The lawsuit targets TikTok’s use of biometric technologies, such as facial recognition and other biometric identifiers, which plaintiffs allege were collected without informed consent. ByteDance’s legal team contends that the complaint relies on vague assertions and lacks the specificity required to proceed in court. The company also disputes the relevance of the claims in light of a $92 million settlement reached in 2021 over similar allegations, noting that the prior case resolved claims involving data practices up to October 13, 2022. ByteDance has emphasized that the settlement did not include any admission of wrongdoing and was intended to avoid prolonged litigation.
The amended claims in the current lawsuit focus on alleged violations that occurred after that 2022 cutoff date, which means they are not covered by the earlier settlement. Plaintiffs argue that TikTok continued to collect biometric data through features such as video filters and facial effects, without clearly disclosing how this data was processed or stored. While ByteDance insists that its privacy policies provide sufficient notice, courts have recently taken a more critical view of such policies, particularly when consent mechanisms are not prominently disclosed or when users are unaware of material policy changes.
These legal challenges reflect broader scrutiny of ByteDance’s data handling practices. In 2022, reports surfaced that ByteDance employees in China had access to overseas user data, prompting the company to announce changes to its infrastructure. TikTok has since said that U.S. user traffic is routed through Oracle Cloud servers and that all U.S. user data is stored domestically, with backups in Singapore. The company has repeatedly denied sharing user information with the Chinese government.
The biometric privacy lawsuit comes alongside other legal actions against ByteDance, including an ongoing case concerning its CapCut video editing app. In that instance, a federal judge recently allowed certain privacy claims to move forward under California law, although other claims were dismissed. Both cases illustrate growing legal interest in how major platforms collect and manage biometric data, particularly in the absence of clear federal regulation.
At the heart of these disputes is Illinois’ Biometric Information Privacy Act (BIPA), a state law that allows individuals to sue companies for collecting biometric data without explicit consent. BIPA’s private right of action has made Illinois a focal point for biometric privacy litigation, and the outcomes of these cases could set important precedents for how social media platforms handle sensitive data going forward.
Source: MLex
—
May 20, 2025 – by the ID Tech Editorial Team
