DPIA

The wait is over
Ailance™ DPIA is here!

CapCut trouble over new "Terms of Service": legal risks lurk here

The popular video editing app CapCut from ByteDance, which also owns TikTok, updated its terms of use on June 12, 2025.
Categories:

The popular video editing app CapCut from the company ByteDance, which also owns TikTok, updated its terms of use on June 12, 2025. These now provide for a comprehensive transfer of rights, which has led to ongoing criticism from lawyers and the public. We shed light on the associated legal risks for those responsible.

The new CapCut terms of use at a glance

CapCut has comprehensively revised its Terms of Service with effect from June 12, 2025 and has now granted itself extensive rights to all content uploaded by users. The so-called "Terms of Service" include in particular a perpetual, worldwide, royalty-free, irrevocable license to use, edit, distribute, make publicly available and exploit this content. This provision applies regardless of whether the content has been published or is merely stored within the app.

It is particularly critical that CapCut grants itself the right to use biometric features, in particular facial recognition and voice patterns, for any commercial purpose. This includes, for example, use in advertising or algorithmic recommendation mechanisms without the need to obtain separate consent.

Another problem is the so-called persistence clause. Even if an account is deleted, the rights of use previously granted remain in place. Users can therefore permanently lose control over their content without being able to subsequently restrict or revoke these rights.

In addition, the GTC reserve the right to link all content and associated metadata with other offers of the parent company ByteDance, in particular TikTok. It is intended that personal data from various applications may be merged and automatically analyzed. This linking could constitute an infringement of informational self-determination and give rise to further risks with regard to profiling, automated decisions and international data flows.

The overall structure of the new terms of use creates a risky framework, especially for users from the EU whose data is protected by the GDPR. In the next section, these aspects are assessed in detail from a legal perspective.

Data protection assessment of the CapCut T&Cs

  1. Lawfulness of the processing (Art. 6 GDPR)
    The processing of personal data by CapCut requires a sound legal basis. Blanket consent to the terms of use may not meet the requirements for informed consent in accordance with Art. 7 GDPR. In particular, if users are inadequately informed about the scope, recipients and risks.

  2. Violation of the principle of purpose limitation (Art. 5 para. 1 lit. b GDPR)
    The unrestricted further use of content, including for third parties and advertising purposes, could contradict the purpose limitation. This is because subsequent use outside of the original processing intention is not covered unless clear consent has been given.

  3. Profiling and automated decision-making (Art. 22 GDPR)
    The possibility of linking with other ByteDance products could imply a high degree of profiling. Especially for users who also use TikTok or similar platforms. Without specific information and the option to object, there could be a violation of Art. 22 GDPR.

  4. Transparency obligations (Art. 13/14 GDPR)
    The information provided by CapCut on data processing may not meet the requirements of Articles 13 and 14 GDPR. Clear information on recipients, third country transfers and storage duration is required.

  5. Right to erasure (Art. 17 GDPR)
    The clause that allows CapCut to continue using content even after the user account has been deleted could conflict with the right to erasure enshrined in Art. 17 GDPR, unless a statutory retention obligation or a legitimate interest can be demonstrated.

  6. Data protection impact assessment (Art. 35 GDPR)
    In cases where CapCut is systematically used in a corporate context (e.g. for social media marketing, video communication or e-learning), a data protection impact assessment (DPIA) may be required. This applies in particular to the extensive processing of image and sound recordings in connection with biometric data.

Risks for organizations and companies

CapCut could not only pose a risk for individual users, but could also pose a potential threat to organizations, companies and public and educational institutions under data protection law. The implications of its use affect both internal processing and external communication measures, for example as part of marketing campaigns or digital educational content.

Use in the corporate environment

The use of CapCut in a corporate context, for example for the production of employer branding videos, social media clips or internal tutorials, could have legal consequences. The inclusion of employee data is particularly critical, especially if employees are filmed or their voices are recorded.

  • There is a risk of unauthorized transfer of personal datain particular pursuant to Art. 88 GDPR in conjunction with. § Section 26 BDSG for employee data.
  • Automated analysis and profiling by ByteDance can lead to company content appearing in completely different contexts, which is particularly problematic in the area of reputation control.
  • Since CapCut does not provide a contractual basis in the sense of an order processing contract (Art. 28 GDPR), the responsibility lies entirely with the company.
  • Even after the app or account has been deleted, content and personal data remain within the provider's sphere of influence. A clear loss of control for data controllers.

School & Education

CapCut is often used in educational contexts due to its ease of use and creative design options. However, it is often overlooked that personal data is regularly processed when used by students, sometimes including special categories such as biometric features (e.g. facial images).

  • Teachers and institutions that recommend or prescribe CapCut expose themselves to a considerable liability risk.
  • Educational content created and stored via CapCut could be analyzed by ByteDance and used for its own purposes without the educational institutions being able to prevent or control this.


Reading tip: TikTok must pay 530 million euros in fines - due to data transfer to China

Copyright assessment of the CapCut terms of use

In addition to data protection risks, CapCut's terms of use also entail copyright risks, which become particularly relevant if copyright-protected content is processed, stored or distributed via the platform.

CapCut's General Terms and Conditions provide for comprehensive licensing of user content to ByteDance. This applies to the rights of reproduction, distribution, publication and editing. No distinction is made between private and professional content or between copyright-relevant and purely personal contributions. This is particularly problematic for the following reasons:

  • Loss of exclusivity: The granting of rights is non-exclusive, but potentially unlimited and irrevocable. This may be contrary to the economic interests of the author, particularly in the case of commercial re-use by ByteDance.
  • Editing rights: The GTC contain a consent to editing, which can lead to distortion within the meaning of Section 14 UrhG in the case of creative services (e.g. music, graphics, video editing).
  • Lack of restriction to own content: The terms of use do not require confirmation that the uploader is also the rights holder or has the corresponding rights of use. This poses liability risks for third-party content.


The copyright clauses in the CapCut T&Cs lead to an extensive loss of control over creative content. Users and institutions using CapCut must be aware of the economic and legal consequences. Use is therefore only justifiable if only own, freely usable content is processed and economic or exclusive claims to use are waived.

What CapCut says about the new terms of use

CapCut has responded to the ongoing criticism in a blog post: "In the course of the update, there has been some confusion about the pre-existing legal wording in our Terms of Service regarding user-generated content. Some people are concerned that this gives CapCut broad rights to use or monetize your content or likeness without your consent. This is not the case...".

The provider tries to explain the changes as follows:

  • CapCut requires permission to "save, format and display" content on the platform, to allow other community members to "adapt, modify" or create "derivative works" of shared templates, and to "transfer or distribute" content by downloading or sharing.
  • Terms such as "irrevocable" and "unlimited" are used because once content (e.g. templates) is shared and used by others, we cannot undo every single reuse or recombination on the platform or the internet. This should help to ensure that the platform functions consistently.

Legal review of the CapCut T&Cs

However, leading data protection experts see things differently. "Anyone who edits videos with the TikTok software Capcut loses rights and risks liability," explains lawyer Chan-jo Jun. His law firm has already issued a warning to the CapCut provider Bytedance. "The wording is very far-reaching," says Jun. Bytedance should therefore make a legally binding declaration that they have not had these far-reaching terms of use granted to them and are not claiming any rights of use that go beyond what is absolutely necessary for use.

In any case, it would be desirable for CapCut to update the terms of use once again and clarify any ambiguities.

Source: CapCut, Terms of Service, Last updated: June 12, 2025

Tags:
Share this post :
en_USEnglish