Nineteen lawsuits have been combined into a unified federal legal action against short-form video app TikTok for allegedly harvesting data from users and secretly sending the information to China.

Anjum Naveed/AP

hide caption

toggle caption

Anjum Naveed/AP

Nineteen lawsuits have been combined into a unified federal legal action against short-form video app TikTok for allegedly harvesting data from users and secretly sending the information to China.

Anjum Naveed/AP

Dozens of families are suing TikTok in what has turned into a major legal action in federal court.

More than 70 minors, through their parents, are alleging that the video-sharing app collects information about their facial characteristics, locations and close contacts, and quietly sends that data to servers in China.

Twenty separate but similar federal lawsuits were filed over the past year on behalf of TikTok users in California, where the company has offices, and Illinois, which requires that technology companies receive written consent before collecting data on a person’s identity.

The suits now have been merged into one.

And on Wednesday, a panel of federal judges ruled that the case will be based in the U.S. District Court for the Northern District of Illinois. Judge John Z. Lee was appointed as the presiding judge.

Plaintiffs’ lawyers will be asking Lee to expand the suit into a nationwide class action, potentially affecting tens of millions of American users.

While TikTok flatly denies the allegations, the company is under intense pressure to avoid a long, drawn-out legal battle. The Trump administration considers TikTok a national security threat because its parent company, ByteDance, is based in China. President Trump said Monday that TikTok must be sold to an American suitor by September 15 or “close down” in the U.S. Microsoft, for one, has acknowledged that it is exploring a bid.

TikTok is fighting to have the privacy lawsuit dismissed. But if it survives, it could cost the company hundreds of millions of dollars.

A lawsuit filed under the same Illinois law against Facebook over its use of facial recognition technology recently prompted the social network to agree to a record data-privacy settlement of $650 million. Legal experts say, if the the court approves the TikTok lawsuit as a national case, the settlement sum could exceed the Facebook payout.

The Illinois law, known as the Biometric Information Privacy Act, “has been striking fear in the heart of many companies in the United States for fear that claims like this will be brought,” said Leslie Weaver, one of the 33 plaintiffs’ lawyers involved in the litigation against TikTok.

Lawyers for TikTok say the app is not capturing users’ biometric information, nor sending any data to China. But TikTok’s legal team also argues that the company can transfer data to Beijing, if it so chooses, without breaking any laws.

“The App’s privacy policy also fully discloses that user data will be shared with TikTok’s corporate affiliates and third-party business partners and service providers, as is standard with free social networking apps that have a business model based on advertising,” wrote TikTok lawyer Tony Weibell in a submission to the court.

Is TikTok sending data to China?

The national security debate about TikTok centers on something nobody has so far provided direct evidence of: that Tiktok is sending information about American citizens to China and, possibly, the Chinese Community Party.

TikTok says its primary servers for its U.S. users are in Virginia and its backup servers are in Singapore. The company says no data collected on Americans ever goes to servers or authorities in China.

But that contradicts the findings of technology experts hired by the plaintiffs’ lawyers. Those experts, who studied the collection and journey of TikTok data, claim troves of information are being sent to servers in China “under the control of third-parties who cooperate with the Chinese government,” according to the lawsuit.

“Such information reveals TikTok users’ precise physical location, including possibly indoor locations within buildings, and TikTok users’ apps that possibly reveal mental or physical health, religious views, political views, and sexual orientation,” lawyers for users wrote in legal filings.

The lawyers declined to comment for this story, nor would they disclose to NPR who their experts are or what methods they employed.

In the lawsuit, they contend that as soon as TikTok is downloaded, it starts collecting data, even before a user opens an account. If a user starts making a video, but then does not save it, data in the video is still mined by TikTok, according to the suit. Even when TikTok is merely on a phone but not being used, it is still allegedly vacuuming up loads of personal data. It is a practice, the suit argues, that violates the law by not receiving the consent of users.

The lawyers for the users say the app engages in what it calls “covert theft” while attempting to hide its tracks.

“They do so by obfuscating the source code that would reveal the private and personally-identifiable user data and content actually taken from users’ mobile devices,” the suit says.

TikTok denies that any of its data collection starts before users agree to its terms of service. TikTok is upfront about what data it takes from users. Experts say most smartphone apps collect and store just as much — or more — data as TikTok does.

TikTok’s legal team says the lawsuit is based on a “factually mistaken” analysis of how the app collects data and what it is doing with that data. But worse than that, according to TikTok lawyer Weibell, is that the suit is China-phobic in the same way many U.S. politicians and Silicon Valley tech giants are, he argues.

“The present lawsuit is based on (and quotes) the same anti-Chinese rhetoric, conjecture, supposition, and innuendo that originated with these political and competitive attacks,” Weibell said in a filing.

Weibell would not comment on the suit to NPR.

TikTok says case should be tossed based on user agreement

TikTok’s terms of service include what is known as an arbitration clause, which makes users agree that any complaint about TikTok can never be part of a class-action lawsuit.

But under California law, arbitration clauses do not apply to minors. They can still file lawsuits if they think they have been harmed.

Lawyers for the users say because data collection allegedly happens before any terms of service are agreed to, users of any age should be able to have their day in court.

TikTok, though, hopes the whole case will be thrown out on the grounds that users do not have a right to bring the lawsuit in the first place because of the legalese that forces disputes to be resolved outside of court.

If a panel of judges overseeing the case sides with TikTok, the whole case could fall apart. But if the panel agrees with the plaintiffs, both sides will begin deliberations about who is able to join the class action and how much money will be at stake.

Under the Illinois biometric law, the minimum penalty is $1,000 per instance that identifying data was taken without someone’s consent. If it is proven that the covert theft was reckless, the penalty can go up to $5,000 per violation.

According to market research firm Sensor Tower, TikTok has been downloaded more than 180 million times in the U.S.

Lawsuit looms over potential sale to Microsoft

What kind of exposure Microsoft would have to pending litigation will likely be part of the software giant’s review ahead of an official offer to buy the app. But lawyers involved in the case say the lawsuit is not likely to dissuade Microsoft, a company valued at $1.5 trillion.

Some lawyers involved in the lawsuit predicted that a settlement would be reached before any sale of TikTok is completed and that TikTok may be in a rush to resolve the suits to make itself “more sellable.”

But if the suit becomes a nationwide class action, it could be a legal headache and considerable expense that sticks around TikTok for years to come.

Microsoft has vowed that if it becomes TikTok’s new parent company, all data on American citizens would remain within U.S. borders.

“To the extent that any such data is currently stored or backed-up outside the United States, Microsoft would ensure that this data is deleted from servers outside the country after it is transferred,” Microsoft said in a statement.