Lawsuit: ByteDance’s CapCut app secretly reaps massive amounts of user data

The ByteDance-owned CapCut video editing app gathers significant amounts of private data, including facial scans, from its 200 million active users, generating huge profits and potentially allowing the Chinese government to access that data, according to a proposed class action lawsuit filed in an Illinois federal court.

CapCut and sister company TikTok are owned by the Chinese company ByteDance Ltd., which has long been under scrutiny by American officials concerned with how it collects and leverages American users’ personal data, allegedly including biometric data.

The lawsuit, filed July 28, says that CapCut users are not notified of its data practices and are not asked to give consent. CapCut allowed one of the plaintiffs, then a 7th grader, to use the app without setting up an account, accessing a privacy policy with terms of use, or obtaining parental consent, according to the lawsuit.

CapCut’s privacy problems are “particularly significant,” the lawsuit says, noting that as the subsidiary of a Chinese company, CapCut has a legal obligation to share with the Chinese government the information it gathers from regular users and one-time users alike. .

The lawsuit notes that in May 2023 former ByteDance official Yintao Yu publicly stated that the Chinese government could access data and monitor U.S. operations from its Beijing headquarters, giving the company strategic insight into how to maintain “core communist values.” The plaintiffs add that the Chinese Communist Party uses a “backdoor channel code” to access U.S. and other non-Chinese citizens’ data, citing Yu.

TikTok did not respond to a request for comment.

The named plaintiffs assert that they were not told nor did they consent to their biometric data, such as face scans and voiceprints, being collected. CapCut violates Illinois’ strict Biometric Information Privacy Act (BIPA), the lawsuit alleges. A large number of biometric privacy lawsuits have been brought in Illinois under BIPA, many yielding large amounts of statutory damages, thanks to its “private right of action” provision, now a contested element of proposed federal privacy legislation.

The lawsuit also accuses CapCut of intentionally designing its privacy policy to make it difficult for users to understand terms and conditions or provide “meaningful, express consent” thereby duping them into signing up despite the exploitative practices.

The lawsuit wants to ban TikTok from sending user data to China as well as from harvesting users' biometric data without notice and consent. It further asks the court to force the company to trash data already taken.

Collecting details

CapCut collects not only users’ photos and videos, but also location, gender, and birthday, the lawsuit alleges. The app then develops a “data bank” that is leveraged to fuel targeted advertising, the lawsuit says.

In addition, ByteDance developers are accused of building in the ability to suck up technical details about a user’s device and its network information, including its MAC address, IMEI identification information, MEID (Mobile Equipment Identifier), ICCID (Integrated Circuit Card Identifier), and SIM serial number.

"Defendants unjustly profit from the secret harvesting of a massive array of private and personally identifiable CapCut user data and content that they can use for targeted advertising, improvements to defendants' artificial intelligence technologies, patent applications, and the development of consumer demand for, and use of, defendants' other products," the lawsuit asserts.

CapCut relies on automated software, proprietary algorithms, artificial intelligence, facial recognition and other technologies to secretly feed its data bank, the lawsuit says.

The suit alleges that CapCuts’ practices also violate the federal Computer Fraud and Abuse Act, and the California Comprehensive Data Access and Fraud Act, among others.

India has banned CapCut and other China-based video editing apps, the lawsuit notes. It also points to the fact that Montana lawmakers have banned TikTok, and U.S. military branches and many state governments no longer allow TikTok to be used on government phones. The Justice Department is investigating whether TikTok’s Chinese owners have used the app to surveil American journalists, the lawsuit says.