ByteDance is a privately held, Cayman Islands-incorporated technology company headquartered in Beijing that owns TikTok, Douyin, CapCut, and other apps, with a multi-layered corporate structure that outside researchers say is difficult to independently verify. The company's platforms have been the subject of a 2024 U.S. Department of Justice/FTC lawsuit alleging COPPA violations, a €345 million Irish Data Protection Commission fine and a £12.7 million UK ICO fine over children's data handling, and a 2022 internal ByteDance investigation that confirmed employee access to journalists' TikTok account data. ByteDance's own privacy policies disclose use of first-party tracking technologies and permit sharing of de-identified or aggregated data with third parties for business purposes.
TRACK RECORD
1 ENFORCEMENT ACTION
[2024-08-02]
In August 2024, the U.S. Department of Justice, on behalf of the FTC, sued TikTok, ByteDance, and affiliates alleging violations of COPPA and infringement of a 2019 FTC consent order.
The privacy policy for ByteDance's Doubao Seed Team website discloses that it does not generally collect personal information beyond what a user affirmatively provides through the service.
The FTC's 2024 complaint alleges TikTok and parent company ByteDance failed to notify parents about all personal data collected from children under 13 and failed to obtain verifiable parental consent before collecting it.
Independent research into ByteDance's corporate structure found that, because ByteDance is a private company relying on a variable interest entity structure, its full ownership composition is not independently verifiable from public records.
TikTok operates through a multi-layered corporate structure in which the U.S. app entity (TikTok LLC, Delaware) is controlled by TikTok Ltd (Cayman Islands/Shanghai), which is in turn ultimately owned by ByteDance Ltd, also incorporated in the Cayman Islands and based in Beijing.
Reporting on TikTok's privacy policy states the company discloses it will not sell personal information to third parties but reserves the right to use information internally for business development purposes, including use by parent company ByteDance.
ByteDance's Seed Team privacy policy discloses that anonymized, aggregated, or de-identified data may be shared with third parties for the company's lawful business purposes.
Following a December 2022 internal investigation, ByteDance's CEO stated that employees had misused their authority to access TikTok user data, and the company confirmed four employees involved were fired.
In April 2023, the UK Information Commissioner's Office fined TikTok £12.7 million for breaches of UK data protection law, including allowing an estimated 1.4 million UK children under 13 to use the platform without parental consent.
In August 2024, the U.S. Department of Justice, on behalf of the FTC, sued TikTok, ByteDance, and affiliates alleging violations of COPPA and infringement of a 2019 FTC consent order.
A December 2022 internal ByteDance investigation, confirmed by the company, found that employees used TikTok user account data, including IP addresses, to attempt to determine journalists' physical proximity to ByteDance staff suspected of leaking information.