In February, Tiktok agreed to settle a class-action lawsuit in the U.S. District Court for the Northern District of Illinois Eastern Division that consists of 21 putative class actions. The multiple lawsuits stem from the "collection, use, and transmission of highly sensitive personal data" through the TikTok application, which violated national and state laws. By settling, the court will not have a chance to litigate the issues presented by the complaint. The settlement highlights the possible power of privacy class actions over companies that handle data in the U.S., especially because they imposed sizeable monetary relief and substantive obligations. 

The complaint against TikTok

The first case in the class action was filed in November 2019 in the Northern District of California. Subsequent cases in the class action were filed in other jurisdictions, Illinois and other districts in California.

The complaint details 10 causes of action, including alleged violations of Illinois' Biometric Information Privacy Act and other laws, including the U.S. Computer Fraud and Abuse Act, California Comprehensive Data Access and Fraud Act, and Video Privacy Protection Act.

The complaint states the app used "automated software, proprietary algorithms, AI, facial recognition, and other technologies to commercially profit" from TikTok users. Beyond using and profiting off users' "biometric data and information," it also alleges the app "clandestinely vacuumed up and transferred" information about users to servers located in China. The plaintiffs claim TikTok collected user data without notice or consent upon signing up for the app. 

BIPA allegations

The complaint states that TikTok violated BIPA in several ways. It states the app collected, stored and used users’ face geometry scans (a biometric identifier under BIPA Section 10) without notifying or receiving written releases from users. Second, it also alleges TikTok possessed and profited from users’ biometric identifiers “by using them for targeted advertising, improvements to artificial intelligence technologies, patent applications, and the generation of increased demand for and use of other products.” Third, the complaint posits TikTok impermissibly disclosed and disseminated users’ biometric data without consent and without an allowed reason under BIPA, such as a subpoena.

The complaint also alleges the app used face scans, artificial intelligence and facial recognition to make recommendations for users partially based on their perceived race/ethnicity or age and to suppress content made by users with so-called "ugly facial looks."

Additionally, the complaint states TikTok's augmented reality filters can change a person's face on the app employ code with names such as "FaceDetectManager" and "maxScanTime," which reveals the app scans users' face geometries to perform the AR filters correctly.

By settling the agreement, the question of what is considered "biometric information" under BIPA will not be litigated. In the settlement agreement, TikTok admitted to using "demographic classification," which included "recognizing visual patterns that indicate age, gender or other characteristics." However, the company has stated they believe using demographic classifications is different than using face scans "because it does not create facial templates and is not capable of identifying a user."

A related BIPA settlement 

TikTok is not the only technology company to face a lawsuit due to Illinois's BIPA statute. In February, a federal district court judge approved a $650 million class-action settlement against Facebook for a BIPA violation. The judge described it as a "landmark result" that is expected to "put at least $345 into the hands of every class member interested in being compensated."

The Facebook and TikTok settlements illustrate the power of Illinois's BIPA law, which has contributed to two multimillion-dollar settlements and has forced both companies to modify their behavior regarding information collected, stored, shared and used. BIPA is unique because it has a private right of action. Although TikTok settled before the case could wind through the court system, which could have led to a narrowing or broadening of the term "biometric identifier," the two settlements set the stage for continued litigation under BIPA and the possibility of huge settlement amounts.

Allegations beyond BIPA

The TikTok complaint also alleged the company violated two federal statutes, the Computer Fraud and Abuse Act and the Video Privacy Protection Act, as well as several California state laws and state consumer protection statutes. It further states TikTok intruded upon users' seclusion and was unjustly enriched, two common law claims.

While the company agreed to a settlement, it has not agreed with the complaint's allegations. In a statement, TikTok said while the company "disagree[s] with the assertions, rather than go through lengthy litigation, we'd like to focus our efforts on building a safe and joyful experience for the TikTok community."

What does the settlement entail? 

The proposed settlement includes monetary and injunctive relief for two different classes: the Nationwide Class and the Illinois Subclass. Combined, the two classes cover 89 million U.S.-based TikTok users, with some class members as young as 8 years old.

The Nationwide Class consists of "all persons who reside in the United States who used the app prior to the issuance of the Preliminary Approval Order." The Illinois Subclass covers "all persons who reside in the State of Illinois and used the App in the State of Illinois to create videos prior to issuance of the Preliminary Approval Order." The Illinois Subclass consists of approximately 1.4 million Illinois-based TikTok users.

Monetary relief

TikTok agreed to pay a total of $92 million to settle the claims. The settlement agreement asserts "a recovery of this magnitude ranks among the nation's highest privacy-related settlements."

If every potential class member submitted a valid claim, each Nationwide Class claimant would receive $0.96, and each Illinois Subclass claimant would receive $5.75. The actual amount claimants may receive may be higher because not every potential claimant will make a claim. However, 22% of potential claimants filed a claim for Facebook's BIPA settlement — an "usually high" number. If 22% of all possible claimants file a claim, Illinois Subclass members will receive $174.57, and Nationwide Class members would receive $29.10. 

Injunctive relief

Beyond monetary payment, the company agreed not to take specific actions, unless "disclosed expressly in the TikTok Privacy Policy and in compliance with all applicable laws." The actions include using the app to: 

• "Collect or store a user's biometric information or identifiers.
• Collect geolocation or GPS data.
• Collect information in users' clipboards.
• Transmit U.S. user data outside of the U.S.
• Store U.S. user data in databases outside of the U.S.
• Pre-upload U.S. user-generated content."

However, if the company's privacy policy discloses the above actions and is in compliance with "all applicable laws," they will be allowed to perform them.

Furthermore, the proposed settlement agreement would require TikTok employees and contractors to complete annual data privacy compliance training. It would also be required to hire a third party "to review the data privacy law compliance training for a period of three years and to provide verification of this review."

The proposed settlement, however, has hit a roadblock. U.S. District Judge John Lee did not approve the proposed settlement but instead requested further information about how class members would be notified of the settlement, specifically asking why users would not be notified about the settlement through the app itself. If settlement notifications appear on the app, there is a chance the claim rate would exceed the predicted claim rate of about 2%. If TikTok only notified class members through email, it would only reach the 30 million users who have provided an email address out of the 89 million users who could potentially make a claim.

COPPA

This is not the first time TikTok settled for allegedly violating privacy law. In 2019, the company, then known as Musical.ly, settled with the U.S. Federal Trade Commission for violating the Children's Online Privacy Protection Act. The FTC alleged the company violated COPPA for being a website or service directed at children and did not receive "parental consent before collecting personal information from children under the age of 13." The company agreed to pay $5.7 million — the largest monetary settlement in a COPPA case.

Conclusion

This settlement is just the latest in what will probably be an increase in litigation coming out of both California and Illinois. Illinois' BIPA has shown to be a vehicle by which individual consumers of technology can force changes to large companies' behavior and policies. Even though the $92 million settlement was not nearly as large as Facebook's $650 million settlement, it highlights that companies can end up owing both monetary and injunctive relief under BIPA and other national privacy laws without ever fully litigating the issues. As more lawsuits arise under BIPA, the IAPP will be ready to analyze them.

Photo by Bill Oxford on Unsplash