TikTok Users Advance Suit Over In-App Browser’s Data Collection

TikTok Inc. must face most claims of a proposed class action alleging it illegally collected the private information of users through an in-app browser allowing users to follow links to advertisers and points of sale.

The plaintiffs alleged concrete injuries sufficient to establish their standing to sue in federal court, and provided enough facts at the pleading stage to state claims of unjust enrichment and violations of the Federal Wiretap Act, state wiretapping and eavesdropping laws, and state unfair competition laws, Judge Rebecca R. Pallmeyer of the US District Court for the Northern District of Illinois said Tuesday.

The ruling comes nine months after Pallmeyer ruled that plaintiffs bringing wiretap claims over TikTok’s data-collection practices could proceed with their consolidated multi-district lawsuit despite a prior $92 million settlement TikTok entered into with consumers challenging the company’s practices under biometric privacy laws.

TikTok was hit with a wave of lawsuits across the country over its in-app browser following publication in August 2022 of research by Felix Krause, a software engineer who exposed previously undisclosed privacy risks arising from the browser’s ability to record users’ interactions with third-party websites.

Those lawsuits were transferred to Pallmeyer’s courtroom by the Judicial Panel on Multidistrict Litigation.

Injected Code

The plaintiffs in the consolidated litigation alleged that the in-app browser embeds JavaScript code into third-party websites that allows it to track users’ mouse movements, clicks, keystrokes, text entered into information fields, URLs of web pages visited, and other electronic communications. The company then uses the information to create marketing profiles of users and target them with advertising, the complaint said.

TikTok argued in a motion to dismiss that the 10 named plaintiffs didn’t provide enough information about their activity using the in-app browser to justify their inclusion in the litigation, but Pallmeyer disagreed.

The complaint’s background context about the browser helped shore up the plaintiffs’ individual pleadings and were enough to affirm their standing and put TikTok on notice of their claims, she said.

The company’s argument that the claims should be dismissed because of limitations in Krause’s research, which formed the basis of the complaint, fared no better.

Krause’s acknowledgment that he couldn’t specify what data the browser collected or whether it transferred the data for other use wasn’t enough to absolve TikTok of potential liability for installing the equivalent of a keylogger on third-party websites, she said.

Pallmeyer also rejected TikTok’s argument that the plaintiffs consented to the data collection under its Terms of Service and Privacy Policy.

TikTok’s evidence—screenshots from the Internet Archives “Wayback Machine” showing versions of the privacy policy from 2021 to 2024—was too limited to allow a definitive ruling at this early stage, she said.

Pallmeyer denied the motion as to the plaintiffs’ claims under the California Invasion of Privacy Act, the Florida Security of Communications Act, the Illinois Eavesdropping Act, and the Pennsylvania Wiretapping and Electronic Surveillance Control Act.

But she dismissed their claims under California’s Unfair Competition Law, finding the plaintiffs didn’t adequately plead they suffered an economic injury from TikTok’s practices, a requirement to state a claim under the statute.

Baron & Budd PC; Scott & Scott Attorneys at Law LLP; Barrack, Rodos & Bacine; Lockridge Grindal Nauen PLLP; Carella, Byrne, Cecchi, Brody & Agnello PC; Israel David LLC: Gibson Consumer Law Group LLC; Kessler, Topaz, Meltzer & Check LLP; Herman Jones LLP; Reese LLP; and Chicago Consumer Law Center PC represent the plaintiffs and the proposed classes.

Mayer Brown LLP represents TikTok.

The case is In re TikTok Inc. In-App Browser Priv. Litig., N.D. Ill., No. 1:24-cv-02110, 10/1/24.