This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
ByteDance allegedly engaged in unauthorized scraping of user content from platforms like Instagram and Snapchat in 2017 to populate its app Flipagram and train its 'For You' recommendation algorithm. Former employees reported that this data was used to improve the algorithm's performance for US users. The practice resulted in user impersonation and privacy concerns, with ByteDance allegedly instructing staff to delete accounts only after receiving complaints from affected creators.
ByteDance allegedly scraped short-form videos, usernames, profile pictures, and descriptions of accounts on Instagram, Snapchat, and other sources, and uploaded them without consent on Flipagram, TikTok’s predecessor, in order to improve its “For You” algorithm's performance on American users.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to gain a personal advantage over others such as through cheating, fraud, scams, blackmail or targeted manipulation of beliefs or behavior. Examples include AI-facilitated plagiarism for research or education, impersonating a trusted or fake individual for illegitimate financial benefit, or creating humiliating or sexual imagery.
Also classified as
The creative video content of hundreds of thousands of users was duplicated without consent to build value for a competing platform.
ByteDance created fake accounts using scraped public profiles to impersonate real users on Flipagram for corporate growth and advantage.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident was caused by intentional decisions by ByteDance management and engineers to scrape competitor data as a growth hack for their active app.
Added categories peak at 2: Minor (Psychological Harm, Direct)
In 2017, ByteDance allegedly scraped data from hundreds of thousands of US social media users to train its recommendation algorithm and populate its app Flipagram. While primarily a corporate privacy and terms of service violation, the incident highlights strategic concerns regarding foreign entities harvesting domestic user data to train influential personalization algorithms.
The report focuses on the data scraping and training process of the 'For You' algorithm rather than describing its active runtime behavior or operational mode during the incident.
Minimal or No Risk: The 'For You' algorithm is a personalization and recommendation system used in social media entertainment, which poses low or negligible risk under the EU AI Act.
The 'For You' algorithm's primary function is to personalize and recommend content to users based on their preferences.
The reports are highly detailed and draw on multiple independent former employee sources and internal documents. ByteDance's official response is also included, providing a balanced view.
The incident could be interpreted primarily as a corporate data theft and growth hack campaign rather than an AI safety failure, though the training of the recommendation algorithm connects it to AI.
Technology
Algorithmic Training on Stolen Data
The For You algorithm was trained on unauthorized scraped US user data.
Automated Scraping Tools
Engineering team used automated crawlers to scrape over 10,000 videos daily.
Data Inputs
Unauthorized Data Scraping
Scraped videos and profiles from Instagram and Snapchat without consent.
Use of Fake Accounts
Uploaded scraped data via fake accounts to mimic real user engagement.
Human Factors
Creator Deception
Users were unaware their content was scraped and duplicated on Flipagram.
Employee Compliance
Engineers followed growth hack OKRs despite terms of service violations.
Process and Methods
Growth Hack Methodology
Prioritized rapid data acquisition and fake engagement metrics over ethics.
Watermark and Resizing Edits
Resized videos and removed watermarks to hide the source of scraped data.
Management
Growth Over Safety and Ethics
Management prioritized user growth and algorithm training over user privacy.
Unethical OKR Targets
Set engineering OKRs to scrape 10,000 videos daily from priority countries.
Deceptive Support Instructions
Instructed staff to hide scraping by blaming fans for unauthorized uploads.
Regulatory Environment
Weak Privacy Legislation
Lack of strong kids' privacy and safety laws allowed unchecked scraping.
Inadequate Platform Defenses
Target platforms had weak technical barriers to prevent bulk data scraping.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
