Two Illinois children and their mothers sued the social media company TikTok and its parent company on Tuesday for allegedly collecting the personal information of minors without parental consent.
TikTok and ByteDance Technology allegedly tracked, collected, and disclosed information to a third party about the children that used the companies’ Musical.ly app, according to a lawsuit filed in the U.S. District Court for Northern Illinois.
ByteDance purchased Musical.ly in 2017, then rebranded it as TikTok.
The lawsuit alleges that Musical.ly “failed to deploy appropriate safeguards” to prevent minors from using their application.
At the same time, the app asked users for personally identifiable information like their email address, phone number, username, first and last name, short bio, and a profile picture to register.
The suit also alleges that between December 2015 and October 2016 the app collected location data on users, a feature that “enabled Defendants and other users of the App to identify where a user was located.”
The suit also notes that profiles were set as public by default, and even if users set their accounts on private, “their profiles, including usernames, profile pictures, and bios, remained public and searchable by other users.”
Under the Children’s Online Privacy Protection Act (COPPA) developers of apps geared toward children cannot collect personally identifiable information of children under 13 without consent from parents or legal guardians.
TikTok did not immediately respond to comment on the allegations in the lawsuit.
The Federal Trade Commission earlier this year announced it had reached a settlement with Musical.ly over a separate complaint about COPPA violations.
The multimillion-dollar settlement is the largest civil penalty the FTC has obtained in a children’s privacy case.
In that settlement, TikTok said it would require new users to verify their age and promised to work to verify the ages of users currently on the platform.
The app also said it would work to ensure that users under 13 access a “limited, separate app experience” replete with “safety and privacy protections.”