WASHINGTON — TikTok and its Chinese parent company, ByteDance, have agreed to pay $400 million to settle a U.S. government lawsuit accusing the companies of violating federal children’s online privacy protections by collecting personal information from users younger than 13 without required parental consent.
The Justice Department announced the settlement Thursday, saying TikTok will pay $300 million immediately and an additional $100 million after a court enters an order vacating a prior consent decree involving Musical.ly, the video-sharing platform acquired by ByteDance and later integrated into TikTok.
The government described the agreement as one of the largest recoveries ever obtained in a case brought under the Children’s Online Privacy Protection Act, known as COPPA. The law requires online services directed at children, or services with actual knowledge that they are collecting information from children, to obtain verifiable parental consent before collecting, using or disclosing personal information from users under 13.
The settlement resolves allegations, not findings of liability. The Justice Department said there has been no judicial determination that TikTok or ByteDance violated the law, and the companies did not admit wrongdoing as part of the agreement.
The case is one of the most significant federal privacy actions against a social media company and underscores the growing scrutiny facing platforms used by children and teenagers. It also arrives as TikTok remains under intense political pressure in Washington over data security, Chinese ownership and its role in the online lives of millions of Americans.
What the government alleged
The Justice Department and Federal Trade Commission filed the lawsuit in 2024, alleging that TikTok knowingly allowed millions of children under 13 to create and use regular accounts on the platform.
According to the complaint, TikTok collected personal information from those children without obtaining the parental consent required by COPPA. The government alleged that the information included email addresses, phone numbers, usernames, geolocation data, and other identifying details.
Federal officials also accused the companies of failing to delete children’s accounts and personal information when parents requested that the data be removed. The complaint alleged that TikTok sometimes kept or failed to properly handle accounts it knew belonged to children under 13.
The allegations centered on the distinction between TikTok’s regular platform and its youth-oriented experience. TikTok has said that users under 13 are directed to a more limited version of the service, where they cannot post videos, exchange direct messages, or create public profiles.
The government argued that the company did not adequately prevent young children from entering the regular TikTok platform, where they could create content, interact with other users, and have their data collected.
TikTok’s enormous reach made the allegations particularly serious. The platform is one of the world’s most popular social media apps, especially among younger users, and its short-video format has helped define online culture, entertainment, marketing, and political communication.
The lawsuit did not claim that every child under 13 using TikTok had the same experience or that all data practices were identical. But the government said the companies’ system did not meet the legal standard for protecting children’s privacy.
How the $400 million payment works
Under the settlement, TikTok and ByteDance will pay $300 million immediately to the United States.
The additional $100 million is tied to a legal step involving a 2019 consent decree against Musical.ly, TikTok’s predecessor. The government must obtain a court order vacating that earlier decree before the remaining $100 million becomes due.
Musical.ly was a lip-sync and short-video application acquired by ByteDance in 2017. It was later merged into TikTok, creating a platform that became a global phenomenon.
In 2019, the Federal Trade Commission reached a $5.7 million settlement with Musical.ly over allegations that it violated COPPA by collecting personal information from children without parental consent. At the time, the FTC said the penalty was the largest it had obtained in a children’s privacy case.
That earlier settlement required Musical.ly to take steps intended to protect the privacy of users younger than 13. The 2024 lawsuit alleged that the platform, now operating as TikTok, failed to comply with those obligations.
The new agreement would replace the earlier consent decree with a larger financial settlement and updated compliance requirements. The Justice Department said TikTok has made significant changes to its ownership, management, compliance functions and privacy practices since the lawsuit was filed.
Details of the operational changes were not fully disclosed in the Justice Department’s announcement. But reporting on the agreement indicated that TikTok will strengthen age-related controls, improve parental oversight tools, and maintain enhanced safeguards for young users.
Understanding COPPA
COPPA was enacted in 1998 and is enforced primarily by the Federal Trade Commission. It remains one of the most important U.S. laws specifically designed to protect children’s online privacy.
The law applies to websites and online services directed at children under 13, as well as general-audience platforms that have actual knowledge they are collecting personal information from children under that age.
Under COPPA, companies must:
- Direct notification to parents of data collection practices.
- Obtain verifiable parental consent to acquire any personal information from children under 13.
- Allow parents to access and remove their children’s information.
- Collect only such information as is reasonably necessary for the service.
- Protect the security and confidentiality of collected information.
The law was created before smartphones, social media, app stores, and algorithmic video feeds became central to children’s lives. But its core principles have become more relevant as platforms collect increasingly detailed data about users’ behavior, location, interests and connections.
Critics argue that COPPA is outdated because it relies heavily on a 13-year age threshold and parental-consent mechanisms that can be difficult to verify online. Supporters say the law remains an essential baseline, particularly when companies fail to enforce their own age restrictions.
The TikTok settlement is likely to renew calls for Congress to update federal privacy rules. Lawmakers have debated broader children’s online-safety legislation, but Congress has struggled to pass a comprehensive national privacy law.
Why the settlement matters
The $400 million payment is large, but the case’s significance extends beyond the financial penalty.
For TikTok, the settlement resolves a major legal risk at a time when its U.S. operations are already under scrutiny. American officials have raised concerns about ByteDance’s ownership, data security and the possibility that the Chinese government could influence the platform. TikTok has denied that it would hand U.S. user data to Chinese authorities.
The children’s privacy case is legally separate from those national-security debates. But it adds to the pressure on TikTok to demonstrate that it can operate responsibly in the United States.
For the Justice Department and FTC, the settlement sends a signal to other technology companies that youth protections are not merely a matter of voluntary policy. Platforms that collect children’s data can face substantial penalties if they do not comply with federal law.
The agreement also reflects a shift in how regulators view social media platforms. Earlier internet privacy cases often focused on websites collecting email addresses or contact information. Today, platforms can collect and infer far more: viewing habits, interactions, device identifiers, location patterns, social connections, and behavioral profiles.
Kids could not fully grasp what will happen with their data and how it might be used, preserved or merged with other information. The stakes are even higher for kids.
TikTok’s broader political challenge
TikTok is not confronting this settlement in isolation.
The company has become a central subject of U.S. political debate, with lawmakers and officials questioning whether a platform owned by ByteDance should be allowed to operate at its current scale in the United States.
Congress has passed legislation requiring ByteDance to divest TikTok’s U.S. operations or face a ban, though the policy has been subject to legal challenges, extensions and negotiations. The company has argued that a ban would violate free-speech rights and harm millions of creators and businesses.
The privacy settlement does not decide TikTok’s ownership future. But it reinforces the argument of critics who say the platform needs stronger oversight.
TikTok has responded to past criticism by expanding safety teams, introducing parental controls, limiting screen time for younger users, and creating a separate experience for children under 13. The company says it invests heavily in protecting minors and removing underage accounts.
The government’s allegations suggest that officials believed those measures were insufficient during the period covered by the lawsuit. The new settlement will be judged by whether its safeguards work in practice, not simply by the size of the payment.
The challenge of age verification
One of the hardest questions in online child safety is how platforms can reliably determine a user’s age.
Many services ask users to enter a date of birth when creating an account. But children can enter false information, and companies often face a tradeoff between stronger age verification and user privacy.
Government ID requirements might exclude undocumented users, generate new privacy concerns and raise issues over who holds key identity data. Errors may result from less intrusive methods such as artificial intelligence, age estimation or parental verification.
TikTok’s case illustrates the limitations of self-reported ages. The government alleged that the platform had actual knowledge that many users were under 13 through their content, reports or account information but did not consistently move them into the more restricted youth experience.
The settlement may push other social media companies to invest more in age assurance systems. It may also intensify debate over whether those systems should be standardized and regulated rather than left to each platform.
Parents, schools and young users
The TikTok case carries practical implications for families.
Parents should review the privacy and safety settings available on their children’s devices and social media accounts. That includes age settings, screen-time limits, private account options, direct-message controls, and data-sharing preferences.
Parents should also recognize that no platform control is a substitute for direct conversations. Children may encounter inappropriate content, misleading information, unwanted contact or pressure to share personal details even on services that claim to have safety measures in place.
Schools face related challenges. Social media and AI tools are increasingly part of students’ daily lives, making digital literacy as important as traditional internet safety. Students need to understand what data they are sharing, how algorithms influence what they see, and why age restrictions exist.
For young users, the basic guidance remains straightforward: do not share full names, phone numbers, addresses, school information, passwords or location details publicly. If an interaction feels uncomfortable or threatening, tell a trusted adult.
What happens next
The settlement ends the federal litigation, but it does not end scrutiny of TikTok or the wider debate over children’s privacy.
TikTok must make the $300 million initial payment and, after the court vacates the earlier Musical.ly decree, the additional $100 million. The company will also face expectations that it implements the privacy and child-safety measures described in the agreement.
Regulators will likely monitor whether those changes improve age detection, parental consent procedures, account deletion, and data handling.
The case may also influence future enforcement actions. Other platforms with large youth audiences will be watching closely, particularly companies that rely on advertising models built around user data.
The $400 million settlement is a major penalty, but it also represents a broader turning point. It shows that U.S. regulators are willing to pursue social-media companies over child privacy, and that the cost of failing to protect young users can reach far beyond a company’s reputation.
