A California student has filed a class-action lawsuit against TikTock, the wildly popular social media app from China. According to a report in the Daily Beast, the suit alleges that TikTok uploads data without user consent—in some cases without a user even creating an account.

Misty Hong, a student at Palo Alto, claims she downloaded the app but never got around to setting up an account. According to the suit, TikTok created an account using her phone number, and began analyzing videos she took but never uploaded. These videos included a facial scan.

“The app, she alleges, transferred all of her information to servers owned and operated by companies that cooperate with the Chinese government. She’s filed the lawsuit on behalf of all U.S. residents who have downloaded TikTok, roughly 110 million people.”

The suit also alleges the app secretly gathers “users’ locations, ages, private messages, phone numbers, contacts, genders, browsing histories, cell-phone serial numbers, and IP addresses. That data was allegedly then sent to Chinese servers.”

TikTok’s executives have tried to reassure the American public that their data is stored in Virginia, with a backup in Singapore. In a recent New York Times profile, they tried to reassure American users that their data cannot be accessed by Chinese officials. Nonetheless, previous user agreements did stipulate that data could be sent to China. The suit is alleging that practice has continued despite changes to the agreement saying it won’t.

Convincing users of its independence is a tall order, given that Chinese corporations are required to cooperate with Chinese intelligence when requested. This is partly what has led to Huawei being blacklisted in the U.S. and under scrutiny in many countries around the world.

U.S. senators have already warned of the threat to national security TikTok may pose, should it be sending data back to China. This lawsuit will only add to those concerns and could result in punitive measures taken against ByteDance, the company that owns TikTok.

In the meantime, given China’s poor history of respecting individual privacy—including, but not limited to China now requiring facial recognition scans to open a wireless account—this news should come as a surprise to exactly no one.