TikTok accused in California lawsuit of sending user data to China

The allegations may deepen legal troubles in the United States for TikTok, which is owned by Beijing-based ByteDance Technology.
Image: FILE PHOTO: Man walks past a sign of ByteDance's app TikTok, known locally as Douyin, at an expo in Hangzhou
FILE PHOTO: A man walks past a sign of Chinese company ByteDance's app TikTok, known locally as Douyin, at the International Artificial Products Expo in Hangzhou, Zhejiang province, China on Oct. 18, 2019.CSN / via Reuters

Breaking News Emails

Get breaking news alerts and special reports. The news and stories that matter, delivered weekday mornings.
SUBSCRIBE
By Reuters

SAN FRANCISCO — A California college student has accused popular video-sharing app TikTok in a class-action lawsuit of transferring private user data to servers in China, despite the company’s assurances that it does not store personal data there.

The allegations may deepen legal troubles in the United States for TikTok, which is owned by Beijing ByteDance Technology Co but operates entirely outside of China and has developed an especially devoted fan base among U.S. teenagers.

The company is already facing a U.S. government national security probe over concerns about data storage and possible censorship of political sensitive content.

Byers Market Newsletter

Get breaking news and insider analysis on the rapidly changing world of media and technology right to your inbox.

The lawsuit, filed in the U.S. District Court for the Northern District of California last Wednesday and originally reported by The Daily Beast, alleges TikTok has surreptitiously “vacuumed up and transferred to servers in China vast quantities of private and personally-identifiable user data.”

TikTok did not immediately respond to a request for comment on the allegations, but maintains that it stores all U.S. user data in the United States with backups in Singapore.

The documents identify the plaintiff as Misty Hong, a college student and resident of Palo Alto, California, who downloaded the TikTok app in March or April 2019 but never created an account.

Months later, she alleges, she discovered that TikTok had created an account for her without her knowledge and produced a dossier of private information about her, including biometric information gleaned from videos she created but never posted.

According to the filing, TikTok transferred user data to two servers in China - bugly.qq.com and umeng.com - as recently as April 2019, including information about the user’s device and any websites the user had visited.

Bugly is owned by Tencent, China’s largest mobile software company, which also owns social network WeChat, while Umeng is part of Chinese e-commerce giant Alibaba Group.

The lawsuit also claims that source code from Chinese tech giant Baidu is embedded within the TikTok app, as is code from Igexin, a Chinese advertising service, which security researchers discovered in 2017 was enabling developers to install spyware on a user’s phone.

The legal documents did not provide evidence of the data transfers or the existence of Baidu or Igexin source code in the app. Hong and her legal representatives could not immediately be reached for comment.