• by Wendy Davis  @wendyndavis, March 5, 2025

The China-based company ByteDance must face claims that its video-editing app, CapCut, wrongly collected a trove of users' data -- including their photos and videos, location information and biometric data -- a federal judge has ruled.

The ruling, issued this week by U.S. District Court Judge Georgia Alexakis in the Northern District of Illinois, comes in a lawsuit brought in July 2023 by CapCut users including California resident Evelia Rodriguez and Illinois resident Erikka Wilson.

They alleged in a class-action complaint that ByteDance and subsidiaries, including TikTok, “unjustly profit from the secret harvesting” of a vast array of data that can fuel targeted ads, improve artificial intelligence, and develop other products.

Rodriguez specifically alleged that she intended to test CapCut by combining two photos on her device, but that the app “gained access to all of the photos and videos on her device.”

The complaint also included allegations that CapCut collected user identifiers and registration information.

The plaintiffs claimed the company violated various federal privacy laws, as well as privacy statutes in California and Illinois.

Alexakis's ruling only allows the users to proceed with claims that CapCut violated California privacy standards by allegedly collecting photos and videos, location data, and biometric data. She dismissed the federal claims, and some other state claims, but without prejudice -- meaning the plaintiffs can amend those claims and bring them again.

ByteDance had urged Alexakis to quickly dismiss the entire complaint, arguing that CapCut users consented to data collection. The company contended that CapCut disclosed its data practices in a privacy policy, and that the plaintiffs consented by downloading and using the app.

“CapCut’s data collection practices are not secret or hidden -- they were published to the world,” the company argued in its bid for a fast dismissal. “Users expressly or impliedly consent to the policy upon downloading and using the app.”

Alexakis rejected that argument as premature, noting that it wasn't clear what privacy terms the plaintiffs saw, given that CapCut's disclosures had changed over time. For instance, CapCut privacy policies issued in April 2022 and January 2023 said the company collects users' locations, but its November 2020 privacy policy did not say it collected such data.