The U.S. Department of Justice has announced a landmark $400 million settlement with TikTok, its parent company ByteDance, and affiliated entities over alleged violations of the Children's Online Privacy Protection Act (COPPA). The settlement represents the largest COPPA penalty in U.S. history and underscores the federal government's intensifying enforcement stance on platforms that collect data from children under 13.
What Happened
Federal prosecutors alleged that TikTok and ByteDance collected, retained, and used personal data from children under the age of 13 without obtaining verifiable parental consent — a direct violation of COPPA's core requirements. The complaint cited systemic failures in age verification mechanisms and the deliberate retention of children's data for purposes including behavioral profiling and targeted content delivery.
The DOJ's case built on earlier regulatory actions, including the Federal Trade Commission's $5.7 million settlement with TikTok (then Musical.ly) in 2019 — itself a record at the time. Despite that earlier enforcement action, federal authorities alleged that TikTok's privacy practices continued to fall short of legal requirements as the platform scaled to hundreds of millions of U.S. users.
Scale and Significance
At $400 million, the settlement dwarfs previous COPPA penalties by an order of magnitude. For context:
| Company | Fine | Year | Regulator |
|---|---|---|---|
| TikTok/ByteDance | $400 million | 2026 | DOJ |
| YouTube/Google | $170 million | 2019 | FTC/NY AG |
| TikTok (Musical.ly) | $5.7 million | 2019 | FTC |
| Amazon/Alexa | $25 million | 2023 | FTC |
The sheer size signals that regulators are moving beyond token penalties and toward fines large enough to impose genuine financial consequences on large technology platforms.
Terms of the Settlement
Beyond the monetary penalty, the settlement includes mandatory compliance reforms. TikTok and ByteDance are required to:
- Implement robust age verification mechanisms to prevent children under 13 from creating accounts
- Cease collecting, using, or retaining personal data from users identified or reasonably identifiable as children without verifiable parental consent
- Delete historical data collected from child users in violation of COPPA
- Submit to independent privacy audits at regular intervals
- Establish and maintain a designated privacy compliance officer
Failure to comply with these terms could expose the companies to additional penalties and contempt proceedings.
Industry Reaction
The settlement is expected to send shockwaves through the broader social media industry. Platforms that rely heavily on younger demographics — including Instagram, YouTube Kids, Snapchat, and Roblox — will likely face renewed scrutiny of their own age verification practices and data handling policies for minors.
Privacy advocates have welcomed the enforcement action but argue that fines alone are insufficient. "A $400 million fine is pocket change for a company of TikTok's scale," said one children's privacy researcher. "What matters is whether the compliance requirements are enforceable and whether the data that's already been collected is actually deleted."
What This Means for Organizations
For enterprises and developers operating platforms that may attract younger users, the settlement is a timely reminder that COPPA compliance cannot be treated as a checkbox. Key obligations include:
- Verifiable parental consent before collecting any personal information from users under 13
- Data minimization — collect only what is strictly necessary
- Retention limits — children's data must not be retained beyond its stated purpose
- Transparency — clear, plain-language privacy policies accessible to parents
- Deletion mechanisms — parents must be able to request deletion of their child's data
Violations can now clearly attract penalties in the hundreds of millions of dollars, and the DOJ's direct involvement signals that children's privacy enforcement is no longer solely an FTC matter.
Background
COPPA was enacted in 1998 and has been enforced primarily by the FTC. The law applies to operators of commercial websites and online services directed at children under 13, or that have actual knowledge they are collecting data from children. With this settlement, the DOJ has demonstrated its willingness to pursue criminal and civil enforcement in parallel with FTC actions — raising the regulatory risk ceiling substantially for non-compliant platforms.
TikTok has not publicly admitted wrongdoing as part of the settlement terms.