TikTok Data Scrape: 4.5 Billion Videos Pulled From a Private API (2026)

A TikTok data scrape now sitting on Hugging Face contains metadata on 4,501,811,789 videos, pulled over roughly three weeks through the private API TikTok’s own Android app uses. No usernames. No video files. Just captions, sounds, engagement counts and timestamps, at a scale nobody has published in the open before. The person who built it also sells the method for $699.

• What it is: this TikTok data scrape is a 289 GB dataset, 4,501,811,789 rows, published September 3, 2026 by a Hugging Face user going by kuben-developer, covering captions, engagement metrics, sound IDs, country/language codes and posting times for 4.5 billion TikTok videos
• How it was collected: TikTok’s private HTTP API used by the Android app, accessed through anonymous, signed device registrations, no login or account required, over roughly three weeks
• What’s explicitly not in it: no creator usernames or profile data, no media URLs, no video files, by the uploader’s own design
• The twist: the same person who published the dataset runs a commercial site selling the underlying scraping code for $699 and a managed version for $1,899, a detail Hacker News commenters flagged as likely marketing

What This TikTok Data Scrape Actually Collected

This TikTok data scrape lives at huggingface.co/datasets/kuben-developer/tiktok-videos-4b, uploaded under the account kuben-developer. Its own card lists 4,501,811,789 rows across 27 Parquet files, zstd-compressed, totaling 289 GB, an average of roughly 167 million video records and 10 GB per file.

AI Weekly also reported on the dataset the same day, describing the same scrape method and record count. That coverage frames the uploader as an “independent researcher,” the same framing the dataset’s own card uses. It’s a fair starting point, but it’s not the full picture, as the next section covers.

Each row carries a fixed set of fields: a content ID, a creation timestamp, the video’s caption text, any tagged-account mentions, duration, whether it’s a video post, a music/sound ID and title, view/like/comment/share/save counts, a country and language code, and a flag for whether the post is sponsored content.

Do the math on the file size and it checks out as pure metadata, not video content: 289 GB spread across 4.5 billion rows works out to roughly 64 bytes per row once compressed, enough for a caption snippet and a handful of numbers, nowhere near enough to hold an actual video frame. That arithmetic is one of the things that convinced skeptical commenters on Hacker News the dataset is what it claims to be, not an inflated or fabricated number.

How the Scrape Got Past TikTok’s Defenses

This TikTok data scrape didn’t touch TikTok’s public website or its documented developer API. It went through the private HTTP API the Android app itself calls, the same traffic your phone generates every time you open TikTok, reverse-engineered and replayed at scale.

The technique behind this TikTok data scrape is documented in detail on a companion site, tiktok-api.seeksocial.io, run by the same kuben-developer account. Getting a request accepted requires registering an anonymous device credential with TikTok, no login or account needed, then signing every request with the correct cryptographic implementation (the writeup names Simon, Speck and SM3 ciphers), routing it through the right regional host, and presenting a TLS handshake that looks like it came from a real phone rather than a script.

The writeup is blunt about how unforgiving that is: “four completely unrelated things have to be right at once,” and getting any one of them wrong doesn’t throw a helpful error, it returns “a clean HTTP 200 with an empty body,” a response that looks successful while silently containing nothing. That failure mode is itself notable. A system that fails silent rather than loud is harder to debug if you’re building against it, but it’s also harder to distinguish from legitimate traffic if you’re the one trying to detect and block it from the other side.

Whoever ran this TikTok data scrape kept it running long enough to pull 4.5 billion records, over what the dataset card describes only as “approximately three weeks,” without triggering whatever TikTok uses to shut down anomalous scraping activity at that volume, or at least not before the run finished and the data went up publicly.

What’s Inside, and What Was Deliberately Left Out

It’s worth being precise here, because the easy version of this story is the wrong one. This TikTok data scrape is not a leak of TikTok users’ personal information, and treating it as one overstates what actually happened.

The dataset card is explicit about two exclusions by design: no creator usernames, profile data or author IDs of any kind, and no media URLs, since those carry time-limited signed parameters that would expire anyway. There is no way to look up a row in this dataset and land on a specific person’s TikTok profile. You can’t watch the videos from the data alone. That’s a real, meaningful limit on what this scrape actually exposes, and it’s the reason a “personal information breach” framing doesn’t hold up against the primary source.

What is in the data is still substantial: nearly every caption written across a huge cross-section of TikTok during the collection window, tied to real engagement numbers, real sound IDs, and real country and language codes, at a scale (4.5 billion rows) that makes this TikTok data scrape dwarf prior public TikTok research datasets, most of which top out in the tens of millions of rows.

The Same Person Selling You the Method

Here’s the detail that changes how this TikTok data scrape should actually be read: kuben-developer isn’t a disinterested academic who stumbled onto an API gap. The same account runs a commercial storefront at tiktok-api.seeksocial.io selling the exact access method used to build this dataset.

The pricing is public. Full source code access, described as covering “all 24 endpoints” of the private API, sells for $699 as a one-time purchase. A “done-for-you” version, a full collection pipeline built on the buyer’s own infrastructure including a ClickHouse database, sharding and a week of support, runs $1,899. A rotating proxy gateway needed to actually run either at scale is a further $150 to $950 a month, billed separately.

This TikTok data scrape reads, in that context, as a proof of capability attached to a product page, not an independent security disclosure. That’s precisely what a cluster of commenters on the story’s Hacker News discussion thread (45 points, 55 comments, as of this writing) called out directly. One commenter, posting as 405error, dismissed parts of the technical writeup as likely “AI coded and hallucinated,” questioning how much of the surrounding narrative was written to sound impressive rather than to be strictly accurate. Others in the thread noted the pattern common to security-adjacent marketing: publish something large and alarming-sounding for free, sell the tool that makes it possible right next to it.

None of that makes this TikTok data scrape fake. The Hugging Face dataset is real, downloadable, and internally consistent with what the technical writeup describes. But a reader deciding how much weight to put on this as a story about TikTok’s security posture, versus a story about a scraping vendor’s promotional strategy, should know both things are true at once.

Why “No Usernames” Doesn’t Mean No Risk

This TikTok data scrape’s own documentation raises a legal flag its creator didn’t have to include, and did anyway. Directly from the card: “Captions are written by real people and this dataset is personal data under GDPR, the UK GDPR and CCPA regardless of the fact that it was publicly posted.” That’s the uploader acknowledging, in writing, that stripping out usernames doesn’t fully strip out the privacy exposure, because caption text itself, at 4.5 billion rows of it, is still personal data under EU and California law.

The card pairs that admission with an explicit restriction: “Do not use this to identify, profile, target or contact individuals.” It’s licensed as “research-use” and the description states it was “released for research and educational use.” Those are conditions attached to a voluntary license, though, not a technical control. Nothing in a Parquet file enforces how a downloader actually uses it once it’s downloaded.

The realistic risk here isn’t that someone opens this dataset and instantly identifies a specific TikTok user. It’s re-identification through correlation: a caption with a distinctive phrase, a precise timestamp, an engagement count, cross-referenced against a video a researcher or bad actor already has other context on, could narrow things down for a small number of posts even without a username attached. That’s a real, if narrower, risk than a straightforward identity leak, and the dataset’s own card effectively concedes the point rather than denying it.

This isn’t a new problem specific to TikTok. It’s the same reason regulators have spent years pushing back on the idea that removing a name field is sufficient anonymization on its own, the underlying issue behind TikTok’s own $400 million children’s privacy settlement earlier this year, even though that case involved a different mechanism entirely.

What This TikTok Data Scrape Says About Platform Security

TikTok has publicly described what it does to stop exactly the kind of activity behind this TikTok data scrape. Its own privacy center post on combating unauthorized scraping says the platform “monitors user devices, networks, and interactions to detect suspicious activity that may indicate bot activity,” and separately “uses rate limiting mechanisms and other detection tools.” It deploys CAPTCHA challenges to distinguish human activity from automated requests. The post adds a candid caveat: “To avoid revealing our tactics, we can’t disclose all the measures we use to detect and prevent unauthorized data scraping.”

Whatever those undisclosed measures are, this TikTok data scrape ran large enough to produce 4.5 billion rows over roughly three weeks, using anonymous device registrations against the private mobile API rather than the public web, and either wasn’t caught in time to stop it, or was caught and not stopped for some other reason not stated anywhere in the public record. Either read points to the same underlying fact: a real gap existed between what TikTok says it monitors for and what one operator was able to sustain at scale.

This connects to a broader pattern this site has covered before with TikTok’s evolving trust and security posture this year: ownership questions get resolved through legal restructuring, national-security reviews clear formal thresholds, and yet the more mundane, unglamorous question of whether the platform’s own API can be quietly exploited at industrial scale is a separate problem that doesn’t get fixed by any of that. A joint venture’s ownership percentages don’t patch a signing-oracle weakness in a mobile API. Those are different layers of the same company’s risk surface, and this scrape is evidence the second one has real, demonstrated gaps regardless of how the first one gets resolved.

It’s also worth noting what didn’t happen, at least not publicly and not yet as of this writing: no statement from TikTok specifically addressing this dataset, no confirmation or denial of the collection method, and no sign the Hugging Face listing has been taken down. Three weeks of high-volume anonymous scraping being followed by a public dataset staying up, unaddressed, is itself part of the story.

Quick answers

Does this TikTok data scrape expose my personal information? No, not directly. The dataset explicitly excludes usernames, profile data and media URLs. It contains caption text, engagement numbers, sound IDs and timestamps, not identity information tied to a specific account.

Is this a TikTok data breach? No. A breach implies TikTok’s own systems or protected user accounts were compromised. This was collection through TikTok’s own private mobile API using anonymous, unauthenticated device registrations, no account access or credential theft involved, though the dataset’s own creator acknowledges the collection itself violated TikTok’s Terms of Service.

Who created this TikTok data scrape, and can they be trusted? A Hugging Face user going by kuben-developer, who also runs a commercial site selling the underlying scraping method for $699 to $1,899. That commercial relationship doesn’t make the dataset fake, the file is real and internally consistent, but it’s a relevant conflict of interest worth knowing before treating the publication as purely a public-interest disclosure.

Is a TikTok data scrape like this one actually legal? It violates TikTok’s Terms of Service by the uploader’s own admission. Whether it violates a law like the U.S. Computer Fraud and Abuse Act is a genuinely unsettled question; courts including the Ninth Circuit in hiQ Labs v. LinkedIn have found scraping publicly viewable data isn’t automatically a CFAA violation, but that case law is specific to certain fact patterns and hasn’t been tested against a private, signed mobile API like this one.

What should I actually take away from this TikTok data scrape? Not that your personal TikTok data leaked. That a private API handling billions of requests can apparently be scraped at massive scale by one operator over three weeks without a public enforcement response, and that “anonymized” public data still carries real privacy law implications once it’s aggregated and republished at this size.