In early August 2020, 10 class action lawsuits alleging biometric privacy violations by popular social media app, TikTok, were merged into a multi-district litigation (MDL) case in the Northern District of Illinois. The chief complaint amongst the plaintiffs is an accusation that TikTok collected information about users’ locations, contacts, and facial features—including users who are minors. The plaintiffs allege that TikTok then shared this information with its parent company, ByteDance, located in China.
The lawsuits allege that by collecting this information and sending it to servers in another country, TikTok has violated one or more U.S. biometric information privacy laws. In the transfer order, the court found that the 10 cases shared common questions and determined the commonalities would be more easily addressed as a centralized MDL, rather than being heard separately.
What’s at Stake in the TikTok Case
The individual lawsuits were originally filed in California and Illinois. California is home to TikTok’s US offices, while in Illinois, the Biometric Information Privacy Act (BIPA) allows for a private right of action by individuals whose biometric information is used inappropriately. This includes biometric information that is gathered, transferred, or used for commercial gain without an individual’s knowledge or consent.
Previously, a lawsuit filed in Illinois against another social network, Facebook, alleged that its facial recognition technology violated the BIPA. This recently resulted in a $650 million settlement—a record amount for a data privacy case. Given the matter and scope of the ongoing TikTok case, this could mean a comparable or possibly larger settlement.
TikTok’s Response
TikTok denies any allegations that it handled users’ biometric information in violation of U.S. state or federal laws. The social media company’s attorneys responded that the app is not collecting biometric information or sending any such information to China. TikTok’s legal team also asserts, however, that even if it were sending facial recognition data to China, it hasn’t violated any privacy laws, because its terms of service clearly state that data collected by the app may be used this way. According to the company’s lawyer, these terms of service are “standard with free social networking apps that have a business model based on advertising.”
The lawsuit, however, comes at a precarious time for the social media service. TikTok’s relationship with its Chinese parent company has prompted the Trump administration to label TikTok a potential threat to U.S. national security. The president has stated that TikTok’s U.S. operations must be sold to a US company by mid-September 2020 or face potential shutdown in the country. Although Microsoft has stated that it is considering a bid, no such business deal has yet been completed. A pending lawsuit, particularly one of this scope concerning biometric privacy, could harm the company’s chances at acquisition by a U.S. parent.
The Role of Expert Witnesses in TikTok Litigation
Lawsuits regarding the proper handling of biometric data have proliferated in recent years, particularly in Illinois. While Illinois is not the only state with biometric privacy legislation, it is the only state that explicitly acknowledges a private right of action for individuals whose biometric privacy rights, as outlined in the law, are infringed.
A number of issues related to biometric data are likely to arise as the TikTok case unfolds. For example, the parties may raise questions over whether the data TikTok collects is “biometric” as defined by Illinois or other state law. To handle these issues, counsel will want to consult with experts in biometric data privacy and corresponding law.
The MDL will also delve into how TikTok protects, stores and uses the data they collect—including what consent or confidentiality measures, if any, are taken. This will require experts with extensive knowledge of social media technologies and the regulation surrounding terms of service and privacy rights.
Experts who can clarify and draw connections between social media use in the United States and data transfers to other countries, like China, may also be in demand. This could also involve experts in international relations and how data privacy laws apply outside the country.
