In a new lawsuit brought before a federal court in Illinois, the Chinese-owned application CapCut, a sister company to the notorious TikTok, is being accused of covertly gathering staggering amounts of personal data, including facial scans, from its 200 million strong user base – earning colossal profits while potentially providing the Chinese government unrestricted access to that information. This development throws a harsh spotlight on the controversial modus operandi of its parent company, ByteDance Ltd., whose data collection and usage practices have long been a cause for alarm among American officials.
The lawsuit, officially filed on July 28th, highlights the seemingly shady data practices by CapCut, contending that users are kept in the dark about the type and extent of data being collected, with no opportunity to give their informed consent. It specifically mentions an instance where a 7th grader was able to use the app without any consent, privacy policy, or even the need to set up an account.
We obtained a copy of the lawsuit for you here.
Adding an extra layer to an already deep concern is the app’s obligations as a subsidiary of a Chinese organization. The lawsuit states CapCut is legally required to share its extensively harvested data with the Chinese government, irrespective of whether they are regular or one-time users.
The plaintiffs in the lawsuit refer to an alarming revelation made in May 2023 by ex-ByteDance official Yintao Yu who publicly acknowledged that American operations and data could be monitored from the company’s Beijing headquarters, maintaining what was referred to as “core communist values.”
Further, the Chinese Communist Party’s use of a dubious “backdoor channel code” to access data globally was also cited, spotlighting the looming threats to user privacy.
At the heart of the matter is CapCut’s alleged violation of Illinois’ stringent Biometric Information Privacy Act (BIPA). The complainants assert being unapprised and uninformed about the collection of their biometric data like face scans and voiceprints, a direct infringement of the act. The plaintiffs further accuse CapCut of intentionally obfuscating its privacy policy, making it excessively difficult for users to understand the implications and give meaningful consent, thus entrapping them in an exploitative cycle.
The suit boldly calls for a prohibition on TikTok from transmitting user data to China, and a cease on gathering users’ biometric data without notice or consent. It also seeks an order to dispose of the incessantly collected data.
Operating way beyond just accumulating users’ photos and videos, the lawsuit alleges CapCut amasses users’ location, gender, and birthday data, contributing to a staggering amount of data for targeted advertising. Alarmingly enough, it also accuses ByteDance’s software developers of embedding features to gather technical specifications, including MAC address, IMEI identification information, MEID, and SIM serial number about users’ devices.
