TikTok Will Pay $400m Over Children's Privacy

TikTok has agreed to pay $400m to the United States to settle a lawsuit alleging that its platform violated children's privacy — one of the largest settlements ever reached on the issue.

The deal stems from a 2024 suit brought by the Department of Justice under President Biden, alleging that TikTok and its parent company ByteDance collected "vast amounts of data" on millions of users under the age of 13.

The law involved

The case was brought under the Children's Online Privacy Protection Act, a federal law enacted in 2000. It is the same statute dozens of US states are now using against Meta.

"Children and parents are better protected today than they were when this case began," said assistant Attorney General Brett Shumate.

TikTok has been under sustained regulatory pressure in the United States since 2024.

The pattern of penalties

TikTok joins a short list of companies penalised under COPPA. Google's YouTube paid $170m in 2019; Epic Games paid $275m in 2022.

The escalation is visible in those numbers, and so is the limitation. Meta now faces potential penalties that could run into hundreds of billions of dollars over COPPA violations alleged by state attorneys general — an exposure so far beyond the federal settlements that it constitutes a different kind of legal risk entirely.

That gap between what the federal government extracts and what state litigation threatens is the most consequential fact in US technology regulation right now.

Why a 2000 law is doing this work

COPPA predates every platform it is now being used against. It was written for websites, in an era before smartphones, social feeds, recommendation algorithms or the concept of an app.

Its durability comes from what it regulates: the collection of personal information from children under 13 without verifiable parental consent. That prohibition is technology-neutral, which is why it applies as cleanly to a video app in 2026 as to a web forum in 2001.

It is also why enforcement has been the main instrument of American child-safety policy for a quarter of a century. Congress has repeatedly failed to pass updated legislation, so regulators and state attorneys general work with what exists — a data-collection statute pressed into service against design and engagement questions it was never written to address.

What $400m represents

For a company of TikTok's scale the figure is significant but absorbable, and it settles the specific allegations without establishing precedent about how the platform should be built.

That is the recurring criticism of enforcement-led regulation. A settlement resolves the past; it does not oblige a redesign, and the next company weighs the expected penalty against the value of the data before deciding how carefully to gate its sign-up flow.

The age verification problem underneath

Every COPPA case eventually arrives at the same practical difficulty: platforms are required to know whether a user is under 13, and have no reliable way to find out.

The standard mechanism is a self-declared date of birth, which children routinely falsify, and which platforms have historically had limited incentive to scrutinise. Stronger verification means collecting identity documents from everyone, which creates a larger privacy problem than the one being solved.

That tension has never been resolved, and it is why enforcement recurs rather than concludes.

What TikTok gets for the money

A settlement ends the litigation without an admission or a finding of fact, which has value beyond the balance sheet.

It also removes a case that would have produced discovery — internal documents about what the company knew, when, and what it decided to do. In the Meta litigation, that material has proved considerably more damaging than any penalty, and paying to avoid its equivalent is a rational commercial decision.