CapCut Lawsuit: ByteDance Privacy Claims and Judge’s Ruling

The CapCut lawsuit is a class action pending in federal court in Chicago that accuses ByteDance, the Chinese parent company of TikTok, of secretly collecting biometric data, location information, device identifiers, and other sensitive personal details from users of its video-editing app without meaningful consent. Filed in July 2023, the case survived a motion to dismiss in March 2025, when a judge allowed core privacy claims to move forward.¹

What the Lawsuit Alleges

The complaint, Rodriguez v. ByteDance, Inc., was filed on July 28, 2023, in the U.S. District Court for the Northern District of Illinois under Case No. 1:23-cv-04953.² It alleges CapCut collects far more data than users realize, including biometric information such as facial measurements and voiceprints, along with photos, videos, geolocation, device identifiers like IMEI and MAC addresses, and SIM serial numbers.³

The plaintiffs claim CapCut’s privacy policies were designed to prevent users from giving “meaningful, express consent,” and that the disclosures shifted over time in ways that made it unclear what users were actually agreeing to.¹ According to the complaint, ByteDance used the harvested data to fuel targeted advertising, improve artificial intelligence systems, support patent applications, and drive users toward other ByteDance products like TikTok. The suit further alleges ByteDance maintained a “backdoor channel” giving the Chinese government access to non-Chinese user data, a claim tied to Chinese laws requiring domestic companies to cooperate with state intelligence-gathering.³

The complaint invokes the Illinois Biometric Information Privacy Act, the federal Computer Fraud and Abuse Act, the California Comprehensive Data Access and Fraud Act, the California Constitution’s right of privacy, and California tort claims for intrusion upon seclusion, larceny, and conversion.³²

Who Filed the Case

The named plaintiffs are Evelia Rodriguez, a resident of Oroville, California, and Erikka Wilson of Chicago, who also brought claims on behalf of her then-14-year-old child, A.N.¹ Rodriguez downloaded the app around April 13, 2023, after seeing a TikTok ad showing how CapCut could combine two photos. She alleged that when she tried the feature, the app gained access to every photo and video on her device, and that she saw no privacy policy, terms of use, or discernible warnings before using it.⁴

Wilson downloaded CapCut around March 2023 and similarly did not recall reading a privacy policy. Her child A.N. began using the app in seventh grade without setting up an account or encountering a policy, and later created an account with no requirement for parental permission.⁴

What the Judge Decided

ByteDance moved to dismiss, arguing that users “expressly or impliedly” consented to data collection by downloading and using CapCut and that its practices were disclosed in the app’s privacy policy.¹

On March 3, 2025, U.S. District Judge Georgia Alexakis rejected that argument as “premature.” She found it was unclear which specific privacy terms the plaintiffs had actually seen, noting that CapCut’s disclosures had changed materially over time. The November 2020 privacy policy made no mention of collecting location data, while the April 2022 and January 2023 versions did.¹

Judge Alexakis allowed the plaintiffs to proceed with claims under the California Constitution’s privacy protections, together with claims of intrusion upon seclusion, larceny, and conversion.² The federal Video Privacy Protection Act claim was dismissed with prejudice, meaning it cannot be refiled.⁵ Other federal and state claims were dismissed without prejudice, leaving the plaintiffs room to amend and refile.¹

Where the Case Stands Now

As of mid-2026, no settlement or trial date has been publicly reported. The case remains in pretrial stages, with the surviving California constitutional and tort claims still active. There is no settlement fund and no claim form for the public at this point.

A Separate Dispute: CapCut’s June 2025 Terms of Service

The class action is about alleged secret data collection. A distinct controversy hit CapCut in June 2025, when the company updated its terms of service. Effective June 12, 2025, the new terms grant CapCut a “perpetual, worldwide, royalty-free, irrevocable license” to use, edit, distribute, and exploit user content, covering public videos, private videos, and unfinished drafts made in the app.⁶⁷

Attorney Bert P. Krages, author of The Photographer’s Right, described the language as “very broad” and “ambiguous,” warning it could allow ByteDance to sublicense user content to third parties or display it without consent, and called the license “risky” for anyone creating private content for clients.⁶ German lawyer Chan-jo Jun said “anyone who edits videos with the TikTok software CapCut loses rights and risks liability,” and his firm issued a formal legal warning to ByteDance.⁸

CapCut responded in a blog post that the “irrevocable” and “perpetual” language was not new and had existed in its terms for years, calling the provisions necessary to save, format, and display content and to let other users create derivative works from shared templates. The company said it has “never claimed ownership of users’ work.”⁹ As of mid-2026, CapCut has not reversed or materially modified the contested terms.⁸

What CapCut’s Privacy Policy Says

CapCut’s privacy policy, most recently updated April 15, 2026, acknowledges collecting date of birth, login credentials, phone numbers, user-generated content such as photos, videos, and audio recordings, and AI prompts and AI-generated responses. It states the app collects information about “the existence and location of faces and body parts” within user content, along with device identifiers, IP addresses, approximate location based on IP and SIM data, and usage patterns.¹⁰

CapCut says it uses this information to operate and customize its services, train machine learning models, verify age and identity, personalize content and advertising, and enforce its community guidelines, and it shares data with service providers, business partners, advertising and analytics partners, corporate affiliates, and legal authorities when required by law. On biometric data specifically, the policy states that face and body information is used only to apply effects and is deleted once the effect is applied, not retained or used for identification.¹⁰ The plaintiffs dispute these characterizations, alleging the company’s actual practices go well beyond what its policies disclose.

ByteDance’s Prior Privacy Settlements

The CapCut case is not ByteDance’s first biometric privacy fight. TikTok itself faced 21 consolidated class actions in the same Northern District of Illinois. In February 2021, TikTok agreed to a $92 million settlement resolving claims it collected users’ facial geometry scans without consent in violation of Illinois BIPA and shared data without authorization. A federal judge approved the settlement in July 2022.¹¹

As part of that deal, TikTok agreed to stop collecting biometric information, geolocation data, and clipboard content unless expressly disclosed in its privacy policy, to end the practice of pre-uploading user content before a user chose to post, and to delete all previously pre-uploaded content that users had not saved. The company committed to mandatory annual data privacy training subject to third-party review for three years.¹¹ Whether those compliance measures extended to ByteDance’s other consumer products is one of the questions underlying the CapCut litigation.

ByteDance also has a children’s privacy history. TikTok’s predecessor Musical.ly settled with the Federal Trade Commission in 2019 for $5.7 million over violations of the Children’s Online Privacy Protection Act, and the Department of Justice later sued TikTok, on FTC referral, alleging the company continued to let children under 13 create accounts and use the platform without parental consent.¹² The CapCut complaint echoes that theme through its allegations about A.N., the minor plaintiff.

1
MediaPost. ByteDance’s CapCut Must Face Privacy Suit
2
Top Class Actions. ByteDance Class Action: CapCut App Fails to Protect User Data
3
The Record. CapCut Privacy Lawsuit Illinois BIPA ByteDance China
4
Archive.org. Rodriguez v. ByteDance Inc., Case No. 1:23-cv-04953, Court Filing
5
Law360. ByteDance, TikTok Get Editing App Privacy Suit Trimmed
6
DPReview. CapCut Video Editing App’s New Terms Spark Rights Concerns
7
CapCut. CapCut Terms of Service
8
2B Advice. CapCut: Trouble Over New Terms of Service
9
CapCut. About CapCut Terms of Service
10
CapCut. CapCut Privacy Policy
11
IAPP. TikTok Settlement Highlights Power of Privacy Class Actions to Shape U.S. Protections
12
Davis+Gilbert LLP. Children’s Privacy Roundup: U.S. vs. TikTok and Federal and State Legislation Updates