Cybersecurity Policy Report, N.D. Ill.: Some consumer class action claims against ByteDance about use of CapCut app survive dismissal, (Mar 6, 2025)

By Justin Marcus Smith, J.D.

The court held it did not have enough to convert the ByteDance motion to dismiss into a motion for summary judgment where it was not clear which version of the privacy policy pertained to the use context of the consumers who brought the case.

A group of seven consumers asserting a class action against various ByteDance, Ltd. entities sufficiently stated violations of their privacy rights under the California Constitution; intrusion on seclusion; larceny; conversion; and, violation of one section of the Illinois Biometric Information Privacy Act (BIPA), held the federal district court in Chicago. The court dismissed a variety of other claims, including their Consumer Fraud and Abuse Act (CFAA) claim (Rodriguez v. ByteDance, Inc., No. 1:23-cv-04953 (N.D. Ill. March 3, 2025)).

Background. Seven consumers brought a putative class action against ByteDance, Ltd. and related companies (collectively, ByteDance) alleging violation of privacy statutes through the collection of data from CapCut, a video-editing application.

CapCut is thought to be the fourth most downloaded app in the world with more than 200 million monthly active users. The court opinion said ByteDance, Ltd. owns CapCut directly, and ByteDance, Ltd., a Chinese company, also owns TikTok, LLC, which, in turn, owns TikTok Inc., a California corporation.

According to the consumers, CapCut collects a broad array of private and personally identifiable data (e.g., phone and social network contacts; identifier and location information; biometrics) which it is then legally obligated to provide to the Chinese Communist Party (CCP) and the Chinese government, profiting ByteDance, while creating national security concerns for the United States.

ByteDance moved to dismiss for failure to state a claim under Fed. R. Civ. P. 12(b)(6).

Consent. The court held that the CapCut privacy policies did not preclude the consumers’ claims as a matter of law. Whether the plaintiffs had consented to having their data collected was a question of fact that could not be resolved on a motion to dismiss.

ByteDance argued that the consumers could not proceed because the CapCut privacy policy disclosed all of the alleged privacy invasions, including, among other things, “face and body features and attributes.” ByteDance attached three versions of the privacy policy to its opposition. Generally, that would convert a R. 12(b)(6) motion into a R. 56 motion for summary judgment, but the court found the incorporation by reference exception pertained. The consumers certainly referenced CapCut’s privacy policies in their amended complaint.

Even so, whether the consumers waived their right to bring suit based on the privacy policy was an affirmative defense that could not be resolved on a R. 12(b)(6) motion where “several outstanding questions” prevented a legal determination about consent. There was nothing yet to show when and how these particular consumers agreed to the terms, especially where the consumers alleged they never read any privacy policy or terms of use, or which version applied to them.

Consumer fraud. The court dismissed the consumers’ Consumer Fraud and Abuse Act (CFAA) claim. The court held they only made a bare and unspecified assertion about what ByteDance could access on their devices. They also did not allege that ByteDance accessed areas of their devices outside of the app itself. The “capacity” of CapCut to do certain things did not indicate whether it exceeded authorization.

The consumers countered that ByteDance attempted to rewrite CFAA by focusing on access to “areas” rather than “files” and “data”, but the court was not having a terminology debate. The complaint did not sufficiently allege that the defendants “exceeded authorized access.” See 18 U.S.C. § 1030(a)(2)(C). The court reminded that it was not making any factual determination at this time.

The court held the consumers’ CFAA claim also failed because they did not adequately allege “loss.” The CFAA definition of loss focused on technological harms. The consumers asserted secret transmission of personal data and content causing a diminution in value of their personal information; drained battery power; and, a need for forensic evaluation to determine mitigation.

The court said it was following the lead of other courts in holding that diminution of the value of their personal information was not cognizable under the CFAA. Battery power loss was also defective because the consumers did not allege at least $5,000 worth in a year or how otherwise to value that. Class aggregate loss could not pertain where the consumers did not “show their work.” The court also found professional forensic evaluation was speculative without an allegation of actual consultation valued at $5,000 per year. The court accordingly dismissed the CFAA claim without prejudice.

CDAFA. Similarly, the court dismissed the consumers’ Computer Data Access and Fraud Act (CDAFA) on the same ground that the consumers failed to articulate any theory of loss.

VPPA. The court dismissed the consumers’ Video Privacy Protection Act (VPPA) claim because CapCut was not a “video tape service provider.” The court relied on VPPA use of the word “materials.” Unlike defunct video rental stores or even more modern services like Netflix, the court said CapCut is not engaged in renting, selling, “or even delivering audio visual materials.” (emphasis included). The court construed CapCut as a video editing application. The court agreed with ByteDance that users provide videos to CapCut, not the other way around. This dismissal was with prejudice because the court said amendment would be futile.

ECPA. The court held the consumers only made conclusory allegations that ByteDance “intercepted” their communications under the Electronic Communications Privacy Act of 1986. The court declined to infer required real-time interception where the complaint alleged only that the CCP could access the data and that a special committee of CCP members monitors ByteDance. The allegations also fell short of the software-tracking device, a Facebook plug-in, found sufficient in their cited authority. Neither ECPA nor the California Invasion of Privacy Act (CIPA) imposes liability on a person who is a “party” to the communication, and here, ByteDance was indeed a party. The court dismissed the ECPA counts without prejudice.

SCA. The court held the consumers’ allegations were not enough to rise beyond speculation with respect to unauthorized disclosure under the Stored Communications Act (SCA). The consumers alleged reports of leaky TikTok data, but they acknowledged ByteDance ran CapCut directly. The allegation about a “super user” data access credential did not establish CCP access to user communications as opposed to user data. SCA liability only attaches to knowing disclosure of communication contents. See 18 U.S.C. § 2702(a)(1). The court declined to presume anything about an engineer’s statement about data sharing with the CCP that might have happened several years before CapCut ever launched in the U.S. The § 2702(a)(1) also does not apply to communications service providers, and the consumers admitted that CapCut was such a service.

Privacy claims. The court held the consumers could proceed with their constitutional and common-law privacy claims based on the collection of their photos and videos, location data, and biometric data. However, the court dismissed such non-statutory claims based on the collection of account meta data like identifiers, registration information, and sign-up information. As for photos and videos, sensitivity was not dispositive. The manner of collection mattered, and the consumers alleged their expectation of privacy. ByteDance did not argue that the consumers lacked a reasonable expectation of privacy in their location information. Consent remained a fact question for disposition later. For now, it sufficed to say that a reasonable person could find the collection of face scans and voice prints to be ‘highly offensive.”

UCL. The court dismissed the California Unfair Competition Law (UCL) claim without prejudice. The consumers failed to allege sufficient theories of lost money or property resulting from the ByteDance data privacy practices.

FAL. The court dismissed the consumers’ claim under California’s False Advertising Law (FAL) without prejudice. The consumers alleged ByteDance failed to disclose its collection of their private information and sharing with the CCP. They also alleged misleading advertising and other statements. FAL claims were subject to the same economic loss requirement as UCL claims. Their fraudulent omission allegations also fell short because they did not explain a duty to disclose.

Larceny, conversion. The court sustained the consumers’ claims for larceny and conversion. The consumers alleged more than the theft or conversion of their videos, they also alleged unlawful collection of personal information and private data that included, among other things, social network contacts. ByteDance attempted to argue such personal data is generally not “property”, but the court acknowledged a growing trend to recognize the lost property value of personal information. The court said it would follow that trend in this context.

Unjust enrichment. The court dismissed the consumers’ unjust enrichment equitable cause of action without prejudice because the consumers did not plausibly plead that they relied on a misrepresentation or omission when they decided to use CapCut.

BIPA. Scans of facial geometry and voiceprints were “straightforwardly” biometric identifiers under a textual reading of BIPA. Actual use was not pertinent. The court distinguished cases ByteDance cited in that the consumers’ complaint made it clear that ByteDance was capable of using the data to identify them even if it did not actually do so. The allegations about voiceprints and face scans were enough for now under 740 ILCS 14/15(b).

However, the court dismissed other facets of the consumers’ BIPA claim under multiple other BIPA sections. As for sale of the information under BIPA, the complaint failed to allege that TikTok ever received “biometric identifiers” from CapCut, that is, measurements as distinguished from the underlying videos. The consumers did not allege that the ByteDance video-editing business model relies on collection of biometric data rather than the underlying videos. The alleged data sharing with the CCP was too speculative, and the consumers did not allege an industry standard of care much less how ByteDance practices fell short of one.

The Case is No. 1:23-cv-04953.

Judge: Alexakis, G.

Attorneys: Jeannie Y. Evans (Hagens Berman Sobol Shapiro LLP) for Evelia Rodriguez. Anthony J. Weibell (Mayer Brown LLP) for ByteDance, Inc.

Companies: ByteDance, Inc.

Cases: Privacy Advertising StateUnfairTradePractices CyberPrivacyFeed DataPrivacy IllinoisNews DataSecurity