with analysts 

estimating the country will have almost 300 million cameras installed by 2020. Chinese buyers 

will snap up more than three-quarters of all servers designed to scan video footage for faces 

....”63

87. The Chinese government relies on China-based technology companies like BAT 

to assist in government investigations of criminal activity and political dissent, as well as 

surveillance activities: “The Chinese police ‘request data from Alibaba for their own 

investigations, ... tapping into the trove of information the tech giant collects through its ecommerce and financial payment networks. ... Companies including Alibaba [], Tencent [], and 

Baidu [] are required to help China’s government hunt down criminal suspects and silence 

political dissent. Their technology is also being used to create cities wired for surveillance. ... 

Apple disclosed that more than 35,000 user accounts were affected by 24 Chinese lawenforcement requests in the first half of this year [2017], many in connection with fraud 

investigations. It said it provided information on about 90% of them. Chinese companies don’t 

release any information on the number of requests from the government, the nature of the 

 

62 https://www.buzzfeednews.com/article/evangreer/dont-regulate-facial-recognition-ban-it. 

63 https://www.nytimes.com/2018/07/08/business/china-surveillance-technology.html. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 33 of 113 PageID #:1095
 33 

requests or the compliance rate.’”64

88. The Chinese government’s use of BAT to sort and analyze information, including 

information gathered from smartphones, is also well documented: “Along with access to online 

data, China’s government wants something else from tech companies – the cloud computing 

prowess to sort and analyze information. China wants to crunch data from surveillance cameras, 

smartphones, government databases and other sources to create so-called smart cities and safe 

cities. ... Police now work with Alibaba to use surveillance footage and data processing to 

identify ‘persons of interest’ and keep them out, local police official Dai Jinming said at a recent 

conference sponsored by Alibaba. Tencent is working with police in the southern city of 

Guangzhou to build a cloud-based ‘early-warning system’ that can track and forecast the size and 

movement of crowds, according to a statement from the Guangzhou police bureau.”65

89. The Wall Street Journal has reported on the significant patronage that BAT 

receive from the Chinese government, the growing number of tech entrepreneurs who have 

become members of the legislature under President Xi Jinping (including, for example, 

Tencent’s Tony Ma), and BAT’s pledges of loyalty to the Chinese government.66 “‘The 

government is always the boss and the tech firms are there to serve the goals of the Chinese 

government.’”67

90. Defendant Beijing ByteDance is emerging as a threat to BAT’s exclusive status: 

 

64 https://www.wsj.com/articles/chinas-tech-giants-have-a-second-job-helping-the-governmentsee-everything-1512056284. 

65 https://www.wsj.com/articles/chinas-tech-giants-have-a-second-job-helping-the-governmentsee-everything-1512056284. 

66 https://www.wsj.com/articles/the-godfathers-of-chinese-tech-get-an-offer-they-cant-refuse1520510404. 

67 https://www.wsj.com/articles/the-godfathers-of-chinese-tech-get-an-offer-they-cant-refuse1520510404. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 34 of 113 PageID #:1096
 34 

“there’s a new B in the BAT trio on the horizon: the world’s highest-valued unicorn, ByteDance 

....”68 Like BAT, Defendant Beijing ByteDance is subject to the same cybersecurity laws 

mandating cooperation with the Chinese government that are described in Senator Schumer and 

Senator Cotton’s letter. Senator Hawley, according to the Wall Street Journal, described the 

resulting threat to TikTok users by stating: “all it takes is one knock on the door of their parent 

company [Defendant Beijing ByteDance], based in China, from a Communist Party official for 

that data [from Defendant TikTok, Inc.] to be transferred to the Chinese government’s hands, 

whenever they need it.”69 In the same Wall Street Journal article, a former TikTok employee 

from the Los Angeles office stated that: “We’re a Chinese company ... We answer to China.”70

91. A Washington Post opinion piece entitled “Could TikTok allow China to export 

repression?” describes the danger to TikTok users in the United States if Defendants provide 

such users’ private and personally-identifiable data and content to the Chinese government: 

“TikTok’s leaders protest that they store local information locally, so whatever data the company 

has on the behavioral patterns or personal attributes of some of the most vulnerable American 

citizens are not ‘subject to Chinese law.’ But it’s reasonable to wonder whether TikTok might 

not comply with targeted intelligence requests from the repressive regime ruling over its parent 

company ByteDance. TikTok’s younger users will be voting in the coming years; down the line, 

they may hold positions of power. A trove of their information is a valuable asset.”71

 

68 https://www.forbes.com/sites/rebeccafannin/2019/08/23/baidu-alibaba-tencent-clash-to-leadchinas-tech-future-while-a-new-b-arises/#18cc42e414d0. 

69 https://www.wsj.com/articles/tiktok-looking-at-ways-to-shake-off-its-ties-to-china11574073001. 

70 https://www.wsj.com/articles/tiktok-looking-at-ways-to-shake-off-its-ties-to-china11574073001. 

71 https://www.washingtonpost.com/opinions/global-opinions/could-tiktok-allow-china-toCase: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 35 of 113 PageID #:1097
 35 

92. The Wall Street Journal, in an article entitled “U.S. Orders Chinese Firm to Sell 

Dating App Grindr Over Blackmail Risk,” also has reported on the dangers Americans face from 

the Chinese government’s accumulation of their private and personally-identifiable data and 

content, including blackmail and other sinister scenarios: “U.S. national-security experts said 

Chinese government knowledge of an individual’s usage of Grindr could be used in certain cases 

to blackmail U.S. officials and others with security clearances, such as defense contractors, and 

force them to provide information or other support to China. They have also envisioned more 

elaborate scenarios. For example, one could use Grindr’s location data to discern that a certain 

user works at a telecommunications firm and pays regular visits to the same building in Northern 

Virginia that intelligence officials frequent. Chinese-intelligence officials could then determine 

that that individual is the telecommunications firm’s intelligence liaison, and they would know 

both whom to target and how to threaten that person with potentially compromising information. 

... The risk has grown as the Chinese government acquires more large data sets through hacking 

and other means, allowing it to build databases with detailed profiles of targets.”72

VI. DEFENDANTS’ THEFT OF TIKTOK USER BIOMETRICS. 

A. The Illinois Biometric Information Privacy Act Regulates Face Geometry 

Scans, Voiceprints And Information Derived Therefrom. 

93. In 2008, Illinois enacted the Biometric Information Privacy Act (“BIPA”), 740 

ILCS 14/1, et seq. This was due to the “very serious need [for] protections for the citizens of 

Illinois when it [comes to their] biometric information.” Illinois House Transcript, 2008 Reg. 

Sess. No. 276. The Illinois Legislature recognized the importance of protecting the privacy of 

 

export-repression/2019/11/02/1729f038-fa79-11e9-8906-ab6b60de9124_story.html. 

72 https://www.wsj.com/articles/u-s-orders-chinese-company-to-sell-grindr-app-11553717942. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 36 of 113 PageID #:1098
 36 

individuals’ biometric data, finding that “[b]iometrics are unlike other unique identifiers that are 

used to access finances or other sensitive information.” 740 ILCS 14/5(c). “For example, social 

security numbers, when compromised, can be changed. Biometrics, however, are biologically 

unique to the individual; therefore, once compromised, the individual has no recourse [and] is at 

heightened risk for identity theft ....” Id. 

94. BIPA thus focuses on “biometric identifiers” and “biometric information.” 

Biometric identifiers consist of “a retina or iris scan, fingerprint, voiceprint, or scan of hand or 

face geometry.” 740 ILCS 14/10. A “scan” under BIPA means to examine by observation or 

checking, or systematically in order to obtain data especially for display or storage. In re 

Facebook Biometric Information Privacy Litigation, 2018 WL 2197546, *3 (N.D. Cal. May 14, 

2018). “Geometry” under BIPA is the relative arrangement of parts or elements. Id. Neither the 

term “scan” nor the term “geometry” require “actual or express measurements of spatial 

quantities like distance, depth, or angles.” Id. Biometric information constitutes “any 

information, regardless of how it is captured, converted, stored, or shared, based on an 

individual’s biometric identifier used to identify an individual.” 740 ILCS 14/10. 

B. Defendants Unlawfully Collect, Use And Profit From TikTok User 

Biometrics, Face Geometry Scans, Voiceprints And Information Derived 

Therefrom. 

95. Defendants’ unlawful collection, possession, storage, dissemination, use and 

profiting from biometrics, face geometry scans and voiceprints of TikTok users, and the 

information derived therefrom, takes three forms. 

96. First, Defendants’ BIPA and other biometrics-related violations are established 

by the functionality and code of the TikTok app itself. This functionality and code includes: (a) 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 37 of 113 PageID #:1099
 37 

content recommendations based on TikTok users’ race/ethnicity and age; (b) scans of face 

geometry to determine TikTok users’ age; (c) censoring video content to remove people 

Defendants consider “ugly”; (d) the augmented reality feature that scans face geometry while 

processing users’ videos; (e) code for deepfake videos; and (f) code for age, race/ethnicity and 

emotion recognition. 

97. Second, Defendants’ BIPA and other biometrics-related violations are further 

established by their ongoing work in China, which includes: (a) the application of facial 

recognition technology73 to TikTok users’ videos by highly-trained engineers skilled in computer 

vision, convolutional neural network and machine learning; (b) patent applications for face, 

voice, age, race/ethnicity and emotion recognition technologies; and (c) the publicly-known 

functionality of Douyin that allows its users to perform facial recognition on faces selected by 

such users from other users’ videos. 

98. Third, Defendants’ BIPA and other biometrics-related violations are also 

established by Defendants’ legal and political obligations to accumulate and share vast troves of 

data, including biometrics, in order to assist the Chinese government in meeting two crucial and 

intertwined state objectives: (a) world dominance in artificial intelligence; and (b) population 

surveillance and control. 

1. Defendants’ BIPA And Other Biometrics-Related Violations Are 

Evidenced By The TikTok App’s Functionality And Code. 

99. There are six specific categories of functions and code within the TikTok app that 

 

73 Facial recognition “is a technology capable of identifying or verifying a person from a digital 

image or a video frame from a video source. There are multiple methods in which facial 

recognition systems work, but in general, they work by comparing selected facial features from a 

given image with faces within a database.” See

https://en.wikipedia.org/wiki/Facial_recognition_system.

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 38 of 113 PageID #:1100
 38 

reveal BIPA violations: (1) the race/ethnicity and age-based content recommendations; (2) the 

scans to determine age; (3) the removal of so-called “ugly” videos; (4) the augmented reality 

feature; (5) the deepfake video code; and (6) the age, race/ethnicity and emotion recognition 

code.74 These also evidence violations of the other statutory, constitutional and common law 

claims set forth herein. 

100. That the TikTok app violates BIPA and other laws is highlighted by comments 

from a “Bytedance representative” who confessed to The Verge that “TikTok makes use of the 

company’s AI technologies in various ways, from facial recognition for the filters through to 

the recommendation engine in the For You feed. ... We build intelligent machines that are 

capable of understanding and analyzing text, images and videos using natural language 

processing and computer vision technology. This enables us to serve users with the content that 

they find most interesting ....’”75

101. Similarly, Marketing Technology Insights reported on Defendants’ use of facial 

recognition technology in the TikTok app in violation of BIPA and other laws, stating that 

Defendant TikTok, Inc. and the TikTok app “deploy[] AI and Face Recognition technology to 

analyze user’s interests and preferences through their interactions with the content, and display a 

personalized content feed to each user.”76

a. Race/Ethnicity And Age Based Content Recommendations. 

102. Marc Faddoul, a researcher at the University of California at Berkeley who 

 

74 This evidence also constitutes a basis for the other statutory, constitutional and common law 

causes of action herein. 

75 https://www.theverge.com/2018/11/30/18107732/bytedance-valuation-tiktok-china-startup

(emphasis added). 

76 https://martechseries.com/mts-insights/staff-writers/pay-attention-to-tiktok-content/ (emphasis 

added). 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 39 of 113 PageID #:1101
 39 

studies artificial intelligence, conducted an experiment in or about February 2020 that revealed 

the TikTok app recommends content based in part on race/ethnicity and age information that it 

gleans from TikTok users’ digital face images. Buzzfeed described his findings: “In the app, 

when a person follows a new account, they can click an arrow that then recommends other 

accounts to follow. Faddoul noticed that when he did this, the recommended accounts 

tended to look just like whoever he’d just followed — right down to ethnicity and hair 

color.”77 

103. Recode also reported on Faddoul’s research in its article entitled “There’s 

Something Strange About TikTok Recommendations”: 

When artificial intelligence researcher Marc Faddoul joined TikTok a few days 

ago, he saw something concerning: When he followed a new account, the profiles 

recommended by TikTok seemed eerily, physically similar to the profile picture 

of the first account. Following a young-looking blond woman, for instance, 

yielded recommendations to follow more young-looking blond women. ... 

Following black men led to recommendations to follow more black men. 

Following white men with beards produced recommendations for more white men 

with beards. Following elderly people spawned recommendations for other 

elderly people. And on and on. ... 

Faddoul also told Recode that he believes it’s more likely that TikTok is using 

something he calls automatic featurization. This type of recommendation 

algorithm could take “signals” from profile images to find profile pictures with 

similar attributes. These kinds of signals would be correlations between the 

 

77 https://www.buzzfeednews.com/article/laurenstrapagiel/tiktok-algorithim-racial-bias. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 40 of 113 PageID #:1102
 40 

pictures, which could correspond to anything from skin color to having a beard. 

The algorithm is simply looking for similarities in the photos or profiles. ... 

“What I suspect is happening is that TikTok is featurizing the profile picture,” he 

says, “and using these features in the recommendation engine.”78

b. Face Scans To Determine Age. 

104. Defendants also scan face images taken from TikTok user videos in order to 

determine TikTok users’ age. The Wall Street Journal has reported that “TikTok has built an 

artificial intelligence tool that scans faces in videos to estimate users’ ages.”79 Both Faddoul’s 

research and this Wall Street Journal article are consistent with evidence of Defendants’ work in 

China on TikTok user videos as well as their patent applications in China for face, voice, age, 

race/ethnicity and emotion recognition technologies (below). 

c. Removal Of Videos Of So-Called “Ugly” People. 

105. Public reporting indicates that “the makers of TikTok ... instructed moderators to 

suppress posts created by users deemed too ugly .... Today, The Intercept and The Intercept 

Brasil are publishing two internal TikTok moderation documents .... One ... describes 

algorithmic punishments for unattractive and impoverished users. The documents appear to 

have been originally drafted in Chinese and later — at times awkwardly — translated into 

English for use in TikTok’s global offices.”80 Defendant TikTok, Inc. uses artificial intelligence 

technology in its Culver City office to review and flag user content. Given the presence of this 

AI technology and the sheer volume of TikTok user videos that are reviewed for “ugliness,” it is 

 

78 https://www.vox.com/recode/2020/2/25/21152585/tiktok-recommendations-profile-look-alike. 

79 https://www.wsj.com/articles/tiktok-wants-to-grow-up-but-finds-it-tough-to-keep-kids-out11581858006. 

80 https://theintercept.com/2020/03/16/tiktok-app-moderators-users-discrimination/. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 41 of 113 PageID #:1103
 41 

apparent that Defendant TikTok, Inc. is using facial recognition technology to identify and 

remove such users’ videos. 

d. Augmented Reality Features. 

106. The TikTok app uses an advanced video editor and camera face filters. 

Employing this technology, TikTok users edit their videos to, among other things, morph their 

face into another face; change the size, shape, height and width of their face; change particular 

features of their face (e.g., eyes, ears, nose, lips, mouth, cheeks), including the size and shape of 

such facial features; and so on. Users thereby create videos in which their faces and specific 

facial features take on cartoonish dimensions and appearances, and in which they can appear 

older, etc. 

107. This functionality is a form of augmented reality (“AR”).81 To perform AR, the 

TikTok app examines, detects and localizes the face and the arrangement of its various parts 

(e.g., the eyes, ears, nose, lips, mouth, cheeks) relative to the other parts, and then also tracks the 

face and its various parts (and their relative arrangement) while in motion. 

108. The following relevant code is located within the TikTok app: “FaceDetectManager”; 

“faceDetectMaxTime”; “faceDetectMinTime”; “Requirement_Face_3D_Detect”; “Requirement_Face_Detect”; 

“Requirement_Face_Track”; “face_track.model”; “maxScanTime”; “minScanTime”; and “faceID”. Additional code 

 

81 AR “is an interactive experience of a real-world environment where the objects that reside in 

the real world are enhanced by computer-generated perceptual information .... AR can be 

defined as a system that fulfills three basic features: a combination of real and virtual worlds, 

real-time interaction, and accurate 3D registration of virtual and real objects. ... This experience 

is seamlessly interwoven with the physical world such that it is perceived as an immersive aspect 

of the real environment. In this way, augmented reality alters one’s ongoing perception of a realworld environment .... With the help of advanced AR technologies (e.g. adding computer vision, 

incorporating AR cameras into smartphone applications and object recognition) the information 

about the surrounding real world of the user becomes interactive and digitally manipulated.” See

https://en.wikipedia.org/wiki/Augmented_reality. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 42 of 113 PageID #:1104
 42 

for pitch, yaw and roll – “the three dimensions of movement when an object moves through a 

medium”

82 – is within the TikTok app as well. 

109. This functionality and code reveal Defendants’ use of face geometry scans on 

TikTok users. While it is currently unclear whether Defendants upload such face geometry scans 

from TikTok users’ mobile devices, in addition to performing separate face geometry scans at 

the server level, this functionality and code demonstrate Defendants’ technological ability and 

willingness to perform such scans on TikTok users. 

e. Code For Deepfake Videos. 

110. There is code within the TikTok app, as well as within Douyin, for performing 

facial recognition. TechCrunch reported that there is “Face Swap” code within the TikTok app 

for “life-like deepfakes technology.” It “asks users to take a multi-angle biometric scan of their 

face, then choose from a selection of videos they want to add their face to and share.”83

Defendants admitted that such code is present in the TikTok app, but denied its use. A TikTok 

spokesperson “insisted that ‘after checking with the teams I can confirm this is definitely not a 

function in TikTok ....’ They later told TechCrunch that ‘the inactive code fragments are being 

removed to eliminate any confusion,’ which implicitly confirms that Face Swap code was found 

in TikTok.”84

111. That the “Face Swap” code is present in the TikTok app demonstrates 

Defendants’ technological capacity and intent to perform facial recognition on TikTok users. 

Further, the “Face Swap” code further confirms the direct involvement of Defendant Beijing 

 

82 https://simple.wikipedia.org/wiki/Pitch,_yaw,_and_roll. 

83 https://techcrunch.com/2020/01/03/tiktok-deepfakes-face-swap/. 

84 https://techcrunch.com/2020/01/03/tiktok-deepfakes-face-swap/. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 43 of 113 PageID #:1105
 43 

ByteDance in the TikTok app, because there would otherwise be no way for the TikTok app to 

include facial recognition code that Defendants TikTok, Inc. and ByteDance, Inc. have denied 

was ever used in the United States. 

f. Code For Age, Race/Ethnicity And Emotion Recognition. 

112. There is additional code within the TikTok app designed to recognize users’ age, 

race/ethnicity and emotions. The code separates race/ethnicity into at least four categories: 

“Blac” [sic.]; “Indian”; “White”; and “Yellow.” The code also distinguishes between at least 

seven different ranges of emotion: “Angry”; “Disgust”; “Fear”; “Happy”; “Neutral”; “Sad”; and 

“Surprise.” 

113. To place TikTok users within one of these categories, the TikTok app would have 

to use face geometry scans and/or voiceprints. It is currently unclear whether this code is active 

at the mobile device level and, if so, whether Defendants upload any such face geometry scans 

and voiceprints from TikTok users’ mobile devices. Nonetheless, the age, race/ethnicity and 

emotion recognition code within the TikTok app is consistent with Faddoul’s research (above) 

and also directly correlates to Defendants’ China-based work on TikTok user videos and patent 

applications (below). 

2. Defendants’ BIPA And Other Biometrics-Related Violations Are 

Further Evidenced By Defendants’ China-Based Operations. 

114. Defendants’ BIPA violations are further established by their ongoing work in 

China, which includes: (a) the application of facial recognition technology to TikTok users’ 

videos by highly-trained engineers skilled in computer vision, convolutional neural network, and 

machine learning; (b) patent applications for face, voice, age, race/ethnicity, and emotion 

recognition technologies; and (c) the Douyin app’s functionality that allows its users to perform 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 44 of 113 PageID #:1106
 44 

facial recognition on faces selected by such users from other users’ videos. These factors also 

evidence violations of the other statutory, constitutional, and common law claims set forth 

herein. 

a. Defendants’ China-Based Team Of Highly-Skilled Computer 

Vision, Convolutional Neural Network, And Machine Learning 

Engineers. 

115. Defendants’ artificial intelligence work within China, which is closely tied to its 

United States operations, is among the most sophisticated in the world. “ByteDance has received 

accolades for being a top AI innovator from CBInsight who recognized the company on its 2018 

AI 100 List as well as from Fast Company, who placed it on its most innovative companies list. 

In 2016, it founded its AI Lab, a research division led by Wei-Ying Ma, formerly of Microsoft 

Research Asia. The Lab’s primary focus has been on developing innovative technologies to 

enhance ByteDance’s content platforms.”85 

116. Defendants have a team of engineers in cutting-edge fields such as computer 

vision,86 convolutional neural network (“CNN”),87 and machine learning,88 all of which are 

foundational to the face geometry scans and voiceprints that Defendants conduct on and/or 

derive from the Private Videos and the posted videos of TikTok users. 

 

85 https://www.forbes.com/sites/bernardmarr/2018/12/05/ai-in-china-how-buzzfeed-rivalbytedance-uses-machine-learning-to-revolutionize-the-news/#6579bada40db. 

86 Computer vision “is an interdisciplinary scientific field that deals with how computers can 

gain high-level understanding from digital images or videos. ... Computer vision tasks include 

methods for acquiring, processing, analyzing and understanding digital images .... The classical 

problem in computer vision, image processing, and machine vision is that of determining 

whether or not the image data contains some specific object, feature, or activity. ... • Object 

recognition (also called object classification) – one or several pre-specified or learned objects or 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 45 of 113 PageID #:1107
 45 

117. Defendants’ China-based engineering team includes, among others: (i) a research 

scientist focused on facial recognition, object detection, computer vision and machine learning 

who has worked for Defendants since 2018; (ii) a computer vision and image processing 

algorithm engineer who has worked for Defendants since 2017; (iii) a computer vision algorithm 

engineer who has worked for Defendants since 2019; (iv) a machine learning and neural network 

engineer who has worked for Defendants since 2017; (v) an algorithm engineer who focuses on 

video retrieval and who has worked for Defendants since 2018; and (vi) an algorithm engineer 

who has worked for Defendants since 2017. 

b. Facial Recognition Technology Applied To TikTok Videos. 

118. Wei-Ying Ma is a ByteDance Vice President in Beijing and has led the AI Lab 

since 2017. He is known for having developed a highly respected image retrieval system called 

 

object classes can be recognized, usually together with their 2D positions in the image or 3D 

poses in the scene. ... • Identification – an individual instance of an object is recognized. 

Examples include identification of a specific person’s face or fingerprint .... • Detection – the 

image data are scanned for a specific condition. ... Currently, the best algorithms for such tasks 

are based on convolutional neural networks. ... Several specialized tasks based on recognition 

exist, such as: • Content-based image retrieval – finding all images in a larger set of images 

which have a specific content. ... • Facial recognition.” See

https://en.wikipedia.org/wiki/Computer_vision#Recognition. 

87 CNN “is a class of deep neural networks, most commonly applied to analyzing visual imagery. 

... They have applications in image and video recognition, recommender systems, [and] image 

classification .... CNNs use relatively little pre-processing compared to other image 

classification algorithms. This means that the network learns the filters that in traditional 

algorithms were hand-engineered. This independence from prior knowledge and human effort in 

feature design is a major advantage.” See

https://en.wikipedia.org/wiki/Convolutional_neural_network#Image_recognition. 

88 Machine learning “is the study of computer algorithms that improve automatically through 

experience. It is seen as a subset of artificial intelligence. Machine learning algorithms build a 

mathematical model based on sample data, known as “training data”, in order to make 

predictions or decisions without being explicitly programmed to do so. Machine learning 

algorithms are used in a wide variety of applications, such as ... computer vision, where it is 

difficult or infeasible to develop conventional algorithms to perform the needed tasks.” See

https://en.wikipedia.org/wiki/Machine_learning. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 46 of 113 PageID #:1108
 46 

NeTra, which is a tool for navigating very large image databases. Ma recently delivered a 

keynote speech at a Taipei Web Conference in which he acknowledged that Defendants use 

facial recognition technology and face geometry scans on their enormous and ever-growing 

database of face images from user videos. During his speech, Ma used visual representations that 

show facial recognition and face geometry scans being performed on specific regions of face 

images. Chinese language text accompanying the face images indicate the type of facial 

expression and the age of the individuals represented by the face images. English language notes 

to the side of the face images refer to “emotion analysis,” “object detection and tracking,” and 

“content-based recommendation.” Ma made the following representations during his speech 

while these face images, accompanied by the aforementioned Chinese language and English 

language statements, were visually presented on the screen: 

We are actually receiving a huge number of video created by users every day, so 

it’s at the hundreds of millions of video per day. Imagine the amount of 

computation and also video understanding we need to do here. And here just to 

give you a glimpse of all kinds of video understanding tasks we need to run, and 

let me show you for example, you just saw that video, and for video like that we 

actually do all kind of analysis. We need to automatically classify and also do a 

lot tagging and understand the structure inside the video and also run copyright 

infringement detecting and duplicate detection and also object detection and 

tracking. So based on this video, we convert this video into a structural 

representation, and here just to give you one of the examples.89

119. Defendants’ team of engineers in China also includes a computer vision and 

 

89 https://www.youtube.com/watch?v=2D29f4-J2mw (at 18:18 – 19:17). 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 47 of 113 PageID #:1109
 47 

machine learning engineer who has worked for Defendants since 2018. His job responsibilities 

have included face/body detection and face attribute recognition, including specifically on 

TikTok users’ videos. 

120. Within China, Defendant Beijing ByteDance makes no secret of its processing 

and analysis of users’ videos from around the world. TechNode reported that one of its vice 

presidents publicly told a gathering that “ByteDance” required more chips to continue uploading, 

processing and analyzing its vast database of videos accumulated from around the world. This 

vice president stated that “‘Bytedance has the largest number of users in the world whose videos

need to be analyzed and processed and uploaded, and we are purchasing a large number of 

chips.’”

90

121. Defendants’ wealth of video recordings from TikTok users is critical to 

Defendants’ success in making the TikTok app one of the most popular in the world: “The 

[TikTok] app heavily utilizes AI that is trained on the vast quantity of video footage to 

understand the preferences of users, while also using machine learning to make creating, editing, 

and promoting the videos as easy as possible.”91

122. Indeed, “all of ByteDance’s products use artificial intelligence and machine 

learning to deliver content that users want. The company’s intelligent machines use computer 

vision and natural language processing technology to understand and analyze written content, 

images and videos. Then, based upon what the machines know about each user, they deliver the 

content it believes each user would want. As a user interacts with the content by taps, swipes, 

time spent with each article, comments and more, large-scale machine learning and deep learning 

 

90 https://technode.com/2018/04/24/bytedance-jinri-toutiao-ai-chips/ (emphasis added). 

91 https://dzone.com/articles/the-data-thats-driving-chinas-hidden-champions (emphasis added). 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 48 of 113 PageID #:1110
 48 

algorithms continue to learn about a user’s preferences to refine its content delivery for the 

future. The end result is a high-quality content feed based upon each user’s preferences and 

interests. As more content is accumulated by the system, the better the algorithms get to enhance 

the content experience.”92 As the United States National Security Adviser noted, Defendants are 

“getting facial recognition” on millions of Americans as well as mapping their relationships, and 

then sending all of this “intimate data” back to China for processing.93 

c. Face, Age, Race/Ethnicity And Emotion Recognition Patent 

Applications. 

123. One of Defendants’ engineers in China stands out for his inventions that form the 

basis of numerous patent applications filed by Defendants’ sister company Beijing ByteDance 

Network Technology Co., Ltd. The underlying technology in these patent applications involves 

age, race, and emotion detection through face images, including those derived from videos. The 

specific patent applications include, among others, the following: 

 a. Facial image identifying method.94

 b. Use of face images and a facial recognition model to determine ethnic 

information, to then determine race, to ultimately determine age.95

 c. Use of face and body images, and a facial recognition model, to determine 

age.96

 

92 https://www.forbes.com/sites/bernardmarr/2018/12/05/ai-in-china-how-buzzfeed-rivalbytedance-uses-machine-learning-to-revolutionize-the-news/#6579bada40db (emphasis added). 

93 https://www.forbes.com/sites/zakdoffman/2020/07/15/tiktok-trump-warning-facialrecognition-data-sends-china-ban/#493e38852dea

94 Publication No. WO2020037963A1. 

95 Publication No. CN110046571A. 

96 Publication No. CN109993150A. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 49 of 113 PageID #:1111
 49 

 d. Use of image data sets and audio data sets to determine age.97

 e. Use of face images extracted from videos to determine age.98

 f. Use of face images extracted from videos to determine age.99

 g. Human facial expression recognition method.100

 h. Use of face images extracted from videos to determine emotions based on 

expression recognition.101

 i. Use of face images extracted from video segments to identify a face 

characteristic by parsing the face image.102

124. This same engineer was one of the inventors involved in two earlier patent 

applications filed by a Chinese university that concern face attribute recognition103 and a face 

verification method that determines whether faces in two images are the same or distinct.104

125. “TikTok’s owner, Beijing-based ByteDance, is a hit app factory that has spent the 

last decade learning how to use artificial intelligence, machine learning, and facial recognition

to figure out what people like and serve them endless streams of entertainment tailored to their 

interests and emotions. Its apps are used by billions of people, including 1.45 billion global 

downloads for TikTok alone. The company has years of data informing it on how people think, 

feel and act, making it an expert on what makes people tick and how to persuade them to 

 

97 Publication No. CN110321863A. 

98 Publication No. CN110163170A. 

99 Publication No. CN110188660A. 

100 Publication No. CN110097004A. 

101 Publication No. CN110175565A. 

102 Publication No. CN110163171A. 

103 Publication No. CN106203395B. 

104 Publication No. CN106203533B. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 50 of 113 PageID #:1112
 50 

watch, share or like certain content.”105

d. Voiceprint Patent Applications. 

126. Beijing ByteDance Network Technology Co., Ltd. filed additional patent 

applications for a method for voice extraction involving voiceprints,106 a voice recognition 

method,107 and an age recognition method based on audio.108 This is consistent with reporting 

that Defendant Beijing ByteDance “uses various AI technologies in its services [including] voice 

recognition ....”109 In fact, during Wei-Ying Ma’s recent keynote speech at a Taipei Web 

Conference (above), he discussed the use of audio to identify speakers and he published a slide 

during his speech entitled “Speaker Identification” that stated: “Detect identity, age, gender of 

speakers.”110

e. The Douyin App’s Facial Recognition Function. 

127. The Douyin app provides its users with an “in-video” search tool that uses facial 

recognition technology. Users of Douyin can press the “Search” button while a video is playing, 

drag a rectangle around the target face in the video, and cause the Douyin app to perform a 

search (based on the face in question) for other videos in which the targeted person appears.111

 

105 https://www.bloomberg.com/news/newsletters/2019-10-29/worries-that-tiktok-is-a-threat-tonational-security-have-merit (emphasis added). 

106 Publication No. CN110503961A. 

107 Publication No. WO2019214628A1. 

108 Publication No. CN110335626A. 

109 https://medium.com/syncedreview/intel-and-bytedance-partner-on-ai-lab-b678036cbda4

(emphasis added). 

110 https://www.youtube.com/watch?v=2D29f4-J2mw (at 30:04). 

111 https://radiichina.com/tiktok-new-video-search-function-is-from-the-future/. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 51 of 113 PageID #:1113
 51 

This subjects anyone using the Douyin app to “behind-the-scenes facial recognition analysis.”112

While U.S. TikTok users cannot access this feature, there is evidence that they are subject to the 

same behind-the-scenes facial recognition analysis, as discussed herein. 

3. Defendants’ BIPA And Other Biometrics-Related Violations Are Also 

Evidenced By Their Obligation To Accumulate And Share Data, 

Including Biometrics, With The Chinese Government. 

128. Defendants’ BIPA violations are further established by Defendants’ legal and 

political obligations to accumulate and share data, including biometrics, in order to assist the 

Chinese government in meeting two crucial and intertwined state objectives: (a) world 

dominance in artificial intelligence; and (b) population surveillance and control.113 

a. The Chinese Government’s Plan To Become The World 

Leader In Artificial Intelligence. 

129. In 2017, the Chinese government released its Next Generation Artificial 

Intelligence Development Plan, in which it set 2030 as the temporal goal for becoming the world 

leader in artificial intelligence. To ensure achievement of its artificial intelligence goal, the 

Chinese government selected the five leading technology companies as “national champions” 

and assigned them particular areas of research and development within the artificial intelligence 

field. In exchange, these companies receive government support, including access to finance, 

preferential contract bidding and sometimes market share protection. The list of “national 

 

112 https://futurism.com/the-byte/tiktok-facial-recognition (emphasis added). 

113 This evidence also constitutes a basis for the other statutory, constitutional and common law 

causes of action herein. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 52 of 113 PageID #:1114
 52 

champions” has grown to at least 15 in recent years.114

130. The United States government has taken notice. Last November, Congress’s 

National Security Commission on Artificial Intelligence, chaired by former Google CEO Eric 

Schmidt, published an interim report warning that China was outpacing the United States in 

artificial intelligence spending.115

b. The Chinese Government’s Program Of Population 

Surveillance And Control. 

131. The Chinese government’s monitoring of and control over its own population are 

well known. Most notable is its pervasive use of artificial intelligence-enabled cameras to 

conduct video surveillance of its population.116 As the South China Morning Post reported: 

“China’s goal of becoming a global leader in artificial intelligence (AI) is nowhere more 

manifested than in how facial recognition technology has become a part of daily life in the 

world’s second-largest economy. Facial recognition systems, which are biometric computer 

applications that automatically identify an individual from a database of digital images, are now 

being used extensively in areas such as public security, financial services, transport and retail 

across the country.”117 In fact, the Chinese government employs a variety of biometrics for 

population surveillance and control: “In addition to voice recognition, there are facial and pupil 

recognition, gathering of DNA samples—building the world’s largest DNA database—and 

 

114 https://fortune.com/longform/tiktok-app-artificial-intelligence-addictive-bytedance-china/. 

115 https://fortune.com/longform/tiktok-app-artificial-intelligence-addictive-bytedance-china/. 

116 https://fortune.com/longform/tiktok-app-artificial-intelligence-addictive-bytedance-china/. 

117 https://www.scmp.com/tech/start-ups/article/2133234/meet-five-chinese-start-ups-pushingfacial-recognition-technology. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 53 of 113 PageID #:1115
 53 

fingerprint scans.”118 

c. Data Accumulation, Including Biometrics, Through ChinaBased Technology Companies Is A Critical Part Of Achieving 

The Chinese Government’s Twin Goals. 

132. Artificial intelligence algorithms feed on data to learn and improve – thus, the 

more data the better the development of the algorithms driving the advance of the artificial 

intelligence.119 With better artificial intelligence comes more effective population surveillance 

and control. 

133. To advance these interrelated goals, the Chinese government has worked hand in 

glove with China-based technology companies to accumulate and share data. For example, the 

China-based company Megvii, a leader in computer vision, has the world’s largest open source 

database (Face++) for training other facial recognition algorithms. It has reportedly used 

government data banks to help compile this training program.120 As another example, the 

Chinese government partnered with the China-based technology firm d-Ear Technologies to 

build a database of voiceprints for voice recognition purposes.121

134. “Private [China-based] corporations and the [Chinese] Communist Party’s 

security apparatus have grown together, discovering how the same data sets can both cater to 

consumers and help commissars calibrate repression. ... Many [China-based] tech firms make a 

point of hiring the relatives of high party officials, and a vast state database of headshots might 

 

118 https://vlifestyle.org/codec-news/?l=business/content-2254742-china-gathers-people-s-voicesnew-identification-technology-drawing-concerns. 

119 https://fortune.com/longform/tiktok-app-artificial-intelligence-addictive-bytedance-china/. 

120 https://fortune.com/longform/tiktok-app-artificial-intelligence-addictive-bytedance-china/. 

121 https://vlifestyle.org/codec-news/?l=business/content-2254742-china-gathers-people-s-voicesnew-identification-technology-drawing-concerns. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 54 of 113 PageID #:1116
 54 

be shared with a private firm to train new facial recognition software, while the firm’s trove of 

real-time user data might be offered to police, for a panoramic view of potential 

‘troublemakers.’”122

135. Such data accumulation is not confined to China’s borders. For example, the 

Chinese government is compiling a tremendous storehouse of private and personally-identifiable 

data on ordinary Americans. Recently, Chinese government-sponsored hackers stole data 

belonging to approximately 500 million Marriott International guests. “[M]achine learning is 

yielding uses for large data sets that humans alone could not imagine – or even understand – 

given that machine learning can generate correlations among data that the machine itself can’t 

explain. ... Beijing’s plan may be simply to vacuum up as much data like this as possible and 

then see what today’s machine learning—or, better yet, tomorrow’s machine learning—can do 

with it.”123

136. The lengths to which the Chinese government will go to obtain such data about 

ordinary Americans is further evidenced by other large-scale hacking schemes, including one 

involving 145 million Americans whose data was held by Equifax,124 and another involving 78 

million Americans whose data was held by Anthem.125 “The United States assessed that China 

was building a vast database of who worked with whom in national security jobs, where they 

traveled and what their health histories were, according to American officials. Over time, China 

can use the data sets to improve its artificial intelligence capabilities to the point where it can 

 

122 https://www.nytimes.com/interactive/2019/05/02/opinion/will-china-export-its-illiberalinnovation.html. 

123 https://www.justsecurity.org/62187/weapons-mass-consumerism-china-personal-information/. 

124 https://www.nytimes.com/2020/02/10/us/politics/equifax-hack-china.html. 

125 https://www.nytimes.com/2019/05/09/technology/anthem-hack-indicted-breach.html. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 55 of 113 PageID #:1117
 55 

predict which Americans will be primed for future grooming and recruitment ....”126 “The hacks, 

security researchers said, were an extension of China’s evolving algorithmic surveillance system, 

which has greatly expanded over the past few years.”127

137. The Chinese government’s goal of obtaining private and personally-identifiable 

data (including biometrics) of ordinary citizens throughout the world is also evidenced by the 

deal struck by China-based CloudWalk Technology in Africa. CloudWalk, with the Chinese 

government’s blessing, entered into a strategic partnership agreement with Zimbabwe to begin a 

large-scale facial recognition program. With access to a database containing millions of 

Zimbabwean faces, CloudWalk and the Chinese government intend to train their algorithms in 

order to further improve their facial recognition capabilities. “With the largest surveillance 

system already in place, China is also building one of the world’s most comprehensive facial 

recognition databases. Rolling out the technology in a majority black population will allow 

CloudWalk to more clearly identify other ethnicities, getting ahead of US and European 

developers.”128

d. Defendants Are Obligated By Chinese Law And Politics To 

Accumulate And Secretly Share Their Data, Including 

Biometrics, With The Chinese Government. 

138. Given the Chinese government’s illegal extraction of massive quantities of private 

and personally-identifiable data (including biometrics) from hundreds of millions of ordinary 

Americans and others, there is no reason to believe that the Chinese government has refrained 

 

126 https://www.nytimes.com/2020/02/10/us/politics/equifax-hack-china.html. 

127 https://www.nytimes.com/2019/05/09/technology/anthem-hack-indicted-breach.html. 

128 https://qz.com/africa/1287675/china-is-exporting-facial-recognition-to-africa-ensuring-aidominance-through-diversity/ (emphasis added). 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 56 of 113 PageID #:1118
 56 

from extracting the same type of U.S. TikTok user data from Defendants. In fact, to access that 

data, there is no need to hack major U.S. corporations or the China-based technology companies, 

like Defendants, that have surreptitiously amassed such information on their own. That is 

because such China-based companies are required by law to secretly provide that data to the 

government upon demand: 

The message contained in each of China’s state security laws passed since the 

beginning of 2014 is clear: everyone is responsible for the party-state’s security. 

According to the CCP’s definition of state security, the Party’s political leadership 

is central. ... And the party expects Chinese people and citizens to assist in 

collecting intelligence. The Intelligence Law states ‘any organization and citizen 

shall, in accordance with the law, support, provide assistance, and cooperate in 

national intelligence work, and guard the secrecy of any national intelligence 

work that they are aware of...’ Not only is everyone required to participate in 

intelligence work when asked, but that participation must be kept secret.129

139. Consequently, Defendants must “support, provide assistance and cooperate” by 

accumulating TikTok user data, including biometrics such as face geometry scans, voiceprints 

and information derived therefrom, and then share such data with the Chinese government. In an 

article entitled “Take China’s TikTok App Security Threat Seriously,” Bloomberg reported that 

many “Hong Kong protesters say that regardless of whether TikTok is censoring content or not, 

they fear posting on a social media site owned by ByteDance, a Beijing company that must hand 

 

129 https://capx.co/britain-must-avoid-being-sucked-into-huaweis-moral-vacuum/. See also

https://www.lawfareblog.com/beijings-new-national-intelligence-law-defense-offense. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 57 of 113 PageID #:1119
 57 

over user information to Chinese authorities if asked, just like all its compatriots.”130

140. In fact, Defendants in this action – including even the two based in the United 

States (Defendants TikTok, Inc. and ByteDance, Inc.) – have objected to Plaintiff Misty Hong’s 

requests for the production of relevant documents in this lawsuit “to the extent they seek state 

secrets or any other information that cannot be disclosed without violating Chinese law, 

including the People’s Republic of China on Guarding State Secrets and/or Civil Procedure Law 

of the People’s Republic of China (“State Secrets”).” Defendants apparently interposed this 

“State Secrets” objection in order to comply with China’s Intelligence Law requirement that 

“[n]ot only is everyone required to participate in intelligence work when asked, but that 

participation must be kept secret.”131 This “State Secrets” objection flatly contradicts Defendant 

TikTok, Inc.’s misleading public statement that “none of our data is subject to Chinese law.”132

141. Defendant Beijing ByteDance has a particularly strong incentive to cooperate 

with the Chinese government. In 2018, China’s State Administration of Radio and Television, an 

arm of the Chinese Communist Party, ordered Defendant Beijing ByteDance to shut down one of 

its apps due to “vulgar” content. That prompted the CEO of Defendant Beijing ByteDance to 

publicly apologize. His re-dedication to the Chinese Communist Party resulted in his being 

named one of the “100 outstanding private entrepreneurs” who were “chosen for being 

‘emblematic of the country’s private economic development’, while also being people who 

 

130 https://www.bloomberg.com/news/newsletters/2019-10-29/worries-that-tiktok-is-a-threat-tonational-security-have-merit. 

131 https://capx.co/britain-must-avoid-being-sucked-into-huaweis-moral-vacuum/. 

132 https://newsroom.tiktok.com/en-us/statement-on-tiktoks-content-moderation-and-datasecurity-practices. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 58 of 113 PageID #:1120
 58 

‘resolutely uphold the Party’s leadership ....’”133

142. In a further show of allegiance to the Chinese government, Defendant Beijing 

ByteDance actively supports and participates in the spreading of Communist Party propaganda. 

It signed a strategic cooperation agreement with the Ministry of Public Security’s Press and 

Publicity Bureau to promote the credibility of the police department, including within an area of 

China known for severe repression, demolition of mosques, and wide-spread detention centers 

for ethnic minorities. Under that agreement, “all levels and divisions of police units from the 

Ministry of Public Security to county-level traffic police would have their own Douyin account 

to disseminate propaganda. The agreement also reportedly says ByteDance would increase its 

offline cooperation with the police department ....”134

143. Combined with evidence of the TikTok’s app’s functionality and code, the 

application of facial recognition technology to TikTok user videos, the patent applications for 

facial, voice, age, race/ethnicity and emotion recognition technologies, and the Douyin app’s 

facial recognition feature, Defendants’ legal obligations and political ties to the Chinese 

government make clear their large-scale BIPA and other biometrics violations. 

VII. DEFENDANTS UNJUSTLY PROFIT WHILE PLAINTIFFS, THE CLASS AND 

THE TWO SUBCLASSES SUFFER HARM. 

144. Defendants use the User/Device Identifiers, the biometric identifiers and 

information, the Private Videos and Private Video Images, and the video viewing histories to 

create a dossier of private and personally-identifiable data and content for each TikTok user. 

 

133 https://chinatechmap.aspi.org.au/#/company/bytedance. 

134 https://chinatechmap.aspi.org.au/#/company/bytedance. See also

https://www.washingtonpost.com/world/tiktoks-owner-is-helping-chinas-campaign-ofrepression-in-xinjiang-report-finds/2019/11/28/98e8d9e4-119f-11ea-bf62-

eadd5d11f559_story.html. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 59 of 113 PageID #:1121
 59 

These are living files that are supplemented over time with additional private and personallyidentifiable user data and content, and utilized in the past, the present and the future for 

economic and financial gain. 

145. Defendants’ unlawful possession and control over these ever-expanding dossiers 

make tracking and profiling TikTok users, and targeting them with advertising, much more 

efficient, effective and lucrative. These living dossiers of private and personally-identifiable data 

and content are used to analyze TikTok users’ income, consumption habits, and preferences. 

Such information provides guidance as to what methods of advertising will be most effective on 

particular TikTok users, what products – including Defendants’ own products – will be most 

attractive to particular TikTok users, and how much to spend on particular ads. Defendants 

unjustly have earned and continue to earn substantial profits and revenues from such targeted 

advertising and from generating increased demand for and use of Defendants’ other products. 

146. Defendants also unlawfully leverage these living dossiers of private and 

personally-identifiable TikTok user data and content to improve their artificial intelligence 

technologies and file patent applications, thereby unjustly increasing their past, present and 

future profits and revenues – and their market value. 

147. Meanwhile, Plaintiffs, the Class and the Subclasses have incurred, and continue to 

incur, harm as a result of the invasion of privacy stemming from Defendants’ covert theft of their 

private and personally-identifiable data and content – including their User/Device Identifiers, 

biometric identifiers and information, Private Videos and Private Video Images, and video 

viewing histories. Plaintiffs, the Class and the Subclasses also have suffered and continue to 

suffer harm in the form of diminution of the value of their private and personally-identifiable 

data and content as a result of Defendants’ surreptitious and unlawful activities. Moreover, 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 60 of 113 PageID #:1122
 60 

Plaintiffs, the Class and the Subclasses have suffered and continue to suffer injuries to their 

mobile devices. The battery, memory, CPU and bandwidth of such devices have been 

compromised, and as a result the functioning of such devices has been impaired and slowed, due 

to Defendants’ clandestine and unlawful activities. Finally, Plaintiffs, the Class and the two 

Subclasses have incurred additional data usage and electricity costs that they would not have 

incurred but for Defendants’ covert and unlawful actions. 

VIII. FRAUDULENT CONCEALMENT AND TOLLING. 

148. The applicable statutes of limitations are tolled as a result of Defendants’ knowing 

and active concealment of their unlawful conduct alleged above – through, among other things, 

their obfuscation of the source code, misleading public statements, and hidden and ambiguous 

privacy policies and terms of use. Plaintiffs, the Class and the two Subclasses were ignorant of 

the information essential to pursue their claims, without any fault or lack of diligence on their 

own part. 

149. Also, at the time the action was filed, Defendants were under a duty to disclose 

the true character, quality, and nature of their activities to Plaintiffs, the Class and the two 

Subclasses. Defendants are therefore estopped from relying on any statute of limitations. 

150. Defendants’ fraudulent concealment is common to the Class and the two 

Subclasses. 

IX. NAMED PLAINTIFF ALLEGATIONS. 

A. The California Plaintiffs. 

1. Plaintiff Misty Hong. 

151. Plaintiff Misty Hong is currently a full-time college student. In or about March or 

April 2019, Ms. Hong downloaded the TikTok app onto her mobile device. At the time Ms. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 61 of 113 PageID #:1123
 61 

Hong downloaded the TikTok app, she did not read any privacy policy or terms of use, nor did 

she see discernible hyperlinks to or warnings about these items. In fact, she never clicked the 

sign-up button and never knowingly created an account with Defendants. However, months later, 

she discovered for the first time that Defendant TikTok, Inc. had created an account for her, 

without her knowledge or consent, and provided her with a user name (the word “user” followed 

by a combination of numbers followed by “@” followed by the word “user” followed by a 

combination of letters and numbers) and assigned her phone number as the account password. 

152. Shortly after completing the download of the TikTok app onto her mobile device, 

Ms. Hong made approximately five or six videos using the TikTok app on her mobile device. 

Images of her face were captured in some or all of these videos. Ms. Hong experienced difficulty 

in timing the background music to lip-syncing and dancing. Consequently, after shooting each 

video, Ms. Hong (i) sometimes pressed the “next” button and (ii) sometimes pressed the “x” 

button and then the “reshoot” button. Ms. Hong neither saved nor posted any of these videos. 

But, as a result of sometimes pressing the “next” button, Defendants took some of these Private 

Videos without Ms. Hong’s knowledge or consent. Images of Ms. Hong’s face also have been 

captured in Musical.ly and/or TikTok videos recorded and posted by others. 

153. During the time that the TikTok app was installed on Ms. Hong’s mobile device, 

Defendants surreptitiously performed the following actions without notice to or the knowledge 

and consent of Ms. Hong: (i) Defendants took her User/Device Identifiers and Private Videos 

from her mobile device; (ii) Defendants took her biometric identifiers and information (including 

face geometry scans and voiceprints) from her and her friends’ mobile device and/or videos; (iii) 

Defendants took her private and personally-identifiable data and content from her mobile device 

before she had the opportunity to sign up and create an account; (iv) Defendants took her private 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 62 of 113 PageID #:1124
 62 

and personally-identifiable data and content from her mobile device after she closed the TikTok 

app; and (v) Defendants transferred some or all such stolen data and content to servers located in 

China – including to servers under the control of third-parties who cooperate with the Chinese 

government. 

154. Defendants performed these acts for the purpose of secretly collecting Ms. Hong’s 

private and personally-identifiable data and content – including her User/Device Identifiers, 

biometric identifiers and information, and Private Videos – and using such data and content to 

track, profile and target Ms. Hong with advertisements. Further, Defendants have used Ms. 

Hong’s private and personally-identifiable data and content for the purpose of developing their 

artificial intelligence capabilities and patenting commercially-valuable technologies. Defendants 

and others now have access to a living and information-laden dossier on Ms. Hong that can be 

used for further commercial advantage and other harmful purposes. Defendants have profited, 

and will continue to profit, from these activities. 

155. Meanwhile, Ms. Hong has incurred harm as a result of Defendants’ invasion of 

her privacy rights through their covert taking of her private and personally-identifiable data and 

content – including her User/Device Identifiers, biometric identifiers and information, and 

Private Videos. Ms. Hong also has suffered harm because Defendant’s actions have diminished 

the value of her private and personally-identifiable data and content. Moreover, Ms. Hong has 

suffered injury to her mobile device. The battery, memory, CPU and bandwidth of her device has 

been compromised, and as a result the functioning of that device has been impaired and slowed, 

due to Defendants’ clandestine and unlawful activities. Finally, Ms. Hong has incurred additional 

data usage and electricity costs that she would not have incurred but for Defendants’ covert and 

unlawful actions. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 63 of 113 PageID #:1125
 63 

2. Plaintiff A.S. 

156. Plaintiff A.S., a minor who is currently 15 years old, first downloaded the 

Musical.ly app to her mobile device and created a user account in 2016 when she was under age 

13. She subsequently downloaded the Musical.ly app in 2017 to a new mobile device that was 

hers. In 2019, A.S. downloaded the TikTok app to another new mobile device that was hers. A.S. 

and her legal guardian have never seen or read any of Defendants’ privacy policies or terms of 

use. 

157. Beginning in 2016, A.S. created numerous videos using the Musical.ly app and 

the TikTok app. Many are Private Videos containing images of her face, while many others are 

videos containing her voice and images of her face that she intentionally uploaded and posted. 

A.S. used the augmented reality features and facial filters on her face in both Private Videos and 

in videos that she intentionally uploaded and posted. 

158. During the time that the TikTok app was installed on A.S.’s mobile devices, 

Defendants surreptitiously performed the following actions without notice to or the knowledge 

and consent of A.S. or her legal guardian: (i) Defendants took her User/Device Identifiers, 

Private Videos and Private Video Images from her mobile devices; (ii) Defendants took her 

biometric identifiers and information (including face geometry scans and voiceprints) from her 

mobile devices and/or videos; (iii) Defendants shared her video viewing history with third 

parties; (iv) Defendants took her private and personally-identifiable data and content from her 

other social media accounts; (v) Defendants took her private and personally-identifiable data and 

content from her mobile devices before she had the opportunity to sign up and create an account; 

(vi) Defendants took her private and personally-identifiable data and content from her mobile 

devices after she closed the TikTok app; and (vii) Defendants transferred some or all such stolen 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 64 of 113 PageID #:1126
 64 

data and content to servers located in China – including to servers under the control of thirdparties who cooperate with the Chinese government. 

159. Defendants performed these acts for the purpose of secretly collecting A.S.’s 

private and personally-identifiable data and content – including her User/Device Identifiers, 

biometric identifiers and information, Private Videos and Private Video Images, and video 

viewing history – and using such data and content to track, profile and target A.S. with 

advertisements. Further, Defendants have used A.S.’s private and personally-identifiable data 

and content for the purpose of developing their artificial intelligence capabilities and patenting 

commercially-valuable technologies. Defendants and others now have access to a living and 

information-laden dossier on A.S. that can be used for further commercial advantage and other 

harmful purposes. Defendants have profited, and will continue to profit, from these activities. 

160. Meanwhile, A.S. has incurred harm as a result of Defendants’ invasion of her 

privacy rights through their covert taking of her private and personally-identifiable data and 

content – including her User/Device Identifiers, biometric identifiers and information, Private 

Videos and Private Video Images, and video viewing history. A.S. also has suffered harm 

because Defendant’s actions have diminished the value of her private and personally-identifiable 

data and content. Moreover, A.S. has suffered injury to her mobile devices. The battery, 

memory, CPU and bandwidth of such devices have been compromised, and as a result the 

functioning of those devices has been impaired and slowed, due to Defendants’ clandestine and 

unlawful activities. Finally, A.S. has incurred additional data usage and electricity costs that she 

would not have incurred but for Defendants’ covert and unlawful actions. 

3. Plaintiff A.R. 

161. A.R. downloaded the Musical.ly app to her mobile device and created a user 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 65 of 113 PageID #:1127
 65 

account in or about 2017 when she was approximately 12 years old. Subsequently, in 2019, 

while still a minor, A.R. downloaded the TikTok app to a new mobile device that was hers. A.R. 

and her legal guardian have never seen or read any of Defendants’ privacy policies or terms of 

use. 

162. A.R. created numerous videos using the Musical.ly app and the TikTok app. 

Many are Private Videos containing images of her face, while many others are videos containing 

images of her face that she intentionally uploaded and posted. A.R. used the augmented reality 

features and facial filters on her face in her Private Videos. A.R.’s voice and images of A.R.’s 

face have been captured in Private Videos recorded by others, as well as in videos that were 

recorded, uploaded and posted by others. 

163. During the time that the TikTok app was installed on A.R.’s mobile devices, 

Defendants surreptitiously performed the following actions without notice to or the knowledge 

and consent of A.R. or her legal guardian: (i) Defendants took her User/Device Identifiers, 

Private Videos and Private Video Images from her mobile devices; (ii) Defendants took her 

biometric identifiers and information (including face geometry scans) from her and her friends’ 

mobile devices and/or videos; (iii) Defendants shared her video viewing history with third 

parties; (iv) Defendants took her private and personally-identifiable data and content from her 

mobile devices before she had the opportunity to sign up and create an account; (v) Defendants 

took her private and personally-identifiable data and content from her mobile devices after she 

closed the TikTok app; and (vi) Defendants transferred some or all such stolen data and content 

to servers located in China – including to servers under the control of third-parties who cooperate 

with the Chinese government. 

164. Defendants performed these acts for the purpose of secretly collecting A.R.’s 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 66 of 113 PageID #:1128
 66 

private and personally-identifiable data and content – including her User/Device Identifiers, 

biometric identifiers and information, Private Videos and Private Video Images, and video 

viewing history – and using such data and content to track, profile and target A.R. with 

advertisements. Further, Defendants have used A.R.’s private and personally-identifiable data 

and content for the purpose of developing their artificial intelligence capabilities and patenting 

commercially-valuable technologies. Defendants and others now have access to a living and 

information-laden dossier on A.R. that can be used for further commercial advantage and other 

harmful purposes. Defendants have profited, and will continue to profit, from these activities. 

165. Meanwhile, A.R. has incurred harm as a result of Defendants’ invasion of her 

privacy rights through their covert taking of her private and personally-identifiable data and 

content – including her User/Device Identifiers, biometric identifiers and information, Private 

Videos and Private Video Images, and video viewing history. A.R. also has suffered harm 

because Defendant’s actions have diminished the value of her private and personally-identifiable 

data and content. Moreover, A.R. has suffered injury to her mobile devices. The battery, 

memory, CPU and bandwidth of her devices have been compromised, and as a result the 

functioning of those devices has been impaired and slowed, due to Defendants’ clandestine and 

unlawful activities. Finally, A.R. has incurred additional data usage and electricity costs that she 

would not have incurred but for Defendants’ covert and unlawful actions. 

B. The Illinois Plaintiffs. 

1. Plaintiff Meghan Smith. 

166. Plaintiff Meghan Smith downloaded the TikTok app to her mobile device and 

created a user account in 2018. Ms. Smith has never read and does not recall seeing any of 

Defendants’ privacy policies or terms of use. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 67 of 113 PageID #:1129
 67 

167. Ms. Smith created numerous videos using the TikTok app. Many are Private 

Videos containing her voice and images of her face, while many others are videos containing her 

voice and images of her face that she intentionally uploaded and posted. Ms. Smith used the 

augmented reality features and facial filters on her face in both Private Videos and in videos that 

she intentionally uploaded and posted. 

168. During the time that the TikTok app was installed on Ms. Smith’s mobile device, 

Defendants surreptitiously performed the following actions without notice to or the knowledge 

and consent of Ms. Smith: (i) Defendants took her User/Device Identifiers, Private Videos, and 

Private Video Images from her mobile device; (ii) Defendants took her biometric identifiers and 

information (including face geometry scans and voiceprints) from her mobile device and/or 

videos; (iii) Defendants shared her video viewing history with third parties; (iv) Defendants took 

her private and personally-identifiable data and content from her mobile device before she had 

the opportunity to sign up and create an account; (v) Defendants took her private and personallyidentifiable data and content from her mobile device after she closed the TikTok app; and (vi) 

Defendants transferred some or all such stolen data and content to servers located in China – 

including to servers under the control of third-parties who cooperate with the Chinese 

government. 

169. Defendants performed these acts for the purpose of secretly collecting Ms. 

Smith’s private and personally-identifiable data and content – including her User/Device 

Identifiers, biometric identifiers and information, Private Videos and Private Video Images, and 

video viewing history – and using such data and content to track, profile and target Ms. Smith 

with advertisements. Further, Defendants have used Ms. Smith’s private and personallyidentifiable data and content for the purpose of developing their artificial intelligence capabilities 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 68 of 113 PageID #:1130
 68 

and patenting commercially-valuable technologies. Defendants and others now have access to a 

living and information-laden dossier on Ms. Smith that can be used for further commercial 

advantage and other harmful purposes. Defendants have profited, and will continue to profit, 

from these activities. 

170. Meanwhile, Ms. Smith has incurred harm as a result of Defendants’ invasion of 

her privacy rights through their covert taking of her private and personally-identifiable data and 

content – including her User/Device Identifiers, biometric identifiers and information, Private 

Videos and Private Video Images, and video viewing history. Ms. Smith also has suffered harm 

because Defendant’s actions have diminished the value of her private and personally-identifiable 

data and content. Moreover, Ms. Smith has suffered injury to her mobile device. The battery, 

memory, CPU and bandwidth of such device have been compromised, and as a result the 

functioning of that device has been impaired and slowed, due to Defendants’ clandestine and 

unlawful activities. Finally, Ms. Smith has incurred additional data usage and electricity costs 

that she would not have incurred but for Defendants’ covert and unlawful actions. 

171. Ms. Smith never received notice that Defendants would collect, capture, receive, 

otherwise obtain, store, and/or use her face geometry scans, voiceprints or any of her other 

biometric information. Defendants never informed Ms. Smith of the specific purpose and length 

of time for which her face geometry scans, voiceprints or any of her other biometric information 

would be collected, captured, received, otherwise obtained, stored, and/or used. Ms. Smith never 

signed a written release authorizing Defendants to collect, capture, receive, otherwise obtain, 

store, and/or use her face geometry scans, voiceprints or any of her other biometric information. 

2. Plaintiffs C.W. and I.W. 

172. Plaintiff C.W., a minor who is currently 11 years old, and Plaintiff I.W., a minor 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 69 of 113 PageID #:1131
 69 

who is currently 8 years old, are siblings who each downloaded the TikTok app to their own 

mobile devices and created their respective user accounts in or about March 2019. C.W., I.W. 

and their legal guardian have never seen or read any of Defendants’ privacy policies or terms of 

use. 

173. C.W. and I.W. each created numerous videos using the TikTok app. Each has 

videos containing images of their respective faces that they intentionally uploaded and posted. 

C.W. and I.W. used the augmented reality features and facial filters on their respective faces in 

videos they intentionally uploaded and posted. 

174. During the time that the TikTok app was installed on C.W.’s and I.W.’s mobile 

devices, Defendants surreptitiously performed the following actions without notice to or the 

knowledge and consent of C.W., I.W., or their legal guardian: (i) Defendants took their 

User/Device Identifiers from their mobile devices; (ii) Defendants took their biometric identifiers 

and information (including face geometry scans) from their mobile device and/or videos; (iii) 

Defendants shared their video viewing histories with third parties; (iv) Defendants took their 

private and personally-identifiable data and content from their mobile devices before they had 

the opportunity to sign up and create an account; (v) Defendants took their private and 

personally-identifiable data and content from their mobile devices after they closed the TikTok 

app; and (vi) Defendants transferred some or all such stolen data and content to servers located in 

China – including to servers under the control of third-parties who cooperate with the Chinese 

government. 

175. Defendants performed these acts for the purpose of secretly collecting C.W.’s and 

I.W.’s private and personally-identifiable data and content – including their User/Device 

Identifiers and biometric identifiers and information, and video viewing histories – and using 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 70 of 113 PageID #:1132
 70 

such data and content to track, profile and target C.W. and I.W. with advertisements. Further, 

Defendants have used C.W.’s and I.W.’s private and personally-identifiable data and content for 

the purpose of developing Defendants’ artificial intelligence capabilities and patenting 

commercially-valuable technologies. Defendants and others now have access to a living and 

information-laden dossier on C.W. and I.W. that can be used for further commercial advantage 

and other harmful purposes. Defendants have profited, and will continue to profit, from these 

activities. 

176. Meanwhile, C.W. and I.W. have incurred harm as a result of Defendants’ invasion 

of their privacy rights through Defendants’ covert taking of C.W.’s and I.W.’s private and 

personally-identifiable data and content – including their User/Device Identifiers, biometric 

identifiers and information, and video viewing histories. C.W. and I.W. also have suffered harm 

because Defendant’s actions have diminished the value of their private and personallyidentifiable data and content. Moreover, C.W. and I.W. have suffered injury to their mobile 

devices. The battery, memory, CPU and bandwidth of such devices have been compromised, and 

as a result the functioning of those devices has been impaired and slowed, due to Defendants’ 

clandestine and unlawful activities. Finally, C.W. and I.W. have incurred additional data usage 

and electricity costs that they would not have incurred but for Defendants’ covert and unlawful 

actions. 

177. Neither C.W., I.W., or their guardian ever received notice that Defendants would 

collect, capture, receive, otherwise obtain, store, and/or use C.W.’s or I.W.’s face geometry scans 

or any of their other biometric information. Defendants never informed C.W., I.W., or their 

guardian of the specific purpose and length of time for which C.W.’s and I.W.’s face geometry 

scans or any of their other biometric information would be collected, captured, received, 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 71 of 113 PageID #:1133
 71 

otherwise obtained, stored, and/or used. Neither C.W., I.W., or their guardian ever signed a 

written release authorizing Defendants to collect, capture, receive, otherwise obtain, store, and/or 

use C.W.’s or I.W.’s face geometry scans or any of their other biometric information. 

3. Plaintiff R.P. 

178. R.P., a minor who is currently 11 years old, downloaded the TikTok app to her 

mobile device and created a user account in 2018. R.P. and her legal guardian have never seen or 

read any of Defendants’ privacy policies or terms of use. 

179. R.P. created numerous videos using the TikTok app. Many are Private Videos 

containing images of her face, while many others are videos containing images of her face that 

she intentionally uploaded and posted. R.P. used the augmented reality features and facial filters 

on her face in both Private Videos and in videos that she intentionally uploaded and posted. 

Images of R.P.’s face have been captured in videos that were recorded, uploaded and posted by 

others. 

180. During the time that the TikTok app was installed on R.P.’s mobile device, 

Defendants surreptitiously performed the following actions without notice to or the knowledge 

and consent of R.P. or her legal guardian: (i) Defendants took her User/Device Identifiers, 

Private Videos and Private Video Images from her mobile device; (ii) Defendants took her 

biometric identifiers and information (including face geometry scans) from her mobile device 

and/or videos; (iii) Defendants shared her video viewing history with third parties; (iv) 

Defendants took her private and personally-identifiable data and content from her mobile device 

before she had the opportunity to sign up and create an account; (v) Defendants took her private 

and personally-identifiable data and content from her mobile device after she closed the TikTok 

app; and (vi) Defendants transferred some or all such stolen data and content to servers located in 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 72 of 113 PageID #:1134
 72 

China – including to servers under the control of third-parties who cooperate with the Chinese 

government. 

181. Defendants performed these acts for the purpose of secretly collecting R.P.’s 

private and personally-identifiable data and content – including her User/Device Identifiers, 

biometric identifiers and information, Private Videos and Private Video Images, and video 

viewing history – and using such data and content to track, profile and target R.P. with 

advertisements. Further, Defendants have used R.P.’s private and personally-identifiable data 

and content for the purpose of developing their artificial intelligence capabilities and patenting 

commercially-valuable technologies. Defendants and others now have access to a living and 

information-laden dossier on R.P. that can be used for further commercial advantage and other 

harmful purposes. Defendants have profited, and will continue to profit, from these activities. 

182. Meanwhile, R.P. has incurred harm as a result of Defendants’ invasion of her 

privacy rights through their covert taking of her private and personally-identifiable data and 

content – including her User/Device Identifiers, biometric identifiers and information, Private 

Videos and Private Video Images, and video viewing history. R.P. also has suffered harm 

because Defendant’s actions have diminished the value of her private and personally-identifiable 

data and content. Moreover, R.P. has suffered injury to her mobile device. The battery, memory, 

CPU and bandwidth of her device have been compromised, and as a result the functioning of that 

device has been impaired and slowed, due to Defendants’ clandestine and unlawful activities. 

Finally, R.P. has incurred additional data usage and electricity costs that she would not have 

incurred but for Defendants’ covert and unlawful actions. 

183. Neither R.P. or her guardian ever received notice that Defendants would collect, 

capture, receive, otherwise obtain, store, and/or use R.P.’s face geometry scans or any of her 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 73 of 113 PageID #:1135
 73 

other biometric information. Defendants never informed R.P. or her guardian of the specific 

purpose and length of time for which R.P.’s face geometry scans or any of her other biometric 

information would be collected, captured, received, otherwise obtained, stored, and/or used. 

Neither R.P. or her guardian ever signed a written release authorizing Defendants to collect, 

capture, receive, otherwise obtain, store, and/or use R.P.’s face geometry scans or any of her 

other biometric information. 

4. Plaintiff P.S. 

184. P.S. downloaded the TikTok app to her mobile device and created a user account 

in or about 2019 when she was approximately 12 years old. P.S. and her legal guardian have 

never seen or read any of Defendants’ privacy policies or terms of use. 

185. P.S. created numerous videos using the TikTok app. Many are Private Videos 

containing images of her face, while many others are videos containing images of her face that 

she intentionally uploaded and posted. P.S. used the augmented reality features and facial filters 

on her face. P.S.’s voice and images of P.S.’s face have been captured in Private Videos recorded 

by others, as well as in videos that were recorded, uploaded and posted by others. 

186. During the time that the TikTok app was installed on P.S.’s mobile device, 

Defendants surreptitiously performed the following actions without notice to or the knowledge 

and consent of P.S. or her legal guardian: (i) Defendants took her User/Device Identifiers, 

Private Videos and Private Video Images from her mobile devices; (ii) Defendants took her 

biometric identifiers and information (including face geometry scans and voiceprints) from her 

and her friends’ mobile devices and/or videos; (iii) Defendants shared her video viewing history 

with third parties; (iv) Defendants took her private and personally-identifiable data and content 

from her mobile devices before she had the opportunity to sign up and create an account; (v) 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 74 of 113 PageID #:1136
 74 

Defendants took her private and personally-identifiable data and content from her mobile devices 

after she closed the TikTok app; and (vi) Defendants transferred some or all such stolen data and 

content to servers located in China – including to servers under the control of third-parties who 

cooperate with the Chinese government. 

187. Defendants performed these acts for the purpose of secretly collecting P.S.’s 

private and personally-identifiable data and content – including her User/Device Identifiers, 

biometric identifiers and information, Private Videos and Private Video Images, and video 

viewing history – and using such data and content to track, profile and target P.S. with 

advertisements. Further, Defendants have used P.S.’s private and personally-identifiable data and 

content for the purpose of developing their artificial intelligence capabilities and patenting 

commercially-valuable technologies. Defendants and others now have access to a living and 

information-laden dossier on P.S. that can be used for further commercial advantage and other 

harmful purposes. Defendants have profited, and will continue to profit, from these activities. 

188. Meanwhile, P.S. has incurred harm as a result of Defendants’ invasion of her 

privacy rights through their covert taking of her private and personally-identifiable data and 

content – including her User/Device Identifiers, biometric identifiers and information, Private 

Videos and Private Video Images, and video viewing history. P.S. also has suffered harm 

because Defendant’s actions have diminished the value of her private and personally-identifiable 

data and content. Moreover, P.S. has suffered injury to her mobile devices. The battery, memory, 

CPU and bandwidth of her devices have been compromised, and as a result the functioning of 

those devices has been impaired and slowed, due to Defendants’ clandestine and unlawful 

activities. Finally, P.S. has incurred additional data usage and electricity costs that she would not 

have incurred but for Defendants’ covert and unlawful actions. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 75 of 113 PageID #:1137
 75 

189. Neither P.S. or her guardian ever received notice that Defendants would collect, 

capture, receive, otherwise obtain, store, and/or use P.S.’s face geometry scans, voiceprints or 

any of her other biometric information. Defendants never informed P.S. or her guardian of the 

specific purpose and length of time for which P.S.’s face geometry scans, voiceprints or any of 

her other biometric information would be collected, captured, received, otherwise obtained, 

stored, and/or used. Neither P.S. or her guardian ever signed a written release authorizing 

Defendants to collect, capture, receive, otherwise obtain, store, and/or use P.S.’s face geometry 

scans, voiceprints or any of her other biometric information. 

5. Plaintiff M.T.W. 

190. M.T.W. first downloaded the Musical.ly app followed by the TikTok app to her 

mobile device and created a user account in or about 2018 when she was approximately 15 years 

old. M.T.W. and her legal guardian have never seen or read any of Defendants’ privacy policies 

or terms of use. 

191. M.T.W. created numerous videos using the Musical.ly app and the TikTok app. 

Many are Private Videos containing images of her face, while many others are videos containing 

images of her face that she intentionally uploaded and posted. M.T.W. used the augmented 

reality features and facial filters on her face. M.T.W.’s voice and images of M.T.W.’s face have 

been captured in Private Videos recorded by others, as well as in videos that were recorded, 

uploaded and posted by others. 

192. During the time that the TikTok app was installed on M.T.W.’s mobile device, 

Defendants surreptitiously performed the following actions without notice to or the knowledge 

and consent of M.T.W. or her legal guardian: (i) Defendants took her User/Device Identifiers, 

Private Videos and Private Video Images from her mobile devices; (ii) Defendants took her 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 76 of 113 PageID #:1138
 76 

biometric identifiers and information (including face geometry scans and voiceprints) from her 

and her friends’ mobile devices and/or videos; (iii) Defendants shared her video viewing history 

with third parties; (iv) Defendants took her private and personally-identifiable data and content 

from her mobile devices before she had the opportunity to sign up and create an account; (v) 

Defendants took her private and personally-identifiable data and content from her mobile devices 

after she closed the TikTok app; and (vi) Defendants transferred some or all such stolen data and 

content to servers located in China – including to servers under the control of third-parties who 

cooperate with the Chinese government. 

193. Defendants performed these acts for the purpose of secretly collecting M.T.W.’s 

private and personally-identifiable data and content – including her User/Device Identifiers, 

biometric identifiers and information, Private Videos and Private Video Images, and video 

viewing history – and using such data and content to track, profile and target M.T.W. with 

advertisements. Further, Defendants have used M.T.W.’s private and personally-identifiable data 

and content for the purpose of developing their artificial intelligence capabilities and patenting 

commercially-valuable technologies. Defendants and others now have access to a living and 

information-laden dossier on M.T.W. that can be used for further commercial advantage and 

other harmful purposes. Defendants have profited, and will continue to profit, from these 

activities. 

194. Meanwhile, M.T.W. has incurred harm as a result of Defendants’ invasion of her 

privacy rights through their covert taking of her private and personally-identifiable data and 

content – including her User/Device Identifiers, biometric identifiers and information, Private 

Videos and Private Video Images, and video viewing history. M.T.W. also has suffered harm 

because Defendant’s actions have diminished the value of her private and personally-identifiable 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 77 of 113 PageID #:1139
 77 

data and content. Moreover, M.T.W. has suffered injury to her mobile devices. The battery, 

memory, CPU and bandwidth of her devices have been compromised, and as a result the 

functioning of those devices has been impaired and slowed, due to Defendants’ clandestine and 

unlawful activities. Finally, M.T.W. has incurred additional data usage and electricity costs that 

she would not have incurred but for Defendants’ covert and unlawful actions. 

195. Neither M.T.W. or her guardian ever received notice that Defendants would 

collect, capture, receive, otherwise obtain, store, and/or use M.T.W.’s face geometry scans, 

voiceprints or any of her other biometric information. Defendants never informed M.T.W. or her 

guardian of the specific purpose and length of time for which M.T.W.’s face geometry scans, 

voiceprints or any of her other biometric information would be collected, captured, received, 

otherwise obtained, stored, and/or used. Neither M.T.W. or her guardian ever signed a written 

release authorizing Defendants to collect, capture, receive, otherwise obtain, store, and/or use 

M.T.W.’s face geometry scans, voiceprints or any of her other biometric information. 

X. CLASS ALLEGATIONS. 

196. Plaintiffs seek class certification of the class set forth herein pursuant to Federal 

Rule of Civil Procedure 23 (“Rule 23”). Specifically, Plaintiffs seek class certification of all 

claims for relief herein on behalf of a class and two subclasses defined as follows: 

Class: All persons who used the TikTok app and/or the Musical.ly app on one or more of 

their mobile devices while residing in the United States. 

California Subclass: All persons who used the TikTok app and/or the Musical.ly app on 

one or more of their mobile devices while residing in California. 

Illinois Subclass: All persons who, while residing in Illinois, used the TikTok app and/or 

the Musical.ly app on one or more of their mobile devices and who, while residing in Illinois, (i) 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 78 of 113 PageID #:1140
 78 

used either app to make a video containing his or her own face and/or voice, and/or (ii) had his or 

her own face and/or voice captured in a video made by someone else with either app. 

197. Plaintiffs are the proposed class representatives for the class. California Plaintiffs 

are the proposed class representatives for the California Subclass. Illinois Plaintiffs are the 

proposed class representatives for the Illinois Subclass. 

198. Plaintiffs reserve the right to modify or refine the definitions of the Class and the 

two Subclasses. 

199. Excluded from the Class and the two Subclasses are: (i) any judge or magistrate 

judge presiding over this action and members of their staff, as well as members of their families; 

(ii) Defendants, Defendants’ predecessors, parents, successors, heirs, assigns, subsidiaries, and 

any entity in which any Defendant or its parents have a controlling interest, as well as 

Defendants’ current or former employees, agents, officers, and directors; (iii) persons who 

properly execute and file a timely request for exclusion from the class; (iv) persons whose claims 

in this matter have been finally adjudicated on the merits or otherwise released; (v) counsel for 

Plaintiffs and Defendants; and (vi) the legal representatives, successors, and assigns of any such 

excluded persons. 

200. Ascertainability. The proposed Class and Subclasses are readily ascertainable 

because they are defined using objective criteria so as to allow Class and Subclass members to 

determine if they are part of the Class and/or one of the two Subclasses. Further, the Class and 

two Subclasses can be readily identified through records maintained by Defendants. 

201. Numerosity (Rule 23(a)(1)). The Class and two Subclasses are so numerous that 

joinder of individual members herein is impracticable. The exact number of Class and Subclass 

members, as herein identified and described, is not known, but download figures indicate that the 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 79 of 113 PageID #:1141
 79 

TikTok app has been downloaded more than 120 million times in the United States. 

202. Commonality (Rule 23(a)(2)). Common questions of fact and law exist for each 

cause of action and predominate over questions affecting only individual Class and Subclass 

members, including the following: 

 a. Whether Defendants engaged in the activities and practices referenced 

above; 

 b. Whether Defendants’ activities and practices referenced above constitute a 

violation of the Computer Fraud and Abuse Act, 18 U.S.C. § 1030; 

 c. Whether Defendants’ activities and practices referenced above constitute a 

violation of the California Comprehensive Data Access and Fraud Act, Cal. Pen. C. § 502; 

 d. Whether Defendants’ activities and practices referenced above constitute a 

violation of the Right to Privacy under the California Constitution; 

 e. Whether Defendants’ activities and practices referenced above constitute 

an intrusion upon seclusion; 

 f. Whether Defendants’ activities and practices referenced above constitute a 

violation of the California Unfair Competition Law, Bus. & Prof. C. §§ 17200 et seq. 

 g. Whether Defendants’ activities and practices referenced above constitute a 

violation of the California False Advertising Law, Bus. & Prof. C. §§ 17500 et seq.

 h. Whether Defendants’ activities and practices referenced above constitute 

negligence; 

 i. Whether Defendants’ activities and practices referenced above constitute 

unjust enrichment concerning which restitution and/or disgorgement is warranted; 

 j. Whether Defendants’ activities and practices referenced above constitute a 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 80 of 113 PageID #:1142
 80 

violation of the Illinois Biometric Information Privacy Act, 740 ILCS 14/1, et seq.; 

 k. Whether Defendants’ activities and practices referenced above constitute a 

violation of the Video Privacy Protection Act, 18 U.S.C. § 2710 et seq.; 

 l. Whether Plaintiffs and members of the Class and two Subclasses sustained 

damages as a result of Defendants’ activities and practices referenced above, and, if so, in what 

amount; 

 m. Whether Defendants profited from their activities and practices referenced 

above, and, if so, in what amount; 

 n. What is the appropriate injunctive relief to ensure that Defendants no 

longer unlawfully: (i) take private and personally-identifiable TikTok user data and content – 

including User/Device Identifiers, biometric identifiers and information, Private Videos and 

Private Video Images, and video viewing histories; (ii) utilize private and personally-identifiable 

TikTok user data and content to develop and patent commercially-valuable artificial intelligence 

technologies; (iii) utilize private and personally-identifiable TikTok user data and content to 

create consumer demand for and use of Defendants’ other products; (iv) transfer such private and 

personally-identifiable TikTok user data and content to servers in China and to third parties 

either in China or whose data is accessible from within China; (v) cause the diminution in value 

of TikTok users’ private and personally-identifiable data and content; (vi) cause injury and harm 

to TikTok users’ mobile devices; (vii) cause TikTok users to incur higher data usage and 

electricity charges; (viii) retain the unlawfully assembled TikTok user dossiers, including all 

private and personally-identifiable data and content therein; and (ix) profile and target, based on 

the above activities, TikTok users with advertisements. 

 o. What is the appropriate injunctive relief to ensure that Defendants take 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 81 of 113 PageID #:1143
 81 

reasonable measures to ensure that they and relevant third parties destroy unlawfully-acquired 

private and personally-identifiable TikTok user data and content in their possession, custody or 

control. 

203. Typicality (Rule 23(a)(3)). Plaintiffs’ claims are typical of the claims of 

members of the Class and two Subclasses because, among other things, Plaintiffs and members 

of the Class and two Subclasses sustained similar injuries as a result of Defendants’ uniform 

wrongful conduct and their legal claims all arise from the same events and wrongful conduct by 

Defendants. 

204. Adequacy (Rule 23(a)(4)). Plaintiffs will fairly and adequately protect the 

interests of the Class and two Subclasses. Plaintiffs’ interests do not conflict with the interests of 

the Class and Subclass members, and Plaintiffs have retained counsel experienced in complex 

class action and data privacy litigation to prosecute this case on behalf of the Class and two 

Subclasses. 

205. Predominance & Superiority (Rule 23(b)(3)). In addition to satisfying the 

prerequisites of Rule 23(a), Plaintiffs satisfy the requirements for maintaining a class action 

under Rule 23(b)(3). Common questions of law and fact predominate over any questions 

affecting only individual Class and Subclass members, and a class action is superior to individual 

litigation and all other available methods for the fair and efficient adjudication of this 

controversy. The amount of damages available to Plaintiffs is insufficient to make litigation 

addressing Defendants’ conduct economically feasible in the absence of the class action 

procedure. Individualized litigation also presents a potential for inconsistent or contradictory 

judgments, and increases the delay and expense presented by the complex legal and factual 

issues of the case to all parties and the court system. By contrast, the class action device presents 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 82 of 113 PageID #:1144
 82 

far fewer management difficulties and provides the benefits of a single adjudication, economy of 

scale, and comprehensive supervision by a single court. 

206. Final Declaratory or Injunctive Relief (Rule 23(b)(2)). Plaintiffs also satisfy 

the requirements for maintaining a class action under Rule 23(b)(2). Defendants have acted or 

refused to act on grounds that apply generally to the Class and two Subclasses, making final 

declaratory and/or injunctive relief appropriate with respect to the Class and two Subclasses as a 

whole. 

207. Particular Issues (Rule 23(c)(4)). Plaintiffs also satisfy the requirements for 

maintaining a class action under Rule 23(c)(4). Their claims consist of particular issues that are 

common to all Class and Subclass members and are capable of class-wide resolution that will 

significantly advance the litigation. 

XI. CAUSES OF ACTION. 

FIRST CAUSE OF ACTION 

Violation of the Computer Fraud and Abuse Act, 18 U.S.C. § 1030 

(On Behalf of the Plaintiffs and the Class) 

208. Plaintiffs repeat and incorporate by reference all preceding paragraphs as if fully 

set forth herein. 

209. The Plaintiffs’ and the Class’s mobile devices are, and at all relevant times have 

been, used for interstate communication and commerce, and are therefore “protected computers” 

under 18 U.S.C. § 1030(e)(2)(B). 

210. Defendants have exceeded, and continue to exceed, authorized access to the 

Plaintiffs’ and the Class’s protected computers and obtained information thereby, in violation of 

18 U.S.C. § 1030(a)(2), (a)(2)(C). 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 83 of 113 PageID #:1145
 83 

211. Defendants’ conduct caused “loss to 1 or more persons during any 1-year period . 

. . aggregating at least $5,000 in value” under 18 U.S.C. § 1030(c)(4)(A)(i)(I), inter alia, because 

of the secret transmission of the Plaintiffs’ and the Class’s private and personally-identifiable 

data and content – including User/Device Identifiers, biometric identifiers and information, and 

Private Videos and Private Video Images never intended for public consumption. 

212. Defendants’ conduct also constitutes “a threat to public health or safety” under 18 

U.S.C. § 1030(c)(4)(A)(i)(IV), due to the private and personally-identifiable data and content of 

the Plaintiffs and the Class being made available to foreign actors, including foreign intelligence 

services, in locations without adequate legal privacy protections. That this threat is real and 

imminent is evidenced by the ban on the TikTok app instituted by the Defense Department, 

Navy, Army, Marines, Air Force, Coast Guard and Transportation Security Administration, as 

well as the proposed legislation by United States Senators that would ban federal employees 

from using the TikTok app. As Senators Schumer and Cotton wrote in an October 23, 2019 letter 

to the Acting Director of National Intelligence concerning TikTok, “[s]ecurity experts have 

voiced concerns that China’s vague patchwork of intelligence, national security, and 

cybersecurity laws compel Chinese companies to support and cooperate with intelligence work 

controlled by the Chinese Communist Party. Without an independent judiciary to review requests 

made by the Chinese government for data or other actions, there is no legal mechanism for 

Chinese companies to appeal if they disagree with a request.”135

213. Accordingly, the Plaintiffs and the Class are entitled to “maintain a civil action 

against the violator to obtain compensatory damages and injunctive relief or other equitable 

 

135 https://www.law360.com/articles/1213180/sens-want-tiktok-investigated-for-nationalsecurity-threats; https://www.cotton.senate.gov/?p=press_release&id=1239. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 84 of 113 PageID #:1146
 84 

relief.” 18 U.S.C. § 1030(g). 

SECOND CAUSE OF ACTION 

Violation of the California Comprehensive 

Data Access and Fraud Act, Cal. Pen. C. § 502 

(On Behalf of the Plaintiffs and the Class) 

214. Plaintiffs repeat and incorporate by reference all preceding paragraphs as if fully 

set forth herein. 

215. Defendants’ acts violate Cal. Pen. C. § 502(c)(1) because they have knowingly 

accessed, and continue to knowingly access, data and computers to wrongfully control or obtain 

data. The Plaintiffs’ and the Class’s private and personally-identifiable data and content accessed 

by Defendants – including User/Device Identifiers, biometric identifiers and information, and 

Private Videos and Private Video Images never intended for public consumption – far exceeds 

any reasonable use of the Plaintiffs’ and the Class’s data and content to operate the TikTok app. 

There is no justification for Defendants’ surreptitious collection and transfer of the Plaintiffs’ 

and the Class’s private and personally-identifiable data and content from their mobile devices 

and their other social media accounts; for Defendants’ clandestine collection and transfer of the 

Plaintiffs’ and the Class’s private and personally-identifiable data and content before they even 

sign-up and create an account; for Defendants’ covert collection and transfer of the Plaintiffs’ 

and the Class’s private and personally-identifiable data and content when the TikTok app is 

closed; or for Defendants having embedded source code within the TikTok app that transfers the 

Plaintiffs’ and the Class’s private and personally-identifiable data and content to servers and 

third-party companies based in China where such servers and third-party companies are subject 

to Chinese law requiring the sharing of such data and content with the Chinese government. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 85 of 113 PageID #:1147
 85 

216. Defendants’ acts violate Cal. Pen. C. § 502(c)(2) because they have knowingly 

accessed and without permission taken, copied, and made use of data from a computer – and they 

continue to do so. Defendants did not obtain permission to take, copy, and make use of the 

Plaintiffs’ and the Class’s private and personally-identifiable data and content – including 

User/Device Identifiers, biometric identifiers and information, and Private Videos and Private 

Video Images never intended for public consumption – from their mobile devices and their other 

social media accounts. Nor did Defendants obtain permission to take, copy, and make use of the 

Plaintiffs’ and the Class’s private and personally-identifiable data and content from their mobile 

devices before they even sign-up and create an account. And Defendants did not obtain 

permission to take, copy, and make use of the Plaintiffs’ and the Class’s private and personallyidentifiable data and content from their mobile devices when the TikTok app is closed. Finally, 

Defendants did not obtain permission to embed source code within the TikTok app that transfers 

the Plaintiffs’ and the Class’s private and personally-identifiable data and content to servers and 

third-party companies based in China where such servers and third-party companies are subject 

to Chinese law requiring the sharing of such data and content with the Chinese government. 

217. Accordingly, the Plaintiffs and the Class are entitled to compensatory damages, 

including “any expenditure reasonably and necessarily incurred by the owner or lessee to verify 

that a computer system, computer network, computer program, or data was or was not altered, 

damaged, or deleted by the access,” injunctive relief, and attorneys’ fees. Cal. Pen. C. § 

502(e)(1), (2). 

THIRD CAUSE OF ACTION 

Violation of the Right to Privacy – California Constitution 

(On Behalf of the California Plaintiffs and the California Subclass) 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 86 of 113 PageID #:1148
 86 

218. Plaintiffs repeat and incorporate by reference all preceding paragraphs as if fully 

set forth herein. 

219. The California Plaintiffs and the California Subclass hold, and at all relevant 

times held, a legally protected privacy interest in their private and personally-identifiable data 

and content – including User/Device Identifiers, biometric identifiers and information, and 

Private Videos and Private Video Images never intended for public consumption – on their 

mobile devices and in their other social media accounts that Defendants have taken. 

220. There is a reasonable expectation of privacy concerning the California Plaintiffs’ 

and the California Subclass’s data and content under the circumstances present. 

221. The reasonableness of the California Plaintiffs’ and the California Subclass’s 

expectation of privacy is supported by the undisclosed, hidden, and non-intuitive nature of 

Defendants’ taking of private and personally-identifiable data and content – including 

User/Device Identifiers, biometric identifiers and information, and Private Videos and Private 

Video Images never intended for public consumption – from the California Plaintiffs’ and the 

California Subclass’s mobile devices and other social media accounts. 

222. Defendants’ conduct constitutes and, at all relevant times, constituted a serious 

invasion of privacy, as Defendants either did not disclose at all, or failed to make an effective 

disclosure, that they would take and make use of – and allow third-party companies based in 

China to take and make use of – the California Plaintiffs’ and the California Subclass’s private 

and personally-identifiable data and content. Defendants intentionally invaded the California 

Plaintiffs’ and the California Subclass’s privacy interests by intentionally designing the TikTok 

app, including all associated code, to surreptitiously obtain, improperly gain knowledge of, 

review, and retain their private and personally-identifiable data and content. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 87 of 113 PageID #:1149
 87 

223. These intrusions are highly offensive to a reasonable person, as evidenced by 

substantial research, literature, and governmental enforcement and investigative efforts to protect 

consumer privacy against surreptitious technological intrusions. The offensiveness of 

Defendants’ intrusion is heightened by Defendants’ making the California Plaintiffs’ and the 

California Subclass’s private and personally-identifiable data and content available to third 

parties, including foreign governmental entities whose interests are opposed to those of United 

States citizens. The offensiveness of Defendants’ intrusion is further heightened by Defendants’ 

secret collection and transfer of the California Plaintiffs’ and the California Subclass’s private 

and personally-identifiable data and content before they even sign-up and create an account; by 

Defendants’ covert collection and transfer of the California Plaintiffs’ and the California 

Subclass’s private and personally-identifiable data and content when the TikTok app is closed; 

and by Defendants’ clandestine collection and transfer of the California Plaintiffs’ and the 

California Subclass’s private and personally-identifiable data and content from their other social 

media accounts. The intentionality of Defendants’ conduct, and the steps they have taken to 

disguise and deny it, also demonstrate the highly offensive nature of their conduct. Further, 

Defendants’ conduct targeted the California Plaintiffs’ and the California Subclass’s mobile 

devices, which the United States Supreme Court has characterized as almost a feature of human 

anatomy, and which contain the California Plaintiffs’ and the California Subclass’s private and 

personally-identifiable data and content. 

224. The California Plaintiffs and the California Subclass were harmed by, and 

continue to suffer harm as a result of, the intrusion as detailed throughout this First Amended 

Complaint. 

225. Defendants’ conduct was a substantial factor in causing the harm suffered by the 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 88 of 113 PageID #:1150
 88 

California Plaintiffs and the California Subclass. 

226. The California Plaintiffs and the California Subclass seek nominal and punitive 

damages as a result of Defendants’ actions. Punitive damages are warranted because Defendants’ 

malicious, oppressive, and willful actions were calculated to injure the California Plaintiffs and 

the California Subclass, and were made in conscious disregard of their rights. Punitive damages 

are also warranted to deter Defendants from engaging in future misconduct. 

227. The California Plaintiffs and the California Subclass seek injunctive relief to 

rectify Defendants’ actions, including but not limited to requiring Defendants to stop taking more 

private and personally-identifiable data and content of the California Plaintiffs and the California 

Subclass from their mobile devices and their other social media accounts than is reasonably 

necessary to operate the TikTok app; to make clear disclosures of the California Plaintiffs’ and 

the California Subclass’s private and personally-identifiable data and content that is reasonably 

necessary to operate the TikTok app; to obtain the California Plaintiffs’ and the California 

Subclass’s consent to the taking of their private and personally-identifiable data and content; to 

stop transferring the California Plaintiffs’ and the California Subclass’s private and personallyidentifiable data and content to China, to servers located in China, or to servers or companies 

whose data is accessible from within China; and to recall and destroy the California Plaintiffs’ 

and the California Subclass’s private and personally-identifiable data and content already taken 

in contravention of the California Plaintiffs’ and the California Subclass’s right to privacy under 

the California Constitution. 

228. The California Plaintiffs and the California Subclass seek restitution and 

disgorgement for Defendants’ violation of their privacy rights. A person acting in conscious 

disregard of the rights of another is required to disgorge all profit because disgorgement both 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 89 of 113 PageID #:1151
 89 

benefits the injured parties and deters the perpetrator from committing the same unlawful actions 

again. Disgorgement is available for conduct that constitutes “conscious interference with a 

claimant’s legally protected interests,” including tortious conduct or conduct that violates another 

duty or prohibition. Restatement (3rd) of Restitution and Unjust Enrichment, §§ 40, 44. 

FOURTH CAUSE OF ACTION 

Intrusion upon Seclusion 

(On Behalf of the Plaintiffs and the Class) 

229. Plaintiffs repeat and incorporate by reference all preceding paragraphs as if fully 

set forth herein. 

230. “One who intentionally intrudes, physically or otherwise, upon the solitude or 

seclusion of another or his private affairs or concerns, is subject to liability to the other for 

invasion of his privacy, if the intrusion would be highly offensive to a reasonable person.” 

Restatement (2nd) of Torts § 652B. 

231. The Plaintiffs and the Class have, and at all relevant times had, a reasonable 

expectation of privacy in their mobile devices and their other social media accounts, and their 

private affairs include their past, present and future activity on their mobile devices and their 

other social media accounts. 

232. The reasonableness of the Plaintiffs’ and the Class’s expectations of privacy is 

supported by the undisclosed, hidden, and non-intuitive nature of Defendants’ taking of private 

and personally-identifiable data and content from the Plaintiffs’ and the Class’s mobile devices 

and other social media accounts. 

233. Defendants intentionally intruded upon the Plaintiffs’ and the Class’s solitude, 

seclusion, and private affairs – and continue to do so – by intentionally designing the TikTok 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 90 of 113 PageID #:1152
 90 

app, including all associated code, to surreptitiously obtain, improperly gain knowledge of, 

review, and retain the Plaintiffs’ and the Class’s private and personally-identifiable data and 

content – including User/Device Identifiers, biometric identifiers and information, and Private 

Videos and Private Video Images never intended for public consumption. 

234. These intrusions are highly offensive to a reasonable person, as evidenced by 

substantial research, literature, and governmental enforcement and investigative efforts to protect 

consumer privacy against surreptitious technological intrusions. The offensiveness of 

Defendants’ intrusion is heightened by Defendants’ making the Plaintiffs’ and the Class’s private 

and personally-identifiable data and content available to third parties, including foreign 

governmental entities whose interests are opposed to those of United States citizens. The 

offensiveness of Defendants’ intrusion is further heightened by Defendants’ secret collection and 

transfer of the Plaintiffs’ and the Class’s private and personally-identifiable data and content 

before they even sign-up and create an account; by Defendants’ covert collection and transfer of 

the Plaintiffs’ and the Class’s private and personally-identifiable data and content when the 

TikTok app is closed; and by Defendants’ clandestine collection and transfer of the Plaintiffs’ 

and the Class’s private and personally-identifiable data and content from their other social media 

accounts. The intentionality of Defendants’ conduct, and the steps they have taken to disguise 

and deny it, also demonstrate the highly offensive nature of their conduct. Further, Defendants’ 

conduct targeted the Plaintiffs’ and the Class’s mobile devices, which the United States Supreme 

Court has characterized as almost a feature of human anatomy, and which contain the Plaintiffs’ 

and the Class’s private and personally-identifiable data and content. 

235. The Plaintiffs and the Class were harmed by, and continue to suffer harm as a 

result of, the intrusion as detailed throughout this First Amended Complaint. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 91 of 113 PageID #:1153
 91 

236. Defendants’ conduct was a substantial factor in causing the harm suffered by the 

Plaintiffs and the Class. 

237. The Plaintiffs and the Class seek nominal and punitive damages as a result of 

Defendants’ actions. Punitive damages are warranted because Defendants’ malicious, oppressive, 

and willful actions were calculated to injure the Plaintiffs and the Class, and were made in 

conscious disregard of their rights. Punitive damages are also warranted to deter Defendants 

from engaging in future misconduct. 

238. The Plaintiffs and the Class seek injunctive relief to rectify Defendants’ actions, 

including but not limited to requiring Defendants to stop taking more private and personallyidentifiable data and content from the Plaintiffs’ and the Class’s mobile devices and other social 

media accounts than is reasonably necessary to operate the TikTok app; to make clear 

disclosures of the Plaintiffs’ and the Class’s private and personally-identifiable data and content 

that is reasonably necessary to operate the TikTok app; to obtain the Plaintiffs’ and the Class’s 

consent to the taking of such private and personally-identifiable data and content; to stop 

transferring the Plaintiffs’ and the Class’s private and personally-identifiable data and content to 

China, to servers located in China, or to servers or companies whose data is accessible from 

within China; and to recall and destroy the Plaintiffs’ and the Class’s private and personallyidentifiable data and content already taken in contravention of the Plaintiffs’ and the Class’s 

privacy rights. 

239. Plaintiffs and the Class seek restitution and disgorgement for Defendants’ 

intrusion upon seclusion. A person acting in conscious disregard of the rights of another is 

required to disgorge all profit because disgorgement both benefits the injured parties and deters 

the perpetrator from committing the same unlawful actions again. Disgorgement is available for 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 92 of 113 PageID #:1154
 92 

conduct that constitutes “conscious interference with a claimant’s legally protected interests,” 

including tortious conduct or conduct that violates another duty or prohibition. Restatement (3rd) 

of Restitution and Unjust Enrichment, §§ 40, 44. 

FIFTH CAUSE OF ACTION 

Violation of the California Unfair Competition Law, 

Bus. & Prof. C. §§ 17200 et seq. 

(On Behalf of the Plaintiffs and the Class) 

240. Plaintiffs repeat and incorporate by reference all preceding paragraphs as if fully 

set forth herein. 

241. The Unfair Competition Law, California Business & Professions Code §§ 17200, 

et seq. (the “UCL”), prohibits any “unlawful,” “unfair,” or “fraudulent” business act or practice, 

which can include false or misleading advertising. 

242. Defendants violated, and continue to violate, the “unlawful” prong of the UCL 

through violation of statutes, constitutional provisions, and common law, as alleged herein. 

243. Defendants violated, and continue to violate, the “unfair” prong of the UCL 

because they took private and personally-identifiable data and content – including User/Device 

Identifiers, biometric identifiers and information, and Private Videos and Private Video Images 

never intended for public consumption – from the Plaintiffs’ and the Class’s mobile devices and 

other social media accounts under circumstances in which the Plaintiffs and the Class would 

have no reason to know that such data and content was being taken. 

244. The Plaintiffs and the Class had no reason to know because (i) there was no 

disclosure of Defendants’ collection and transfer of the Plaintiffs’ and the Class’s biometric 

identifiers and information, and Private Videos and Private Video Images not intended for public 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 93 of 113 PageID #:1155
 93 

consumption; (ii) there was no disclosure of Defendants’ collection and transfer of the Plaintiffs’ 

and the Class’s private and personally-identifiable data and content before they even sign-up and 

create an account; (iii) there was no disclosure of Defendants’ collection and transfer of the 

Plaintiffs’ and the Class’s private and personally-identifiable data and content when the TikTok 

app is closed; (iv) there was no disclosure that Defendants had embedded source code within the 

TikTok app that transfers the Plaintiffs’ and the Class’s private and personally-identifiable data 

and content to servers and third-party companies based in China where such servers and thirdparty companies are subject to Chinese law requiring the sharing of such data and content with 

the Chinese government; and (v) there was no effective disclosure of the wide range of the 

private and personally-identifiable data and content, including User/Device Identifiers, that 

Defendants took from the Plaintiffs’ and the Class’s mobile devices and other social media 

accounts. 

245. Defendants violated, and continue to violate, the “fraudulent” prong of the UCL 

because (i) Defendants made it appear that the Plaintiffs’ and the Class’s User/Device Identifiers, 

biometric identifiers and information, and Private Videos and Private Video Images would not be 

collected and transferred unless the Plaintiffs and the Class chose to do so, but in fact Defendants 

collected and transferred such data and content without notice or consent; (ii) Defendants made it 

appear that the Plaintiffs’ and the Class’s private and personally-identifiable data and content 

would not be collected and transferred before they had signed-up and created an account, but in 

fact Defendants collected and transferred such data and content before sign-up and account 

creation without notice or consent; (iii) Defendants made it appear that the Plaintiffs’ and the 

Class’s private and personally-identifiable data and content would not be collected or transferred 

while the TikTok app is closed, but in fact Defendants clandestinely collected and transferred 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 94 of 113 PageID #:1156
 94 

such data and content when the app was closed without notice or consent; (iv) Defendants made 

it appear that the Plaintiffs’ and the Class’s private and personally-identifiable data and content 

would not be transferred to servers and third-party companies based in China where such servers 

and third-party companies are subject to Chinese law requiring the sharing of such data and 

content with the Chinese government, but in fact Defendants covertly transferred such data and 

content to servers and third-party companies based in China without notice or consent; and (v) 

Defendants have intentionally refrained from disclosing the use to which the Plaintiffs’ and the 

Class’s private and personally-identifiable data and content has been put, while simultaneously 

providing misleading reassurances about Defendants’ data collection and use practices. The 

Plaintiffs and the Class were misled by Defendants’ concealment, and had no reason to believe 

that Defendants had taken the private and personally-identifiable data and content that they had 

taken. 

246. The Plaintiffs and the Class have been harmed and have suffered economic injury 

as a result of Defendants’ UCL violations. First, the Plaintiffs and the Class have suffered harm 

in the form of diminution of the value of their private and personally-identifiable data and 

content. Second, they have suffered harm to their mobile devices. The battery, memory, CPU 

and bandwidth of such devices have been compromised, and as a result the functioning of such 

devices has been impaired and slowed. Third, they have incurred additional data usage and 

electricity costs that they would not otherwise have incurred. Fourth, they have suffered harm as 

a result of the invasion of privacy stemming from Defendants’ covert theft of their private and 

personally-identifiable data and content – including User/Device Identifiers, biometric identifiers 

and information, and Private Videos and Private Video Images. 

247. Defendants, as a result of their conduct, have been able to reap unjust profits and 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 95 of 113 PageID #:1157
 95 

revenues in violation of the UCL. This includes Defendants’ profits and revenues from their 

targeted-advertising, improvements to their artificial intelligence technologies, their patent 

applications, and the increased consumer demand for and use of Defendants’ other products. The 

Plaintiffs and the Class seek restitution and disgorgement of these unjust profits and revenues. 

248. Unless restrained and enjoined, Defendants will continue to misrepresent their 

private and personally-identifiable data and content collection and use practices, and will not 

recall and destroy Plaintiffs’ and the Class’s wrongfully collected private and personallyidentifiable data and content. Accordingly, injunctive relief is appropriate. 

SIXTH CAUSE OF ACTION 

Violation of the California False Advertising Law, 

Bus. & Prof. C. §§ 17500 et seq.

(On Behalf of the Plaintiffs and the Class) 

249. Plaintiffs repeat and incorporate by reference all preceding paragraphs as if fully 

set forth herein. 

250. California’s False Advertising Law (the “FAL”) – Cal. Bus. & Prof. Code §§ 

17500, et seq. – prohibits “any statement” that is “untrue or misleading” and made “with the 

intent directly or indirectly to dispose of” property or services. 

251. Defendants’ advertising is, and at all relevant times was, highly misleading. 

Defendants do not disclose at all, or do not meaningfully disclose, the private and personallyidentifiable data and content – including User/Device Identifiers, biometric identifiers and 

information, and Private Videos and Private Video Images never intended for public 

consumption – that they have collected and transferred from the Plaintiffs’ and the Class’s 

mobile devices and other social media accounts. Defendants also do not advertise that 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 96 of 113 PageID #:1158
 96 

Defendants secretly take private and personally-identifiable data and content from the Plaintiffs’ 

and the Class’s mobile devices before they even sign up and create an account, or that 

Defendants covertly take private and personally-identifiable data and content from the Plaintiffs’ 

and the Class’s mobile devices even when the TikTok app is closed. Nor do Defendants disclose 

that the Plaintiffs’ and the Class’s private and personally-identifiable data and content has been 

made available to foreign entities, including foreign government entities. As United States 

Senator Josh Hawley said on November 18, 2019: “If your child uses TikTok, there’s a chance 

the Chinese Communist Party knows where they are, what they look like, what their voices 

sound like, and what they’re watching” . . . “That’s a feature TikTok doesn’t advertise.”136

252. Reasonable consumers, like the Plaintiffs and the Class, are – and at all relevant 

times were – likely to be misled by Defendants’ misrepresentations. Reasonable consumers lack 

the means to verify Defendants’ representations concerning their data and content collection and 

use practices, or to understand the fact or significance of Defendants’ data and content collection 

and use practices. 

253. The Plaintiffs and the Class have been harmed and have suffered economic injury 

as a result of Defendants’ misrepresentations. First, they have suffered harm in the form of 

diminution of the value of their private and personally-identifiable data and content. Second, 

they have suffered harm to their mobile devices. The battery, memory, CPU and bandwidth of 

such devices have been compromised, and as a result the functioning of such devices has been 

impaired and slowed. Third, they have incurred additional data usage and electricity costs that 

they would not otherwise have incurred. Fourth, they have suffered harm as a result of the 

 

136 https://www.law360.com/articles/1220783/no-more-data-storage-in-china-gop-senator-s-billsays. 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 97 of 113 PageID #:1159
 97 

invasion of privacy stemming from Defendants’ covert theft of their private and personallyidentifiable data and content – including User/Device Identifiers, biometric identifiers and 

information, and Private Videos and Private Video Images never intended for public 

consumption. 

254. Defendants, as a result of their misrepresentations, have been able to reap unjust 

profits and revenues. This includes Defendants’ profits and revenues from their targetedadvertising, improvements to their artificial intelligence technologies, their patent applications, 

and the increased consumer demand for and use of Defendants’ other products. The Plaintiffs 

and the Class seek restitution and disgorgement of these unjust profits and revenues. 

255. Unless restrained and enjoined, Defendants will continue to misrepresent their 

private and personally-identifiable data and content collection and use practices, and will not 

recall and destroy Plaintiffs’ and the Class’s wrongfully collected private and personallyidentifiable data and content. Accordingly, injunctive relief is appropriate. 

SEVENTH CAUSE OF ACTION 

Negligence 

(On Behalf of the Plaintiffs and the Class) 

256. Plaintiffs repeat and incorporate by reference all preceding paragraphs as if fully 

set forth herein. 

257. The Plaintiffs and the Class entrusted Defendants with their private and 

personally-identifiable data and content – including User/Device Identifiers, biometric identifiers 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 98 of 113 PageID #:1160
 98 

and information, and Private Videos and Private Video Images never intended for public 

consumption. Defendants had a duty to handle that data and content with care due its sensitivity, 

and the expectation that such data and content would not be shared with third parties. This duty 

included Defendants’ assurances that third-parties would not improperly collect or obtain such 

data and content, and Defendants’ public statements, made in response to direct inquiries about 

the ability of China-based entities to access U.S. TikTok user data, that the Plaintiffs’ and the 

Class’s private and personally-identifiable data was not in fact subject to such access. 

258. The Plaintiffs’ and the Class’s willingness to entrust Defendants with their private 

and personally-identifiable data and content was predicated on the understanding that Defendants 

would take appropriate measures to protect it. Defendants had a special relationship with the 

Plaintiffs and the Class as a result of being entrusted with their private and personallyidentifiable data and content, which provided an independent duty of care. 

259. Defendants knew that the Plaintiffs’ and the Class’s private and personallyidentifiable data and content had value, and Defendants have earned substantial revenues and 

profits as a result of collecting and using such private and personally-identifiable data and 

content. This includes Defendants’ profits and revenues from their targeted-advertising, 

improvements to their artificial intelligence technologies, their patent applications, and the 

increased consumer demand for and use of Defendants’ other products. 

260. Defendants failed to use reasonable care to safeguard the Plaintiffs’ and the 

Class’s private and personally-identifiable data and content, giving third parties access to it 

without taking precautions to protect the Plaintiffs and the Class. Indeed, Defendants took no 

precautions at all, instead making the Plaintiffs’ and the Class’s private and personallyidentifiable data and content directly available to third parties in jurisdictions with inadequate 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 99 of 113 PageID #:1161
 99 

privacy protections, and in jurisdictions with inadequate constraints on governmental use of 

private and personally-identifiable data and content. 

261. Defendants’ failure to use care in allowing access to the Plaintiffs’ and the Class’s 

private and personally-identifiable data and content has caused foreseeable harm. Private and 

personally-identifiable data and content that can be used to track the physical movements and 

online activities of the Plaintiffs and the Class, and that is biometrically unique to each of the 

Plaintiffs and the members of the Class, has been transmitted to China-based companies, thereby 

exposing the Plaintiffs and the Class to a heightened, imminent risk of misuse, fraud, identity 

theft, Chinese government surveillance, and financial harm. 

262. The Plaintiffs’ and the Class’s private and personally-identifiable data and content 

Defendants negligently allowed third parties to access allows such data and content to be 

aggregated with other data and content to identify, profile and target the Plaintiffs and the Class. 

As such, it is reasonable for the Plaintiffs and the Class to obtain identity protection and credit 

monitoring services, and to recover the cost of these services from Defendants. 

263. The injury to the Plaintiffs and the Class was a proximate, reasonably foreseeable 

result of Defendants’ breaches of duty. 

264. Defendants’ conduct also constitutes gross negligence due to their extreme 

departure from ordinary standards of care, and their knowledge that they had failed to secure the 

Plaintiffs’ and the Class’s private and personally-identifiable data and content. 

EIGHTH CAUSE OF ACTION 

Restitution / Unjust Enrichment 

(On Behalf of the Plaintiffs and the Class) 

265. Plaintiffs repeat and incorporate by reference all preceding paragraphs as if fully 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 100 of 113 PageID #:1162
 100 

set forth herein. 

266. The Plaintiffs and the Class have conferred substantial benefits on Defendants by 

downloading and using the TikTok app. These include the Defendants’ collection and use of the 

Plaintiffs’ and the Class’s private and personally-identifiable data and content – including 

User/Device Identifiers, biometric identifiers and information, and Private Videos and Private 

Video Images never intended for public consumption. Such benefits also include the revenues 

and profits resulting from Defendants’ collection and use of such data and content for 

Defendants’ targeted-advertising, improvements to their artificial intelligence technologies, their 

patent applications, and the increased consumer demand for and use of Defendants’ other 

products. 

267. Defendants have knowingly and willingly accepted and enjoyed these benefits. 

268. Defendants either knew or should have known that the benefits rendered by the 

Plaintiffs and the Class were given with the expectation that Defendants would not take and use 

the Plaintiffs’ and the Class’s private and personally-identifiable data and content that 

Defendants have taken and used without permission. For Defendants to retain the 

aforementioned benefits under these circumstances is inequitable. 

269. Through deliberate violation of the Plaintiffs’ and the Class’s privacy interests, 

and statutory and constitutional rights, Defendants each reaped benefits that resulted in each 

Defendant wrongfully receiving profits. 

270. Equity demands disgorgement of Defendants’ ill-gotten gains. Defendants will be 

unjustly enriched unless they are ordered to disgorge those profits for the benefit of the Plaintiffs 

and the Class. 

271. As a direct and proximate result of Defendants’ wrongful conduct and unjust 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 101 of 113 PageID #:1163
 101 

enrichment, the Plaintiffs and the Class are entitled to restitution from Defendants and institution 

of a constructive trust disgorging all profits, benefits, and other compensation obtained by 

Defendants through this inequitable conduct. 

NINTH CAUSE OF ACTION 

Violation of Illinois’s Biometric Information Privacy Act, 740 ILCS 14/1, et seq.

(On Behalf of the Illinois Plaintiffs and the Illinois Subclass) 

272. Plaintiffs repeat and incorporate by reference all preceding paragraphs as if fully 

set forth herein. 

273. BIPA makes it unlawful for any private entity to, among other things, “collect, 

capture, purchase, receive through trade, or otherwise obtain a person’s or a customer’s 

biometric identifiers or biometric information, unless it first: (1) informs the subject . . . in 

writing that a biometric identifier or biometric information is being collected or stored; (2) 

informs the subject . . . in writing of the specific purpose and length of term for which a 

biometric identifier or biometric information is being collected, stored, and used; and (3) 

receives a written release executed by the subject of the biometric identifier or biometric 

information or the subject’s legally authorized representative.” 740 ILCS 14/15(b). 

274. Plaintiff Meghan Smith is, and at all relevant times was, an adult and resident of 

Illinois, and thus is, and at all relevant times was, a “person” and/or a “customer” within the 

meaning of BIPA. 740 ILCS 14/15(b). Plaintiff C.W. and Plaintiff I.W. are, and at all relevant 

times were, minors and residents of Illinois, and thus are, and at all relevant times were, 

“persons” and/or “customers” as well. Id. Plaintiff C.W.’s and Plaintiff I.W.’s mother and legal 

guardian, Mikhaila Woodall, is Plaintiff C.W.’s and Plaintiff I.W.’s “legally authorized 

representative” within the meaning of BIPA, and served in such capacity at all times relevant to 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 102 of 113 PageID #:1164
 102 

this action. Id. Plaintiff R.P. is, and at all relevant times was, a minor and resident of Illinois, and 

thus is, and at all relevant times was, a “person” and/or “customer” as well. Id. Plaintiff R.P.’s 

mother and legal guardian, Lynn Pavalon, is Plaintiff R.P.’s “legally authorized representative” 

within the meaning of BIPA, and served in such capacity at all times relevant to this action. Id.

275. Each Defendant is, and at all relevant times was, a “corporation, limited liability 

company, association, or other group, however organized,” and thus is, and at all relevant times 

was, a “private entity” under the BIPA. 740 ILCS 14/10. 

276. The Illinois Plaintiffs and the Illinois Subclass had their “biometric identifiers,” 

including their face geometry scans and voiceprints, as well as their “biometric information” 

collected, captured, received, or otherwise obtained by Defendants as a result of the Illinois 

Plaintiffs’ and the Illinois Subclass’s use of the TikTok app. 740 ILCS 14/10. 

277. At all relevant times, Defendants systematically and surreptitiously collected, 

captured, received or otherwise obtained the Illinois Plaintiffs’ and the Illinois Subclass’s 

“biometric identifiers” and “biometric information” without first obtaining signed written 

releases, as required by 740 ILCS 14/15(b)(3), from any of them or their “legally authorized 

representatives.” 

278. In fact, Defendants failed to properly inform the Illinois Plaintiffs and the Illinois 

Subclass, or any of their parents, legal guardians, or other “legally authorized representatives,” in 

writing (or in any other way) that the Illinois Plaintiffs’ and the Illinois Subclass’s “biometric 

identifiers” and “biometric information” were being “collected or stored” by Defendants. Nor did 

Defendants inform the Illinois Plaintiffs and the Illinois Subclass, or any of their parents, legal 

guardians, or other “legally authorized representatives,” in writing of the specific purpose and 

length of term for which the Illinois Plaintiffs’ and the Illinois Subclass’s “biometric identifiers” 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 103 of 113 PageID #:1165
 103 

and “biometric information” were being “collected, stored and used” as required by 740 ILCS 

14/15(b)(1)-(2). 

279. BIPA also makes it unlawful for a private entity “in possession of a biometric 

identifier or biometric information” to “sell, lease, trade, or otherwise profit from a person’s or a 

customer’s biometric identifier or biometric information.” 740 ILCS 14/15(c). 

280. Defendants are, and at all relevant times were, “in possession of” the Illinois 

Plaintiffs’ and the Illinois Subclass’s “biometric identifiers,” including but not limited to their 

face geometry scans and voiceprints, and “biometric information.” Defendants profited from 

such “biometric identifiers” and “biometric information” by using them for targeted advertising, 

improvements to Defendants’ artificial intelligence technologies, Defendants’ patent 

applications, and the generation of increased demand for and use of Defendants’ other products. 

740 ILCS 14/15(c). 

281. Finally, BIPA prohibits private entities “in possession of a biometric identifier or 

biometric information” from “disclos[ing], redisclos[ing], or otherwise disseminat[ing] a 

person’s or a customer’s biometric identifier or biometric information unless” any one of four 

enumerated conditions are met. 740 ILCS 14/15(d)(1)-(4). None of such conditions are met here. 

282. Defendants disclose, redisclose and disseminate, and at all relevant times 

disclosed, redisclosed and disseminated, the Illinois Plaintiffs’ and the Illinois Subclass’s 

“biometric identifiers,” including but not limited to their face geometry scans and voiceprints, 

and “biometric information” without the consent of any of them or their “legally authorized 

representatives.” 740 ILCS 14/15(d)(1). Moreover, the disclosures and redisclosures did not 

“complete[] a financial transaction requested or authorized by” the Illinois Plaintiffs, the Illinois 

Subclass or any of their legally authorized representatives. 740 ILCS 14/15(d)(2). Nor are, or at 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 104 of 113 PageID #:1166
 104 

any relevant times were, the disclosures and redisclosures “required by State or federal law or 

municipal ordinance.” 740 ILCS 14/15(d)(3). Finally, at no point in time were the disclosures 

ever “required pursuant to a valid warrant or subpoena issued by a court of competent 

jurisdiction.” 740 ILCS 14/15(d)(4). 

283. BIPA mandates that a private entity “in possession of biometric identifiers or 

biometric information” “develop a written policy, made available to the public, establishing a 

retention schedule and guidelines for permanently destroying biometric identifiers and biometric 

information when the initial purpose for collecting or obtaining such identifiers or information 

has been satisfied or within 3 years of the individual’s last interaction with the private entity, 

whichever occurs first.” 740 ILCS 14/15(a). 

284. But Defendants do not publicly provide any written policy establishing any 

retention schedule or guidelines for permanently destroying the Illinois Plaintiffs’ and the Illinois 

Subclass’s “biometric identifiers” and “biometric information.” 740 ILCS 14/15(a). 

285. BIPA also commands private entities “in possession of a biometric identifier or 

biometric information” to: (1) store, transmit, and protect from disclosure all biometric 

identifiers and biometric information using the reasonable standard of care within the private 

entity’s industry; and (2) store, transmit, and protect from disclosure all biometric identifiers and 

biometric information in a manner that is the same as or more protective than the manner in 

which the private entity stores, transmits and protects other confidential and sensitive 

information. 740 ILCS 14/15(e). Based on the facts alleged herein, including Defendants’ lack of 

a public written policy, their failure to inform TikTok users that Defendants obtain such users’ 

“biometric identifiers” and “biometric information,” their failure to obtain written consent to 

collect or otherwise obtain TikTok users’ “biometric identifiers” and “biometric information,” 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 105 of 113 PageID #:1167
 105 

and their unauthorized dissemination of TikTok users’ “biometric identifiers” and “biometric 

information,” Defendants have violated this provision too. 

286. Defendants recklessly or intentionally violated each of BIPA’s requirements and 

infringed the Illinois Plaintiffs’ and the Illinois Subclass’s rights to keep their immutable and 

uniquely identifying biometric identifiers and biometric information private. As individuals 

subjected to each of Defendants’ BIPA violations above, the Illinois Plaintiffs and the Illinois 

Subclass are and have been aggrieved. 740 ILCS 14/20. 

287. On behalf of themselves and the Illinois Subclass, the Illinois Plaintiffs seek: (1) 

injunctive and equitable relief as is necessary to protect the interests of the Illinois Plaintiffs and 

the Illinois Subclass by requiring Defendants to comply with BIPA’s requirements; (2) $1,000.00 

or actual damages, whichever is greater, for each negligent violation of BIPA by Defendants; (3) 

$5,000.00 or actual damages, whichever is greater, for each intentional or reckless violation of 

BIPA by Defendants; and (4) reasonable attorneys’ fees and costs, including expert witness fees 

and other litigation expenses. 740 ILCS 14/20(1)-(4). 

TENTH CAUSE OF ACTION 

Violation of the Video Privacy Protection Act, 18 U.S.C. § 2710 et seq.

(On Behalf of Plaintiffs A.S., A.R., Meghan Smith, C.W., 

I.W., R.P., P.S., M.T.W. and the Class) 

288. Plaintiffs repeat and incorporate by reference all preceding paragraphs as if fully 

set forth herein. 

289. The VPPA provides that “a video tape service provider who knowingly discloses, 

to any person, personally identifiable information concerning any consumer shall be liable to the 

aggrieved person for the relief provided in subsection (d).” 18 U.S.C. § 2710(b)(1). Defendants 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 106 of 113 PageID #:1168
 106 

violated the VPPA by knowingly disclosing such “personally identifiable information” to 

Facebook and Google. 

290. Defendants are “video tape service providers” under 18 U.S.C. § 2710(a)(4) 

because they “engaged in the business, in or affecting interstate or foreign commerce, of rental, 

sale, or delivery of prerecorded video cassette tapes or similar audio-visual materials.” 

Defendants are engaged in the business of delivering video content and services to Plaintiffs and 

the Class. Defendants’ platform allows TikTok users to create, post, share, view, and otherwise 

engage with videos. Defendants’ platform is built to deliver video content to consumers, and 

Defendants regularly delivered videos to Plaintiffs and the Class by making those materials 

electronically available to Plaintiffs and the Class on Defendants’ platform. Defendants also 

allowed TikTok users to create and share videos with a non-public audience. 

291. Plaintiffs and the Class are “consumers” under 18 U.S.C. § 2710(a)(1) because 

they are “subscriber[s] of goods or services” from Defendants. Plaintiffs and the Class are 

registered TikTok users who use the TikTok app through interaction with it. Plaintiffs and the 

Class were required to provide “personally identifiable information” to TikTok, including date 

of birth, in order to sign up, become registered users, establish user profiles, to subscribe to 

“follow” other accounts, and to contribute to TikTok’s video streaming content. By signing up 

for accounts with TikTok, becoming registered users, establishing user profiles, providing 

TikTok with personal information, and spending time and attention using and contributing to 

TikTok’s video streaming platform, Plaintiffs and the Class entered into transactions with 

Defendants to obtain access to TikTok’s content and services and for the purpose of subscribing 

to TikTok’s video streaming content and services. 

292. The VPPA defines “personally identifiable information” to “include[] information 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 107 of 113 PageID #:1169
 107 

which identifies a person as having requested or obtained specific video materials or services 

from a video tape service provider.” 18 U.S.C. § 2710(a)(1)(3). Defendants “knowingly 

disclose[d]” to Facebook and Google each TikTok user’s “personally identifiable information,” 

including: (1) what specific videos each TikTok user has watched; (2) whether each TikTok user 

has engaged with a specific video by “liking” and/or “favoriting” it; and (3) the identities of 

other TikTok users that each TikTok user “follows.” Defendants also disclosed each TikTok 

user’s device ID and advertising ID to Facebook and Google, which personally identifies each 

TikTok user to an ordinary person and matches each TikTok user to their video viewing history 

when transmitted to Facebook and Google. 

293. Defendants’ pairing of the TikTok user’s device ID and advertising ID with that 

user’s video viewing history violates the VPPA because it discloses to Facebook and Google the 

videos that a specific TikTok user has requested or obtained. While the VPPA permits the disclosure 

of such “personally identifiable information” to third parties by “informed written consent,” the 

requisite consent must be “in a form distinct and separate from any form setting forth other legal 

or financial obligations of the consumer.” 18 U.S.C. § 2710(b)(2)(B)(i). No such consent was 

obtained by Defendants. Nor can this defect be cured after-the-fact. The VPPA provides that the 

requisite written consent must (at the election of the consumer) be “given at the time the 

disclosure is sought” or “given in advance for a set period of time, not to exceed 2 years or until 

consent is withdrawn by the consumer, whichever is sooner.” 18 U.S.C. § 2710(b)(2)(B)(ii). 

294. Defendants’ disclosures to Facebook and Google are not subject to a statutory 

exception for disclosures that are incident to “the ordinary course of business of the video tape 

provider,” see 18 U.S.C. § 2710(b)(2)(E), which exception is limited to debt collection activities, 

order fulfillment, request processing, and the transfer of ownership. 18 U.S.C. § 2710(a)(2). 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 108 of 113 PageID #:1170
 108 

Facebook and Google are not involved in any such activities here. 

295. The VPPA also requires that “[a] person subject to the section shall destroy 

personally identifiable information as soon as practicable, but no later than one year from the 

date the information is no longer necessary for the purposes for which it was collected . . . .” 18 

U.S.C. § 2710(e). In violation of the VPPA, Defendants have not destroyed this “personally 

identifiable information” and instead continue to maintain it. 

296. Plaintiffs and the Class seek to recover actual damages, not less than liquidated 

damages in the amount of $2,500 per Plaintiff/Class member, punitive damages, attorneys’ fees 

and costs, and such other preliminary and equitable relief as the Court determines to be 

appropriate. 18 U.S.C. § 2710(c)(2)(A)-(D). 

XII. PRAYER FOR RELIEF. 

WHEREFORE, Plaintiff respectfully requests relief against Defendants as set forth 

below: 

(a) entry of an order certifying the proposed class and subclasses pursuant to Federal Rule 

of Civil Procedure 23; 

(b) entry of an order appointing Plaintiffs as representatives of the class and subclasses; 

(c) entry of an order appointing Plaintiffs’ counsel as co-lead counsel for the class and 

subclasses; 

(d) entry of an order for injunctive and declaratory relief as described herein, including 

but not limited to: 

 (i) enjoining Defendants, their affiliates, associates, officers, employees and 

agents from transmitting TikTok user data and content to China, to other locations or facilities 

where such TikTok user data and content is accessible from within China, and/or to anyone 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 109 of 113 PageID #:1171
 109 

outside the defendant companies; 

 (ii) enjoining Defendants, their affiliates, associates, officers, employees and 

agents from taking TikTok users’ private draft videos (including any frames, digital images or 

other content from such videos) and biometric identifiers and information without advanced 

notice to, and the prior written consent of, such TikTok users or their legally authorized 

representatives (and, for the Illinois Subclass, without being in compliance with BIPA); 

 (iii) enjoining Defendants, their affiliates, associates, officers, employees and 

agents from taking physical/digital location tracking data, device ID data, personally-identifiable 

data and any other TikTok user data and content except that for which appropriate notice and 

consent is provided and which Defendants can show to be reasonably necessary for the lawful 

operation of the TikTok app within the United States; 

 (iv) enjoining Defendants, their affiliates, associates, officers, employees and 

agents from sharing TikTok users’ video viewing histories unless in compliance with the Video 

Privacy Protection Act; 

 (v) mandating that Defendants, their affiliates, associates, officers, employees 

and agents recall and destroy the TikTok user data and content already taken in violation of law; 

 (vi) mandating that Defendants, their affiliates, associates, officers, employees 

and agents remove from the TikTok app all SDKs based in China or whose data is otherwise 

accessible from within China; 

 (vii) mandating that Defendants, their affiliates, associates, officers, employees 

and agents implement protocols to ensure that no TikTok user data and content is transmitted to, 

or otherwise accessible from within, China; 

 (viii) mandating that Defendants, their affiliates, associates, officers, employees 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 110 of 113 PageID #:1172
 110 

and agents hire third-party monitors for a period of at least three years to ensure that all of the 

above steps have been taken; and 

 (ix) mandating that Defendants, their affiliates, associates, officers, employees 

and agents provide written verifications on a quarterly basis to the court and counsel for the 

Plaintiffs in the form of a declaration under oath that the above steps have been satisfied. 

(e) entry of judgment in favor of each class and subclass member for damages suffered as 

a result of the conduct alleged herein, punitive damages, restitution, and disgorgement, to include 

interest and prejudgment interest; 

(f) award Plaintiff reasonable attorneys’ fees and costs; and 

(g) grant such other and further legal and equitable relief as the court deems just and 

equitable. 

XIII. DEMAND FOR JURY TRIAL. 

Plaintiffs demand a trial by jury on all issues so triable. 

DATED: August 14, 2020 BIRD, MARELLA, BOXER, WOLPERT, NESSIM, 

DROOKS, LINCENBERG & RHOW, P.C. 

By: /s/ Ekwan E. Rhow 

 Ekwan E. Rhow 

BIRD, MARELLA, BOXER, WOLPERT, 

NESSIM, DROOKS, LINCENBERG 

& RHOW, P.C. 

1875 Century Park East, 23rd Floor 

Telephone: (310) 201-2100 

Email: erhow@birdmarella.com 

Attorneys for Plaintiffs Misty Hong, minor A.S., 

through her mother and legal guardian Laurel 

Slothower, and minor A.R., through her mother 

and legal guardian Gilda Avila 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 111 of 113 PageID #:1173
 111 

DATED: August 14, 2020 GLANCY PRONGAY & MURRAY LLP 

By: /s/ Kara M. Wolke 

 Kara M. Wolke 

1925 Century Park East, Suite 2100 

Los Angeles, California 90067-2561 

Telephone: (310) 201-9150 

Los Angeles, California 90067-2561 

Email: info@glancylaw.com 

Attorneys for Plaintiffs Misty Hong, minor A.S., 

through her mother and legal guardian Laurel 

Slothower, and minor A.R., through her mother 

and legal guardian Gilda Avila 

DATED: August 14, 2020 PHILLIPS, ERLEWINE, GIVEN & CARLIN LLP 

By: /s/ David M. Given 

 David M. Given 

39 Mesa Street, Suite 201, The Presidio 

San Francisco, CA 94129 

Telephone: (415) 398-0900 

Email: dmg@phillaw.com 

Attorneys for Plaintiffs Meghan Smith, minors 

C.W. and I.W., through their mother and legal 

guardian Mikhaila Woodall, and minor R.P., 

through her mother and legal guardian Lynn 

Pavalon 

DATED: August 14, 2020 HAUSFELD LLP 

By: /s/ Megan E. Jones 

 Megan E. Jones 

600 Montgomery Street, Suite 3200 

San Francisco, CA 94111 

Telephone: (415) 633-1908 

Email: mjones@hausfeld.com 

Attorneys for Plaintiffs minor P.S., through her 

legal guardian Cherise Slate, and minor M.T.W., 

through her legal guardian, Brenda Washington 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 112 of 113 PageID #:1174
 112 

DATED: August 14, 2020 BURNS CHAREST LLP 

By: /s/ Amanda Klevorn 

 Amanda Klevorn 

365 Canal Street, Suite 1170 

New Orleans, Louisiana 70115 

Telephone: (504) 779-2845 

Email: aklevorn@burnscharest.com 

Attorneys for Plaintiffs minor P.S., through her 

legal guardian Cherise Slate, and minor M.T.W., 

through her legal guardian, Brenda Washington 

DATED: August 14, 2020 LAWRENCE KAMIN, LLP 

By: /s/ Peter E. Cooper 

 Peter E. Cooper 

300 S. Wacker Dr., Ste. 500 

Chicago, IL 60606 

Telephone: (312) 372-1947 

Email: pcooper@lawrencekamin.com 

Attorneys for All Plaintiffs 

 

Case: 1:20-cv-04723 Document #: 89 Filed: 08/14/20 Page 113 of 113 PageID #:1175