19 State AGs Sue TikTok Over Minor Biometric Data

Nineteen state attorneys general filed a coordinated lawsuit against TikTok’s parent company ByteDance in June 2026, alleging the platform collected biometric data from US

minors without parental consent in violation of state consumer protection and privacy laws.

For more context, see our coverage of Meta Pays $1.4 Billion Texas Facial Recognition.

Key Developments

The complaint, filed in federal court in the Northern District of California, alleges that TikTok collected facial geometry and voice prints from users under

18 through its filter and duet features without the explicit consent required by Illinois BIPA and similar state laws in Texas, Washington, and New

York.

Background and Context

For more context, see our coverage of Trump and Qatar Air Force One Deal.

The lawsuit seeks $5,000 per violation under Illinois BIPA, which could expose ByteDance to hundreds of billions of dollars in statutory damages given TikTok’s

user base of approximately 100 million US users, the majority of whom used the platform as minors at some point.

What Experts Are Saying

Read also: World Cup 2026 June 19: USA vs Australia, Brazil vs Haiti.

For more context, see our coverage of OpenAI Spent $34 Billion in 2025.

The complaint includes internal ByteDance documents obtained through state investigative subpoenas showing that TikTok’s engineering team was aware that face filters captured facial geometry

data and that the data was retained on ByteDance servers beyond the session duration needed to apply the filter.

States also allege that TikTok’s parental consent mechanism, introduced after a 2019 FTC settlement, was designed to be easily bypassed by users entering false

birth dates and that the platform took no steps to verify parental consent claims.

A separate allegation covers TikTok’s LIVE gifting feature, which the complaint says allowed minors to receive virtual gifts convertible to real money, constituting an

unlicensed money transmission service under state financial regulations. See also: World Cup 2026 June 18: Mexico, South Korea, Canada, Qatar.

ByteDance said in a statement that the lawsuit contains “factual inaccuracies” and that TikTok “takes privacy seriously.” The company said it does not collect

biometric data for identification purposes and that filter data is processed on-device.

TikTok has faced regulatory action in multiple countries simultaneously in 2026.

The EU issued a 530 million euro fine in March 2026 under GDPR for transferring EU user data to China without adequate safeguards, which ByteDance is appealing.

Legal experts cited by Law360 said the coordinated multi-state action is the most significant legal threat TikTok has faced in the US, exceeding the

scope of previous FTC and state-level actions.

The Illinois Biometric Information Privacy Act (BIPA), passed in 2008, requires companies to obtain written consent before collecting biometric identifiers including fingerprints, facial geometry, and iris scans.

It allows private lawsuits with statutory damages of $1,000 per negligent violation and $5,000 per intentional violation. It is the strongest biometric privacy law in the US.

Yes. Illinois BIPA creates a private right of action, meaning any Illinois resident whose biometric data was collected without consent can sue.

The multi-state attorney general action adds government enforcement on top of private lawsuits.

A $650 million BIPA settlement with Facebook (now Meta) in 2022 established a precedent for large biometric data judgments.

COPPA, the Children’s Online Privacy Protection Act, requires websites and apps to obtain verifiable parental consent before collecting personal data from children under 13.

TikTok’s minimum age is 13, but the FTC and state AGs allege the platform failed to adequately verify ages and collected data from users under 13.

TikTok settled a COPPA case with the FTC for $5.7 million in 2019.

Sources: CNBC – Economy | Reuters – Business | Bloomberg – Economics