The U.S. Department of Justice announced on Friday that ByteDance-owned TikTok has agreed to pay $400 million to settle a 2024 federal lawsuit accusing the company of systematically violating U.S. child privacy laws. The settlement is one of the largest consumer privacy penalties ever imposed on a social media platform.
Terms of the Settlement
Under the agreement:
- $300 million is due immediately upon court approval
- $100 million is deferred, contingent on TikTok's compliance with the settlement's conduct requirements over a specified monitoring period
- TikTok must implement enhanced privacy controls for users under 13 and strengthened protections for teenagers aged 13–17
- An independent third-party monitor will audit TikTok's data handling practices for a defined period
The settlement resolves allegations first raised in a 2024 DOJ complaint that accused TikTok of collecting personal data from children under 13 without verifiable parental consent — a direct violation of the Children's Online Privacy Protection Act (COPPA) — and of knowingly allowing underage users to bypass age verification to create accounts.
What the Lawsuit Alleged
The 2024 complaint, filed in coordination with the Federal Trade Commission, alleged that TikTok:
- Collected precise geolocation data, device identifiers, and biometric information from minors without parental consent
- Maintained millions of child accounts in its system after users self-reported being under 13, rather than deleting them
- Used dark patterns that made it difficult for parents to identify or delete their children's accounts
- Failed to enforce its own age gate, allowing users who provided false birth dates to continue using the platform without review
The DOJ also cited TikTok's "Kids Mode" implementation as inadequate — regulators argued the feature was easily bypassed and did not prevent data collection from verified underage users.
TikTok's Position
TikTok did not admit wrongdoing as part of the settlement. In a statement, the company said it has invested heavily in safety features since the original complaint and described the agreement as an opportunity to "move forward and continue improving protections for younger users." ByteDance has historically pushed back against U.S. regulatory actions, but agreed to negotiate a settlement rather than face a protracted trial.
Broader Regulatory Context
The settlement follows a wave of child privacy enforcement actions against major platforms:
| Platform | Year | Amount | Basis |
|---|---|---|---|
| YouTube (Google) | 2019 | $170M | COPPA |
| Facebook (Meta) | 2023 | $5B | FTC consent decree (broader) |
| Epic Games | 2022 | $520M | COPPA + dark patterns |
| TikTok | 2026 | $400M | COPPA |
COPPA carries penalties of up to $51,744 per violation per day. With millions of affected child accounts, the $400M figure — while record-setting for a standalone COPPA case — may reflect negotiated leniency in exchange for the compliance commitments.
What This Means for the Industry
The settlement sends a clear signal that federal regulators are willing to pursue nine-figure penalties against large platforms for COPPA violations, even when those platforms have significant political complexity (TikTok's ownership by ByteDance has been the subject of national security debates separately from this privacy action).
For security and privacy professionals, the case reinforces several key obligations for platforms with younger audiences:
- Verifiable parental consent mechanisms must be robust — self-certification is insufficient
- Data minimization for minors is not optional — regulators will examine every data type collected
- Age verification systems must actually function; dark patterns that help users lie about their age create significant liability
- Account deletion processes must be immediate and complete when a minor is identified
What Comes Next
Following court approval of the settlement, TikTok will be subject to:
- Mandatory implementation of enhanced parental controls and verification
- Periodic compliance reports submitted to regulators
- Third-party audits assessing data handling practices for minors
- Risk of the deferred $100M payment accelerating if compliance requirements are not met
For U.S. app developers and platform operators, the TikTok settlement underscores that COPPA enforcement is active and that scale is not a shield from accountability.