• by Wendy Davis  @wendyndavis, October 10, 2023

TikTok must face a privacy lawsuit over allegations that it tracked web users on sites operated by Hulu, Etsy and other outside companies, a federal judge has ruled.

In a decision issued late last week, U.S. District Court Judge Stanley Blumenfeld, Jr. in the Central District of California ruled that if the allegations in the complaint are proven true, they could show that TikTok, owned by Chinese-based ByteDance, violated privacy standards in California.

The ruling comes in a class-action complaint brought in June by state resident Bernadine Griffith. She alleged that TikTok's pixel -- a tool publishers can install on their sites to collect ad-related data -- enables the company to compile information about web users, regardless of whether they have accounts with TikTok.

“By aggregating private data over a wide range of websites, defendants assemble a comprehensive profile of these non-TikTok users,” Griffith alleged.

The complaint included claims that TikTok violated California's constitution, which says residents have a right to privacy, and that it engaged in “intrusion upon seclusion” -- a privacy claim that involves offensive conduct.

Some of the allegations draw from a September 2022 Consumer Reports investigation concluding that TikTok “is partnering with a growing number of other companies to hoover up data about people as they travel across the internet.”

According to Consumer Reports, hundreds of large organizations including Weight Watchers, Planned Parenthood and the Girl Scouts were sending data about web visitors to TikTok. At the time of the report, Google's and Meta's tracking tools were far more prevalent than TikTok's, according to Consumer Reports.

Griffith, a non-TikTok user, alleged that the company “secretly intercepted and collected” her browsing and search data from sites including the streaming service Hulu, online marketplace Etsy, and retailer Build-a-Bear Workshop. She also alleged that TikTok's technology allows it to collect information about users even when they attempt to prevent tracking by blocking cookies set by third parties -- meaning cookies set by web companies other than the one a user has deliberately visited.

TikTok urged Blumenfeld to dismiss the case at an early stage, writing that the claims were “non-starters,” noting that Hulu, Etsy and Build-a-Bear all disclose that they allow third parties to collect data.

“Plaintiff’s complaint against data sharing ... is equivalent to complaining about how the Internet works,” TikTok's lawyers wrote in a motion filed in July. “The Internet functions as a network of information. For Plaintiff to visit any website, data must go from Plaintiff, to her Internet Service Provider who connects her online, to numerous computers along the way, and ultimately to the website she visits.”

The company added that analytics codes like its pixel are “widely used by website owners in order to evaluate the effectiveness of their ad campaigns on a platform.”

Blumenfeld threw out some claims -- including allegations that TikTok violated a computer fraud law -- but said Griffith could move forward with the bulk of the lawsuit. He noted in the ruling that other judges in California had allowed privacy lawsuits over online tracking to proceed against Meta and Google.