TikTok users move forward on in-app browser data collection

TikTok Inc. faces most claims in a proposed class-action lawsuit alleging it illegally collected users’ private information through an in-app browser that allows users to follow links to advertisers and retail outlets.

Plaintiffs alleged sufficient actual damages to establish standing to bring suit in federal court and provided sufficient facts at the pleading stage to support allegations of unjust enrichment and violations of the Federal Wiretapping Act. state wiretapping and eavesdropping laws, and state unfair competition laws. Judge Rebecca R. Pallmeyer of the U.S. District Court for the Northern District of Illinois said Tuesday.

The decision comes nine months after Pallmeyer ruled that plaintiffs filing wiretapping lawsuits over TikTok’s data collection practices could move forward with their consolidated multi-district lawsuit despite an earlier $92 million settlement TikTok reached with consumers challenging the company’s practices under biometric privacy laws.

TikTok has faced a wave of lawsuits across the country over its in-app browser following the August 2022 publication of research by Felix Krause, a software engineer who exposed risks previously undisclosed privacy issues arising from the browser’s ability to record user interactions with third parties. party websites.

These suits were transferred to the Pallmeyer courtroom by the Judicial Committee on Multidistrict Litigation.

Code injected

Plaintiffs in the consolidated litigation alleged that the in-app browser embeds JavaScript code into third-party websites that allows it to track mouse movements, clicks, keystrokes, text entered into text fields, etc. information, URLs of visited web pages and other electronic information. communications. The company then uses this information to create marketing profiles of users and target them with advertising, the complaint states.

TikTok argued in a motion to dismiss that the 10 named plaintiffs had not provided enough information about their activity using the in-app browser to justify their inclusion in the litigation, but Pallmeyer was not d ‘agreement.

The context of the browser complaint helped support the plaintiffs’ individual pleadings and was sufficient to assert their position and put TikTok on notice of their claims, she said.

The company’s argument that the claims should be dismissed because of the limitations of Krause’s research, which formed the basis of the complaint, was not more successful.

Krause’s acknowledgment that he could not specify what data the browser collected or whether it transferred the data for another use was not enough to absolve TikTok of any potential liability for installing the equivalent of a keylogger on third-party websites, she said.

Pallmeyer also rejected TikTok’s argument that the plaintiffs consented to the data collection in accordance with its terms of service and privacy policy.

TikTok’s evidence – screenshots from the “Wayback Machine” internet archive showing versions of the privacy policy from 2021 to 2024 – was too limited to allow a definitive ruling at this early stage, she said.

Pallmeyer denied the motion regarding plaintiffs’ claims under the California Invasion of Privacy Act, the Florida Security of Communications Act, the Illinois Eavesdropping Act and the Pennsylvania Wiretapping and Electronic Surveillance Control Act.

But it dismissed their claims under California’s unfair competition law, finding that the plaintiffs had not adequately pleaded that they suffered economic harm as a result of TikTok’s practices, a condition for filing a suit according to the law.

PC Baron and Budd; Scott & Scott Lawyers LLP; Barracks, Rhodes and Bacine; Lockridge Grindal Nauen PLLP; Carella, Byrne, Cecchi, Brody and Agnello PC; Israel David LLC: Gibson Consumer Law Group LLC; Kessler, Topaze, Meltzer & Check LLP; Herman Jones LLP; Reese LLP; and Chicago Consumer Law Center PC represent the proposed plaintiffs and classes.

Mayer Brown LLP represents TikTok.

The case is In re TikTok Inc. In-App Browser Priv. Litig., ND Ill., No. 1:24-cv-02110, 10/1/24.