WebMD Uses TikTok Software to Sell Identifying User Data to 'Highest Bidder': Class Action

Plaintiff Brittney Ramirez, a California resident, alleges WebMD is “part of a media conglomerate that makes money by selling ads, including from ‘pharmaceutical, biotechnology and medical device companies,’” and makes money, in part, “by identifying users, so that symptoms (and the sick) can be coupled, commoditized and sold to the highest bidder.”

A large part of WebMD’s business is based on obtaining, collecting, and organizing “large pools of data from website visitors without their knowledge or consent,” and to accomplish this, it partnered with TikTok, alleged the complaint. The TikTok software WebMD installs on its website uses “fingerprinting” to collect “as much data as it can about an otherwise anonymous visitor” and matches it with “existing data TikTok has acquired and accumulated about hundreds of millions of Americans,” it said.

TikTok’s software gathers device, browser and geographic information and performs referral and URL tracking by running code on WebMD’s website to send user details to TikTok, the complaint alleged. The TikTok software also “requests, validates, and transmits other identifying information,” including phone number and email address, it said.

WebMD runs TikTok’s “AutoAdvanced Matching” feature that scans a website for recognizable form fields containing customer information, such as email addresses and phone numbers “before reaching TikTok servers for matching,” said the complaint. TikTok entities such as WebMD that run the matching feature “capture the email and phone number as early as possible” and “as frequently as possible,” it said.

The software is deployed automatically when a user enters the WebMD website so “there is no way for website visitors to be informed (let alone consent) to the tracking of their web activity by TikTok,” alleged the complaint. The software also sends to TikTok “impulses about virtually every page on WebMD, no matter how private the information is, and no matter the danger that data sharing could impose on a web user, who has no idea personal information is being compromised," it alleged.

WebMD “doesn’t care what it shares or who it shares it with, as long as it can be monetized,” the complaint alleged. All the data captured by the TikTok software is sent to TikTok’s servers so that the social media platform “can reconstruct the user’s identity,” it said. WebMD can use some of the data to serve pharmaceutical and medical device companies, but TikTok can use the data it collects “for any purpose it wants, including 'surveillance and information operations’ designed to 'ensure the [People’s Republic of China’s] desired end state,’” it said.

Ramirez asserts that the TikTok software is a “trap and trace device” as defined by the California Penal Code since it “captures the incoming electronic or other impulses that identify the originating number or other dialing, routing, addressing, or signaling information reasonably likely to identify the source of a wire or electronic communication, but not the contents of a communication.” The software captures incoming electronic impulses and addressing information generated by users, “who are never informed that the website is installing software to obtain their phone number and other identifying information,” it said.

TikTok is “reasonably likely” to identify the source of incoming electronic impulses and “is designed to meet this objective,” alleged the complaint. WebMD didn’t secure Ramirez or class members’ express or implied consent “to be subjected to data sharing with TikTok for the purposes of fingerprinting and de-anonymization,” it said.

Ramirez claims violations of California’s Trap and Trace Law and seeks an order enjoining WebMD from using the trap and trace process without proper consent, plus disgorgement of data acquired through TikTok software. She also seeks statutory and punitive damages, attorneys’ fees and legal costs.