ByteDance Accused of Illegally Obtaining Biometric Information

ByteDance is being sued in a class-action lawsuit for allegedly collecting data from its 200 million active users without their consent through its CapCut video-editing app. The lawsuit, filed in Illinois, accuses CapCut of violating the state’s Biometric Information Privacy Act (BIPA) by gathering information such as face scans and voiceprints without adequately informing or obtaining explicit permission from users.

The app also allegedly collects information about the user’s location, date of birth and gender, as well as their photos and videos. Most of this is said to be the delivery of targeted ads. Additionally, the lawsuit claims that the app is capable of collecting information about the user’s devices, including the MAC address and SIM card serial number.

The Record uncovered a lawsuit alleging that CapCut’s Privacy Policy is designed to make it difficult for people to understand or give the app “significant, express consent.” One plaintiff, who started using the app in seventh grade, was allegedly able to use CapCut without having to sign up for an account, review the privacy policy or get parental consent.

The lawsuit also notes that because ByteDance is headquartered in Beijing, the company may be forced to share CapCut data with the Chinese government. It alleges that a former ByteDance official publicly revealed that the Chinese Communist Party can use a “backdoor channel code” to access the data of users outside the country, including in the United States.

ByteDance, of course, owns TikTok, which has long been accused of giving the Chinese government access to US user data. The company has been trying to convince US regulators that TikTok poses no national security threat. TikTok CEO Shou Zi Chew claimed in a congressional hearing earlier this year that “ByteDance is not an agent of China or any other country.”

Since last year, TikTok has routed all US user data to Oracle servers located in the country. Dubbed Project Texas, this initiative also included the goal of removing US users’ private TikTok data from ByteDance’s own data centers.

Regardless, Montana lawmakers have passed legislation to ban TikTok entirely in the state. Many other jurisdictions, including the federal government, have banned the app on nearly all government-owned devices. The Justice Department is reportedly investigating allegations that four ByteDance employees used TikTok to spy on the location of two U.S.-based journalists.

The class action is asking the district court to stop ByteDance from sending CapCut users’ data and content to China, and from collecting users’ biometric and other data without permission. The plaintiffs asked the court to oblige ByteDance to also delete the user data and content obtained illegally through CapCut. In addition, the lawsuit seeks unspecified damages.

ReturnByte has asked ByteDance for comment.