TikTok has agreed to pay $400 million to settle a child privacy lawsuit brought by the US Department of Justice, which accused the app of collecting personal information from children under 13 without their parents’ consent. The DOJ announced the settlement with TikTok, its parent company ByteDance and affiliated companies on August 21, the law firm Hunton reported.
Under the deal, TikTok will pay $300 million now and another $100 million once a court vacates an earlier consent decree against Musical.ly, the app that became TikTok. Prosecutors said it was one of the largest recoveries ever in a case under the Children’s Online Privacy Protection Act.
What COPPA requires
The Children’s Online Privacy Protection Act, known as COPPA, is a US law that limits what online services can collect from children under 13. Companies whose services are aimed at children, or who know they have child users, must get verifiable consent from a parent before collecting a child’s personal information. Parents also have the right to review that information and have it deleted.
A case with a long history
The dispute goes back to 2019, when Musical.ly agreed to pay $5.7 million to settle Federal Trade Commission allegations that it collected personal information from children without parental consent. As part of that case, the company accepted a consent decree, a court order setting out rules it had to follow.
In August 2024, the DOJ sued TikTok, saying it had broken both COPPA and the 2019 order. According to the complaint, TikTok allowed children under 13 to create accounts, collected and kept their personal information without parental consent, and failed to honour some parents’ requests to delete their children’s accounts and data. The government also said children could open accounts without giving their age, by signing in with credentials from other services, and that their activity on the app was used to build user profiles, Fox 5 New York reported.
What the settlement does and does not do
The settlement ends the 2024 lawsuit. It does not include an admission of wrongdoing: the DOJ said no determination has been made that TikTok violated COPPA, and the claims remain allegations. It also does not impose injunctive relief, meaning new court-ordered restrictions on how TikTok operates.
Instead, the 2019 consent decree will be replaced by TikTok’s ongoing obligations under COPPA and other laws. The DOJ said TikTok has “implemented extensive measures designed to strengthen safeguards for younger users, improve age-related controls, and enhance parental oversight.”
“This settlement is a major victory for American children and parents,” said Associate Attorney General Stanley E. Woodward Jr. “The Department’s priority is ensuring that children are protected online and that companies entrusted with their personal information meet their legal obligations.”
A different TikTok
Much has changed for the company since the lawsuit was filed. ByteDance has agreed with Oracle, Silver Lake and MGX to run a new TikTok joint venture in the United States that will store US user data locally. That deal was designed to answer separate national security concerns about Chinese ownership, but it also changes who is responsible for user data in the US.
The settlement comes as pressure on social media companies over children grows. US states are pursuing large claims against Meta over alleged harm to young users, and governments in several countries are considering age limits for social media.
Why it matters for businesses
For any company with an app or website, the case is a reminder that children’s data carries special legal risk. A service does not have to be designed for children to fall under COPPA; it is enough to know that children are using it. Companies should check how users sign up, especially through third-party logins that can skip age checks, and make sure deletion requests from parents are handled quickly. Phones and apps collect more data than ever, a trend that will grow as AI features spread, as we described in our look at how AI will change smartphones.
Our take
A $400 million payment is large for a privacy case, but small for a company of TikTok’s size, and it comes without an admission or new court-ordered limits. The more important part is the record: the government’s complaint described ordinary failures, such as accounts opened without age checks and deletion requests ignored, that many apps could repeat. Real protection for children will depend less on one-off settlements and more on simple, enforced rules for age checks and data deletion across the industry.