• by Wendy Davis  @wendyndavis, May 31, 2023

A California resident has sued TikTok and its parent company ByteDance for allegedly tracking her online activity on outside publishers' websites, including those of Hulu and Etsy.

TikTok and ByteDance engage in the “unauthorized interception, collection, saving and use of non-TikTok users’ highly personal data,” Bernadine Griffith alleges in a class-action complaint brought late last week in U.S. District Court for the Central District of California.

The complaint centers on TikTok's pixel -- a tracking tool that publishers can install on their sites to collect data that fuels online advertising. Griffith alleges that the pixel allows TikTok to compile a broad array of information from web users, regardless of whether they have accounts with the app.

“By aggregating private data over a wide range of websites, defendants assemble a comprehensive profile of these non-TikTok users,” the complaint alleges.

She claims TikTok violated a federal anti-hacking law as well as various California privacy laws.

Griffith says in the complaint she never used TikTok because “she was concerned that TikTok would violate her privacy.”

She alleges that TikTok “secretly intercepted and collected” her browsing and search data from sites including the streaming service Hulu, online marketplace Etsy, and retailer Build-a-Bear Workshop.

“These websites -- Hulu, Etsy, and Build-a-Bear Workshop -- are just some representative examples of websites where TikTok has stolen the private data of Ms. Griffith,” the complaint alleges.

Some of the allegations draw from a September 2022 Consumer Reports investigation concluding that TikTok “is partnering with a growing number of other companies to hoover up data about people as they travel across the internet.”

According to Consumer Reports, hundreds of large organizations including Weight Watchers, Planned Parenthood and the Girl Scouts were sending data about web visitors to TikTok.

At the time, Google's and Meta's tracking tools were far more prevalent than TikTok's, according to Consumer Reports.

Griffith also alleges that TikTok's technology allows it to collect information about users even when they attempt to prevent tracking by blocking cookies set by third parties -- meaning cookies set by web companies other than the one a user has deliberately visited.

“Where a web browser or operating system is set to block third-party cookies to prevent defendants from obtaining private data, defendants circumvent those settings to obtain private data anyway,” Griffith says in the complaint.

The company allegedly does so by “causing the website to share the first-party cookie with defendants, in effect transmuting a first-party cookie into a third-party cookie with the ability to evade web browser and operating system settings that would otherwise block it.”

TikTok declined to comment on the lawsuit.