A researcher who says they spent three weeks pulling data out of TikTok’s private Android app programming interface has published a dataset containing roughly 4.5 billion video records to Hugging Face, the popular hub where developers share AI training data. The collection, listed under the account name kuben-developer as “tiktok-videos-4b,” weighs in at close to 289 gigabytes and includes video metadata, engagement figures, and other details scraped without TikTok’s permission.
The dataset’s own README acknowledges the obvious problem: gathering this material required going around TikTok’s terms of service, which explicitly prohibit unauthorized scraping of the platform. The uploader added restrictions to the dataset card barring anyone from using it to identify, profile, or target individual users, though a text file asking people to behave responsibly does nothing to stop them from ignoring it once the download finishes.
A familiar problem for a platform already under scrutiny
TikTok has spent years fending off claims that its data practices, and its Chinese parent company ByteDance’s relationship with that data, pose a security risk to American users. This episode flips the script. Instead of a foreign company allegedly harvesting American data, an independent researcher exploited a hole in TikTok’s own private API meant only for its official app, then handed the results to anyone with a Hugging Face account and a fast internet connection.
Security researchers have flagged similar TikTok scraping projects on Hugging Face before, including collections branded under names like “Masa TikTok Scraper.” The scale here, billions of records rather than millions, is what has drawn fresh attention this week. TikTok has not issued a public statement addressing this specific dataset as of publication.
Why it matters beyond the tech crowd
Every major platform insists its private APIs are locked down tightly enough to keep user data out of unauthorized hands. This dataset is a reminder that determined scrapers keep finding cracks, and that once data like this lands on an open platform like Hugging Face, pulling it back is nearly impossible. Anyone who has ever posted a video on TikTok, thinking only friends or followers would see the engagement numbers attached to it, is now part of a public research dataset they never agreed to join.
Hugging Face’s own policies bar hosting data obtained through unauthorized access, which raises the question of how long a dataset this explicit about violating TikTok’s terms will stay live. For now it remains publicly listed, downloadable by anyone.
