Families are suing TikTok in what has turned into a major legal action in federal court.
Dozens of minors, through their parents, are alleging that the video-sharing app collects information about their facial characteristics, locations and close contacts, and quietly sends that data to servers in China.
Twenty separate but similar federal lawsuits were filed over the past year on behalf of TikTok users in California, where the company has offices, and Illinois, which requires that technology companies receive written consent before collecting data on a person's identity.
The suits now have been merged into one.
And on Tuesday, a panel of federal judges ruled that the case will be based in the U.S. District Court for the Northern District of Illinois. Judge John Z. Lee was appointed as the presiding judge.
Plaintiffs' lawyers will be asking Lee to expand the suit into a nationwide class action, potentially affecting tens of millions of American users.
While TikTok flatly denies the allegations, the company is under intense pressure to avoid a long, drawn-out legal battle. The Trump administration considers TikTok a national security threat because its parent company, ByteDance, is based in China. President Trump said Monday that TikTok must be sold to an American suitor by Sept. 15 or "close down" in the United States. Microsoft Corp., for one, has acknowledged it is exploring a bid.
TikTok is fighting to have the privacy lawsuit dismissed. But if it survives, the suit could cost the company hundreds of millions of dollars.
A lawsuit filed under the same Illinois law against Facebook over its use of facial recognition technology recently prompted the social network to agree to a record data-privacy settlement of $650 million. Legal experts said, if the court approves the TikTok lawsuit as a national case, the settlement sum could exceed the Facebook payout.
The Illinois law, known as the Biometric Information Privacy Act, "has been striking fear in the heart of many companies in the United States for fear that claims like this will be brought," said Lesley Weaver, one of the 33 plaintiffs' attorneys involved in the litigation against TikTok.
Attorneys for TikTok said the app is neither capturing users' biometric information nor sending any data to China. But TikTok's legal team also argues that the company can transfer data to Beijing, if it so chooses, without breaking any laws.
Is TikTok sending data to China?
The national security debate about TikTok centers on something nobody has so far provided direct evidence of: that Tiktok is sending information about American citizens to China and, possibly, the Chinese Community Party.
TikTok said its primary servers for its U.S. users are in Virginia and its backup servers are in Singapore. The company said no data collected on Americans ever goes to servers or authorities in China.
But that contradicts the findings of technology experts hired by the plaintiffs' attorneys. Those experts, who studied the collection and journey of TikTok data, claim troves of information are being sent to servers in China "under the control of third-parties who cooperate with the Chinese government," according to the lawsuit.
"Such information reveals TikTok users' precise physical location, including possibly indoor locations within buildings, and TikTok users' apps that possibly reveal mental or physical health, religious views, political views, and sexual orientation," attorneys for users wrote in legal filings.
The lawyers declined to comment for this story and would not disclose to NPR who their experts are or what methods they employed.
In the lawsuit, they contend that as soon as TikTok is downloaded, it starts collecting data, even before a user opens an account. If a user begins making a video but then does not save it, data in the video is still mined by TikTok, according to the suit. Even when TikTok is merely on a phone but not being used, it is still allegedly vacuuming up loads of personal data. It is a practice, the suit argues, that violates the law by not receiving the consent of users.
The attorneys for the users said the app engages in what they call "covert theft" while attempting to hide its tracks.
"They do so by obfuscating the source code that would reveal the private and personally-identifiable user data and content actually taken from users' mobile devices," the suit says.
TikTok denies that any of its data collection starts before users agree to its terms of service. TikTok is upfront about what data it takes from users. Experts said most smartphone apps collect and store just as much — or more — data as TikTok does.
TikTok's legal team said the lawsuit is based on a "factually mistaken" analysis of how the app collects data and what it is doing with that data. But worse than that, according to TikTok lawyer Weibell, is that the suit is China-phobic in the same way many U.S. politicians and Silicon Valley tech giants are, he argues.
"The present lawsuit is based on (and quotes) the same anti-Chinese rhetoric, conjecture, supposition, and innuendo that originated with these political and competitive attacks," Weibell said in a filing.
Weibell declined to comment on the suit to NPR.
TikTok says case should be tossed based on user agreement
TikTok's terms of service include what is known as an arbitration clause, which makes users agree that any complaint about the company can never be part of a class-action lawsuit.
But under California law, arbitration clauses do not apply to minors. They can still file lawsuits if they think they have been harmed.
Attorneys for the users said because data collection allegedly happens before any terms of service are agreed to, users of any age should be able to have their day in court.
TikTok, though, hopes the whole case will be thrown out on the grounds that users do not have a right to bring the lawsuit in the first place because of the arbitration clause that forces disputes to be resolved outside court.
If a panel of judges overseeing the case sides with TikTok, the whole case could fall apart. But if the panel agrees with the plaintiffs, both sides will begin deliberations about who is able to join the class action and how much money will be at stake.
Under the Illinois biometric law, the minimum penalty is $1,000 per instance that identifying data was taken without someone's consent. If it is proven that the covert theft was reckless, the penalty can go up to $5,000 per violation.
According to market research firm Sensor Tower, TikTok has been downloaded more than 180 million times in the United States.
Lawsuit looms over potential sale to Microsoft
What kind of exposure Microsoft would have to pending litigation will likely be part of the software giant's review ahead of an official offer to buy the app. But lawyers involved in the case said the lawsuit is not likely to dissuade Microsoft, a company valued at $1.5 trillion.
Some lawyers involved in the lawsuit predicted that a settlement would be reached before any sale of TikTok is completed and that TikTok may be in a rush to resolve the suits to make itself "more sellable."
But if the suit becomes a nationwide class action, it could be a legal headache and considerable expense that sticks around TikTok for years to come.
Microsoft has vowed that if it becomes TikTok's new parent company, all data on American citizens would remain within U.S. borders.
"To the extent that any such data is currently stored or backed-up outside the United States, Microsoft would ensure that this data is deleted from servers outside the country after it is transferred," Microsoft said in a statement.
ARI SHAPIRO, HOST:
Dozens of families are suing TikTok for allegedly collecting their children's data without permission and sending that information to servers in China. The suit comes at an especially bad time for the app. It is owned by a Chinese company. President Trump considers that a national security threat, and he's ordered that TikTok be sold by the middle of next month. This lawsuit could complicate any sale. NPR's Bobby Allyn joins us with details.
BOBBY ALLYN, BYLINE: Hey, Ari.
SHAPIRO: Tell us more about who is suing TikTok and what they are alleging.
ALLYN: So there are 70 families suing TikTok, and they're claiming that from the moment the app is downloaded on your phone, it starts vacuuming reams of personal information like your location, your browser history, your contacts and when you start taking videos. The suit says TikTok is downloading and saving a profile of your face, and it even makes a guess about your age and your background. You know, lawyers for the users say this is kind of alarming for anyone but especially when it's happening to children. And I will say here, Ari, you know, many smartphone apps use - that you use every day are harvesting tons of data. But lawyers say TikTok is different because of what is allegedly doing with all that data.
SHAPIRO: Right. The fear in Washington is that TikTok is sending U.S. data to Chinese authorities. TikTok has always denied this. Does the lawsuit add anything new to this debate?
ALLYN: Yeah. The lawsuit makes a pretty startling claim, which is lawyers hired outside experts to, like, forensically examine the TikTok app. And they say they traced data from American citizens being directly sent to Chinese servers, which the attorneys say are under the control of third parties that directly cooperate with the Chinese government. There has not been any clear evidence of this happening before this lawsuit, and the lawyers say now we have evidence.
SHAPIRO: And that also contradicts what TikTok has said it does with the data. So what do officials at TikTok now say in response to this suit?
ALLYN: Right. So in response to the suit, TikTok's lawyers have filed papers saying, look. Data moves in complicated ways. It's not weird for data to jump from one country to the next, especially when it's on servers. And the lawsuit's analysis is wrong. TikTok says most of its data on Americans is stored in the Washington, D.C., area in Virginia, and they have backup in Singapore. Besides having what they call a sloppy analysis, TikTok's lawyers say the lawsuit is engaging in, quote, "anti-Chinese rhetoric" and is elevating speculation as real evidence.
SHAPIRO: And meanwhile, Microsoft has said that it's in talks to acquire TikTok. How is this lawsuit likely to factor into those discussions?
ALLYN: Yeah. Well, plaintiffs' lawyers hope this becomes a nationwide class action, and if it does, it could linger for many years to come. So we don't know yet what this liability is going to look like. There's a lot of negotiations that need to be hammered out still. But Microsoft, of course, is a $1.5 trillion company. It has deep, deep pockets. But a legal bill this serious still has the potential of muddying the waters as Microsoft and TikTok continue potential merger talks.
SHAPIRO: I mean, could it potentially undermine that merger and prevent it from happening?
ALLYN: I don't think so. The experts that I've talked to and the folks who are close to that deal say it's not going to stop the deal in its tracks. But, you know, as Microsoft is, you know, kicking the tires and looking under the hood of TikTok, this is a bill that is going to be looked at very, very carefully. And it might change the final deal, but I don't think Microsoft is going to see this and say, it's such a liability; it's such a problem that we're going to walk away. That's probably not going to happen.
SHAPIRO: NPR's Bobby Allyn, thank you.
ALLYN: Thank you, Ari. Transcript provided by NPR, Copyright NPR.