Social media app
Nearly one dozen proposed class actions have been filed since November alleging the TikTok app has JavaScript code that unlawfully captures personal data used to send targeted ads to consumers, according to a Bloomberg Law analysis of federal court dockets.
TikTok could become privy to private information such as a user’s credit card accounts, mental health, or sexual preferences, every lawsuit says. They seek statutory damages that can reach $10,000 per plaintiff.
It’s the latest swell in litigation raising wiretap claims in data privacy cases. Last year, an uptick in lawsuits followed a federal appeals court ruling that session-replay technology—which allows entities to record and play back a user’s browsing session with their website—violated a Pennsylvania wiretapping law.
The cases, brought across five states, come as regulators, lawmakers, and other government officials express concerns over China’s access to the app’s US user data. More than two dozen states have banned the app from government devices while federal legislators also mull similar action. Indiana also sued TikTok over data-sharing and child safety concerns, potentially marking the beginning of more state enforcement against the app.
TikTok is “really in the fishbowl right now,” and public scrutiny can inspire plaintiffs to go after companies already under fire, said Natasha Halloran, a privacy associate at Troutman Pepper Hamilton Sanders LLP.
“I think that’s why they’re saying, ‘Okay, if the state players are concerned and the government is concerned, legislators are concerned, then maybe I should be concerned too,’” Halloran said.
The relative novelty of the wiretap lawsuits means plaintiffs will face challenges in proving the claim, while TikTok also must overcome hurdles to defend against it, attorneys said. The 11 lawsuits may soon be merged into multidistrict litigation proceedings, pending separate motions for consolidation filed in California and Illinois federal courts.
And more lawsuits could be on the way, said Colin Knisely, a privacy commercial litigation attorney at Duane Morris LLP. The potential for a new angle into significant litigation is “like chum in the water” for plaintiffs’ attorneys, he said.
JavaScript Code
All cases analyzed by Bloomberg Law cited an August 2022 report published by privacy researcher Felix Krause, who investigated how different social media apps use JavaScript code in their in-app browsers.
Krause reported that TikTok’s browser was designed to record every text input and selection made on third-party websites through the use of JavaScript code. TikTok was the only app—among peers including Instagram and Snapchat—that didn’t provide an option to open a link in a mobile device’s default browser, according to Krause’s research.
Krause wasn’t immediately available to comment on the story.
TikTok spokesperson Brooke Oberwetter called the report’s findings “incorrect and misleading.”
“Contrary to the report’s claims, we do not collect keystroke or text inputs through this JavaScript code—it is only used for debugging, troubleshooting, and performance monitoring,” Oberwetter said in an emailed statement.
She declined to comment on the litigation and said that performance monitoring of the in-app browser helps “make platform improvements, such as optimizing page load times and ad measurement.” TikTok collects browsing history from the in-app browser, according to its privacy policy.
Privacy Concerns
The first lawsuit over TikTok’s in-app browser was filed in November by Baron & Budd P.C., which estimates that millions of TikTok users have had their privacy rights allegedly violated. It was quickly followed by several complaints in December, and more in January.
The 11 firms involved in litigation against TikTok—including Milberg LLP—didn’t respond to multiple requests for comment or didn’t provide comment before publication.
“Knowing which pages a user chooses to click on and spends time reading...can reveal deeply personal and private information, which TikTok intercepts to monetize by sending more accurate targeted content and advertisements to the user,” one complaint filed in California federal court said.
“For example, the online talk therapy company BetterHelp has a verified account on the TikTok app with a link to its website, which immediately asks the website visitor questions about their mental health needs,” it said.
Many lawsuits also make claims under state-level privacy statutes and common law violations including invasion of privacy and unjust enrichment. Only two lawsuits use the Federal Wiretap Act as their only privacy claim against TikTok.
“It’s very consistent with both a regulatory as well as litigation trend towards a requirement of enhanced disclosure of what you’re doing with personal information,” said privacy litigation attorney Michael Bahar of Eversheds Sutherland LLP.
Litigation Challenges
Each lawsuit alleges that TikTok’s data collection qualifies as an illegal interception of electronic communications under the Federal Wiretap Act. The statute requires consent from at least one party involved in a communication to avoid triggering liability.
Neither the plaintiffs nor the third-party websites being visited gave TikTok consent to be monitored and such tracking exceeds users’ expectations of privacy, the suits said.
Whether that consent argument stands will come down to if TikTok can prove that it disclosed the activity in its terms of service or privacy policy, and obtained consent from the user, attorneys said. That’s a common defense companies make during motions to dismiss in wiretap cases, Knisely said.
TikTok also would be hard pressed to argue that it was a party to the communications—another possible defense it could raise to avoid liability under the federal law, said David Straite, a privacy and class action attorney at Dicello Levitt LLC. Straite has led several privacy class actions against companies including Facebook, Google, and Apple.
“It’ll be very difficult for TikTok to argue that they’re a party to the communication—to me it looks like an interception of the communication between the user and that website that a user visits via a link,” Straite said.
If the lawsuits reach the evidence-gathering discovery phase, the plaintiffs could face challenges in obtaining documents and depositions because TikTok’s corporate owner ByteDance Ltd. is headquartered in China, a common issue in litigation with international entities, Straite said.
Multidistrict Debates
Baron & Budd is now leading the charge to consolidate nine cases and future ones into multidistrict litigation in the US District Court for the Central District of California. Many of the cases have been stayed until MDL debates resolve.
TikTok, however, argues that the lawsuits should be included in a recently-settled MDL action in Illinois that cost the company $92 million.
Attorneys for the wiretap plaintiffs argue that their browser cases fall outside of the Illinois case’s class time frame, and that they deal with issues separate from the biometric privacy claims considered in the prior MDL, according to a motion for consolidation.
Case consolidation would help “streamline” approaches to litigation for both sides, Knisely of Duane Morris said.
“These are all basically the same cases with the same facts and it’s going to involve the same discovery, same legal issues, so it makes sense rather than having them spread all around the country, and even from the defendant’s perspective, to be in several different courts as opposed to one court, it’s just sort of a judicial economy issue,” Knisely said.
To contact the reporter on this story:
To contact the editors responsible for this story: