TikTok faces advanced, 'mature' nationwide probe by dozens of US state attorneys general

A nationwide group of dozens of state attorneys general from Maine to Hawaii have been probing TikTok's personal data practices and whether the hugely popular social media platform has violated state consumer protection laws that prohibit deceptive, unfair or "unconscionable" business conduct by designing AI algorithms to keep young users on the platform. The advanced probe may present more significant legal risk for TikTok than a federal probe based on a federal children's privacy law that was revealed this week.

Keep scrolling for the story, or start your 14-day free trial now for full access to MLex news and analysis on data privacy, cybersecurity and technology regulation around the world.

29 March 2024
By Mike Swift

TikTok faces an advanced, nationwide investigation by dozens of US states that may present more significant legal risk for the social media app than a federal probe revealed this week, as the states weigh evidence gathered during two years of digging that they say shows TikTok may have violated consumer protection laws.

The “very active” investigation — led by the attorneys general of California, Tennessee, New York and Colorado, according to people familiar with the probe — was announced by California Attorney General Rob Bonta and other state attorneys general in early 2022. The multistate TikTok probe has progressed steadily, mostly hidden from public view, since then.

Bonta told MLex this week that the states plan to get “much-needed answers” from TikTok as part of an investigation his office calls “mature” that will determine whether the company broke the law.

"Giant social media companies have proven that, when left to their own devices, they will sell our data without our consent, exploit our children, and put profits over the health and wellbeing of young users,” Bonta said. “It is clear that government has to get involved, at the state and hopefully federal level, to protect our children and future generations.”

Unlike a TikTok investigation by the US Federal Trade Commission reported this week that focuses on a federal children’s privacy law, the states’ probe is additionally focused on whether TikTok violated state laws that prohibit business conduct deemed by a court to be “deceptive,” “unfair” or “unconscionable” — a wider spectrum of illegal practices than those under Section 5 of the FTC Act.

“The multistate group has good reason to believe that TikTok is violating state consumer protection laws in ways that have fueled the ongoing crisis in the mental health of children and teens,” a group of 45 states and the District of Columbia said in a court filing in a Tennessee court last March, one year into the TikTok probe.
 
The states also have authority to enforce the Children’s Online Privacy Protection Act, COPPA, the federal law central to the FTC’s probe, as 33 states did in filing a multistate suit against Meta Platforms in October. That suit also accuses Meta of “unfair and/or unconscionable acts and practices” in violation of the consumer protection laws of a long list of states, including knowingly designing its social media platforms to “be psychologically and physically harmful to young users.”

TikTok, which says it has about 170 million US users, could face similar claims. Eight states – Tennessee, Kentucky, Massachusetts, California, Vermont, Nebraska, New Jersey, and Florida – served TikTok with investigative subpoenas under their own state laws into whether the company and its ByteDance parent violated so-called UDAP laws, court filings show. Those laws carry financial penalties that typically range between $2,500 and $25,000 per violation for unfair, deceptive or abusive practices.

Beyond the leader states and those that served TikTok with investigative subpoenas, many other states are contributing legal resources to the multistate probe, even as states such as Tennessee that served the subpoenas on TikTok are sharing the company’s responses with other states in the probe. The multistate group “has invested substantial resources into the TikTok investigation,” the 45 states told a Tennessee judge in a filing by Colorado Attorney General Phil Weiser and the other states last year.

The 45 states that signed onto the amicus filing supporting Tennessee’s motion for access to TikTok evidence were Alabama, Alaska, Arizona, Arkansas, California, Colorado, Connecticut, Delaware, Florida, Georgia, Hawaii, Idaho, Illinois, Indiana, Iowa, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Montana, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, New York, North Carolina, North Dakota, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, South Dakota, Texas, Utah, Vermont, Virginia, Wisconsin and Wyoming — as well as the District of Columbia.

That list is a strikingly bipartisan collection ranging from some of the most liberal to some of most conservative state attorneys general, although the filing warned that states signing on to the friend-of-the-court brief in support of Tennessee does not necessarily confirm they also joined the TikTok investigation.

TikTok did not respond to a request for comment on the states’ investigation.

Discovery issues

The states have not been satisfied with TikTok’s cooperation with their investigation.

In a filing by Colorado and the other states last year, the attorneys general told a judge in Nashville that “TikTok has failed to respond adequately and appropriately to the States' reasonable requests for information made pursuant to the multistate investigation, withholding and obscuring information that is crucial to the States' understanding of the conduct at issue, and impeding the States' ability to protect their citizens.”

Tennessee Attorney General Jonathan Skrmetti told MLex in an interview last fall that there could be “significant consequences” if TikTok continued to fail to cooperate with a bipartisan probe where virtually every US state attorney general is either participating in or supporting the regulatory inquiry.

One key issue has been whether TikTok deleted key communications through its internal chat system, called Lark, to hide them from investigators. Last month, Judge Patricia Moskal in the Chancery Court of Davidson County, Tennessee, sided with the states in that dispute, granting their motion to compel TikTok to produce a new corporate witness about the company’s data-retention polices after TikTok’s previous witness, Warren Solow, couldn’t answer the states’ questions.

“When asked to describe TikTok’s processes of data governance, Mr. Solow replied based on his ‘personal perspective’ that they were ‘works in progress',” Moskal wrote in her Feb. 5 order, quoting from Solow’s sworn deposition, which is not public.

An in-house TikTok lawyer, Solow testified that he did not know whether TikTok had a chief compliance officer, that TikTok lacked a comprehensive data retention policy, and that prior to May 2023, TikTok was not preserving the metadata for Lark chats, which might reveal who sent or deleted internal messages.

“Mr. Solow described Lark secure chats as ‘ephemeral messaging’ that allows for a ‘life cycle’ setting, such as an hour, a day, or a week. He did not know whether creators of Lark chat-threads can delete the threads where they are subject to legal holds,” Moskal wrote in the order, explaining why Solow wasn't properly prepared to answer the states' questions.

The states noted in last year’s court filing that TikTok could face additional penalties under the laws of multiple states if it conceals, destroys or withholds subpoenaed information.

Spokespersons for attorneys general in Colorado and Tennessee declined to comment.

—With reporting by Amy Miller in San Francisco.

For access to breaking news and predictive analysis from MLex on data privacy, cybersecurity, technology regulation and more, start your free trial today.