TikTok, ByteDance, and affiliated companies have agreed to a $400 million settlement with the U.S. Department of Justice (DOJ).
The agreement resolves a 2024 DOJ lawsuit alleging that TikTok violated the Children’s Online Privacy Protection Act (COPPA) by improperly collecting and handling children’s personal information.
COPPA establishes privacy requirements for online services that collect personal information from children under 13.
Under the agreement, TikTok will pay $300 million immediately. An additional $100 million will be required if a court vacates an earlier consent decree involving Musical[.]ly, TikTok’s predecessor.
The DOJ noted that the agreement resolves the allegations without a judicial determination that TikTok or ByteDance is liable.
TikTok accused of collecting children’s data without consent
The case stems from allegations that TikTok failed to comply with COPPA requirements despite an earlier enforcement action involving Musical[.]ly.
In 2019, Musical[.]ly agreed to pay $5.7 million to settle Federal Trade Commission (FTC) allegations that it illegally collected personal information from children under 13 without obtaining parental consent.
The FTC later launched another investigation into TikTok and referred the matter to the DOJ, alleging the company continued to violate COPPA despite its previous commitment to comply with the law.
According to the DOJ, TikTok knowingly allowed children under 13 to create regular accounts rather than using the platform’s more restrictive Kids Mode.
The government also alleged that TikTok collected and retained personal information belonging to these users without obtaining parental consent.
Federal officials further accused TikTok of failing to delete children’s accounts and associated information when requested by parents.
The DOJ also alleged that the company lacked adequate procedures for identifying and removing accounts belonging to users under 13.
Settlement follows changes to TikTok privacy practices
The $400 million agreement represents one of the largest settlements involving alleged COPPA violations and comes after TikTok made changes to its U.S. operations.
In announcing the settlement, the DOJ acknowledged that TikTok has made changes to its ownership, data management, and legal compliance operations since the lawsuit was filed in 2024.
The government also recognized improvements to TikTok’s data retention practices, age-related controls, and parental oversight.
These measures are intended to provide stronger safeguards around how younger users access the platform and how their information is managed.
“Companies that collect children’s personal information must comply with the law,” Assistant Attorney General Brett A. Shumate said in the DOJ announcement.
Shumate added that the resolution provides a significant monetary recovery while reinforcing federal requirements designed to protect children’s privacy.
Children’s privacy remains a compliance priority
The settlement underscores the financial and regulatory risks technology companies face when collecting or retaining personal information belonging to children.
Organizations operating online services accessible to younger users should have processes for identifying underage users and obtaining required parental consent.
They should also limit unnecessary data collection and promptly respond to requests to delete children’s information.
Age controls alone may be insufficient if organizations lack effective procedures for detecting users who bypass those restrictions.
Privacy teams should regularly test these safeguards and address gaps that could allow underage users to evade them.
For organizations subject to COPPA, the TikTok case reinforces the importance of treating children’s privacy controls as an ongoing compliance obligation rather than a one-time implementation.