CapCut (ByteDance)

Rodriguez v. ByteDance alleges CapCut collected biometric identifiers - facial geometry and voiceprints - from users editing their own videos, without the informed written consent Illinois BIPA requires. The mechanism is the part worth understanding: features that make editing easy, like face detection for filters and auto-framing, are biometric processing by another name, and the user experiences them as convenience rather than collection. CapCut is also ByteDance-owned, the same parent as TikTok, so the jurisdictional analysis documented in the TikTok rows applies here too. Illinois BIPA is the only state biometric statute letting individuals sue without proving harm, which is why nearly every case in this category is filed there. Allegations, not findings.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-04

Primary source. None recorded — Unverified - heuristic first draft.

Arbitration

As a Chinese company (ByteDance), CapCut has a documented legal obligation under Chinese law to share data with the Chinese government upon request — the same structural finding as WeChat/TikTok elsewhere in this tracker.

Data sharing

MAJOR ACTIVE BIPA LITIGATION (Rodriguez v. ByteDance, N.D. Ill., filed July 2023): alleges CapCut (200+ million monthly users, owned by TikTok's parent ByteDance) collects users' FACIAL SCANS and VOICEPRINTS without consent — one plaintiff (then a 7th grader) used the app without ever setting up an account or seeing a privacy policy at all. The complaint cites a FORMER BYTEDANCE OFFICIAL who publicly stated the Chinese government can access data and monitor US operations from ByteDance's Beijing headquarters via a 'backdoor channel code.' A federal judge (Judge Georgia Alexakis, N.D. Ill., March 2025) allowed California privacy claims over CapCut's alleged collection of photos/videos, location and biometric data to PROCEED, while dismissing the federal claims and some state claims without prejudice, finding plaintiffs' detailed technical allegations — connecting ByteDance's computer-vision/neural-network engineering staff, voiceprint patent applications, and CapCut's actual functions — sufficiently specific to proceed; as of a Sept. 2, 2025 Bloomberg Law report ByteDance had moved to dismiss the amended complaint; no ruling on that motion or final resolution was located as of Oct. 16, 2026. SEPARATELY, after a June 12, 2025 terms update, critics reported that CapCut's Terms of Service grant a worldwide, royalty-free, sublicensable and perpetual license over user content, including users' 'voice, face, and likeness'; CapCut responded that the license section had not changed and that the grant is limited to what is 'necessary to provide the Service' (TechRadar, June 2025). Reported provisions linking CapCut data with TikTok data, and a reported formal warning from German privacy lawyers, were not verified.

Contacts

Privacy contact. Not recorded.

Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.

Mailing address. Not recorded.