TikTok has agreed to pay $2 million to settle a Canadian class-action lawsuit, which alleged that the popular social media app had illegally collected and commercialized personal data from its users in the country. The agreement comes after the company settled a similar lawsuit in the U.S. for US$92 million last year.

The Canadian lawsuit, filed in December 2020, stemmed from two separate claims at the Supreme Court of British Columbia, one filed on behalf of a minor, which alleged TikTok had unlawfully harvested their private information.

“The defendants collected, used, retained, and commercialized the private information of underage users without obtaining parental consent of the underage users, and profited from it,” reads a court document filed in October 2021 on behalf of the plaintiffs.

In another court document filed in February 2021, TikTok denied all allegations and stated that its data collection in Canada was done “lawfully” and with users’ consent.

“There is no basis whatsoever for the plaintiff’s claims,” the document reads. 

The company also said that its Singapore-based TikTok Pte. Ltd. was the one providing services to Canada during the period covered by the claim. Therefore, it argued, Singapore’s law should have been considered to have jurisdiction over the use of the app and the company’s interactions with its users.

According to the amended terms of the settlement from December 2021, the $2 million, after the deduction of legal and other fees, will be donated to the Law Foundation of British Columbia, the Canadian Centre for Child Protection, Kids Help Phone and Boys & Girls Clubs of Canada. While an approval hearing was held late last month, a judge has yet to approve the deal.

TikTok declined to comment on the record to The Logic about the settlement. 

According to the terms of the settlement filed with the court, agreeing to the payout does not mean the company admits to any wrongdoing, and TikTok denies all allegations against it, its Singaporean division or its China-based parent company ByteDance.

The class action alleged that TikTok surreptitiously collected the MAC addresses of Android users for at least 18 months before Nov. 18, 2019, by exploiting a bug in the Google-owned Android mobile operating system and adding “an extra layer of data encryption” to conceal the violation.

A MAC address, or media access control address, is a series of 12 digits assigned to all internet- or Bluetooth-ready electronics, including mobile devices. Its collection is against Google’s policy. “Since at least 2015, both Google and Apple have banned the collection of MAC addresses by apps available on the Google Play Store and the iOS App Store, respectively,” the settlement agreement reads. 

The claim also highlighted the continuing effect of such collection as users typically cannot change the MAC address assigned to their device.

“Because a MAC address is both unique and unchanging, it can be used to track a user even if they opt out of data tracking, set the AndroidOS system settings to prevent apps from tracking them, reset their assigned unique advertising ID or delete an app and reinstall it later,” the settlement agreement reads. 

In an affidavit filed as part of the lawsuit, Konstantin Beznosov, a University of British Columbia computer-security professor, said that by December 2019, because many Android users weren’t using the most updated version of the software, it was possible for TikTok to collect MAC-address data from at least 89 per cent of Android smartphones in Canada. 

The Wall Street Journal broke the news of TikTok’s collection of users’ MAC addresses in the U.S. in August 2020. According to that report, the company collected the addresses for at least 15 months before it released an update in November 2019 that ended the practice, amid intense scrutiny from Washington over the ByteDance being headquartered in Beijing. 

ByteDance first launched its video-sharing platform in mainland China under the name Douyin in 2016, two years after a similar app that’s now its subsidiary, Musical.ly, was founded and gained popularity among U.S. teens. Later that year, encouraged by Douyin’s domestic success, ByteDance launched an overseas version under another name, TikTok. The next year, it acquired Musical.ly, at the time its main competitor, for an estimated US$1 billion, and later folded its users into TikTok’s platform. 

As TikTok became popular in North America, however, concerns over its security and data privacy also rose. In 2020, Wells Fargo asked employees to remove TikTok from their work phones, while Amazon sent a company-wide email (which it later retracted) asking employees to delete the app from certain devices.

Although TikTok has said it doesn’t share data with the Chinese government and wouldn’t do so if asked, it hasn’t satisfied all its skeptics. In 2020, the Indian government permanently banned TikTok and dozens of China-linked apps from operating in that country, citing security concerns. 

As U.S. president, Donald Trump demanded a full sale of TikTok to a U.S. owner, threatening to shut it down otherwise. That led to an agreement on a potential deal between Oracle, Walmart and ByteDance, which was abandoned after Trump’s November 2020 election loss to Joe Biden. However, the Trump administration’s efforts may have put pressure on the company to settle a class-action lawsuit in the U.S., where claims similar to those in the Canadian suit were brought in Illinois court. In that settlement, ByteDance agreed to pay US$92 million to its U.S. users. 

In an amendment to the Canadian class action, ByteDance was removed as a defendant. 

With files from Aleksandra Sagan in Vancouver