• by Wendy Davis  @wendyndavis, August 13, 2024

TikTok and its parent company, the China-based ByteDance, have been hit with a class-action complaint alleging that they wrongly collected data from young children who used the app.

TikTok and ByteDance, “knowingly permitted and encouraged children under the age of 13 to create user accounts on the TikTok app for the purpose of collecting intimate, deeply intrusive data points about them and their online behavior without notice and parental consent,” the plaintiffs allege in a complaint brought late last week in U.S. District Court for the Central District of California.

“Defendants use this unlawfully collected personal information for the purpose of providing personally curated content that will keep children engaged with TikTok, so that defendants can serve them copious amounts of behavioral advertising and/or share their information with third parties,” the parents add.

The new suit, brought on behalf of three children, comes one week after the Department of Justice charged TikTok and ByteDance with violating the federal Children's Online Privacy Protection Act. That law prohibits websites and apps from knowingly collecting personal data of users 12 and under, without parental consent.

The complaint reiterates many of the allegations made by the Justice Department, including claims that TikTok's sign-up process allowed users 12 and under to bypass a “Kids Mode” setting and create non-Kids Mode accounts.

A TikTok spokesperson previously said the company disagrees with the Justice Department's allegations, adding that many “relate to past events and practices,” and “are factually inaccurate or have been addressed.”

The Children's Online Privacy Protection Act only authorizes lawsuits by government officials -- and not class-actions by private parties. But the parents claim in their complaint that the alleged data collection by TikTok violates other privacy laws or standards in three states, including California.

Among other claims, the parents say TikTok engaged in “intrusion upon seclusion” -- a privacy claim that can be brought in California, and that involves “highly offensive” conduct.

A federal appellate court recently allowed parents to pursue an “intrusion upon seclusion” claim against Google, which allegedly collected data from young children. The court in that case rejected Google's argument that the federal Children's Online Privacy Protection Act foreclosed all private lawsuits over alleged violations of children's privacy. Instead, the 9th Circuit ruled that the federal privacy law doesn't preclude people from bringing parallel claims rooted in state law.