A 4.5 Billion-Row TikTok Dataset Landed on Hugging Face
An independent researcher has uploaded a 4.5 billion-row TikTok dataset to Hugging Face: 289 GB of captions, engagement counts, and metadata collected through the Android app's private API over about three weeks. The card declares the data personal under GDPR and CCPA and forbids identifying individuals, while the collection itself was contrary to TikTok's terms of service.
On this page
What is in the dataset
A Hugging Face account named kuben-developer published a dataset containing 4,501,811,789 rows, one per TikTok video, as 27 zstd-compressed Parquet files totalling about 289 GB [1]. Each row carries the content ID, creation timestamp, caption, mentions, duration, music identifiers, and engagement counts for views, likes, comments, shares, and saves, plus country, language, and advertising flags [1].
Two absences are notable given the scale. The card states the dataset contains no creator or author identity fields and no media URLs, so it is engagement and caption metadata rather than a library of videos or a directory of people [1].
How it was collected, by the researcher's own account
The collection method is described on the dataset card: requests signed through the private HTTP API that TikTok's Android app uses, made from anonymous device registrations with no login involved, sustained for roughly three weeks [1]. Engagement counts are point-in-time snapshots rather than a time series, and the card warns that country and language labels are TikTok's own inferences [1].
The researcher went further on Reddit, posting a step-by-step account that claims 5.94 billion videos and 3.23 billion profiles were scraped in total, with the Hugging Face upload described as the free public portion [2]. Industry newsletter AI Weekly picked up the release on September 3 [3].
The card's own warnings
The dataset card is unusually blunt about legality. It states "this dataset is personal data under GDPR, the UK GDPR and CCPA", forbids using it to identify, profile, target, or contact individuals, and offers a row-removal process through repository discussions [1]. It also acknowledges that "collection was contrary to TikTok's terms of service", releases the data for research and educational use only, and cautions that rows are grouped by creator and should be shuffled before training [1].
That combination is worth pausing on: an uploader declaring a 289 GB corpus to be personal data under European and California law, hosting it publicly, and building an erasure request process in a repository discussion thread is not a situation with clear precedent [1].
What it means for privacy-minded users
The practical lessons run in three directions. Creators should assume that anything public on a major platform can be copied at API scale within weeks, without login walls stopping it. Builders should treat dataset provenance as a training-input question: a model fine-tuned on this corpus inherits a tos-violation and personal-data history that no license tag washes away [1]. And regulators get a live test of whether GDPR erasure rights can operate against distributed copies of a public dataset [1]. Locally run AI offers no protection from scraping like this, but it does mean the data you generate for your own work never has to join anyone else's corpus [1].