TikTok will pay $400 million to settle a Justice Department lawsuit brought under the Children's Online Privacy Protection Act. Neither TikTok nor its parent ByteDance admits wrongdoing.
The allegations are that the platform allowed millions of children under 13 to use it, collected their personal information without the parental consent the law requires, kept that data and used it for targeted advertising, and altered its registration flow in ways that obscured age checks.
What COPPA actually requires
The statute is narrow and old, and it is worth being precise about it because it is often described loosely.
COPPA applies to online services directed at children under 13, or which know they have under-13 users. Before collecting personal information from such a child, the operator must obtain verifiable consent from a parent. It must tell parents what it collects, let them review it, and delete it on request. The Federal Trade Commission writes the rules and refers cases to the Justice Department when it wants civil penalties in federal court, which is how this one arrived.
What COPPA does not do is regulate what children see, how long they spend on a platform, or how the recommendation algorithm works. It is a data-collection statute. That limits it, and it explains why a case about children and social media ends up being argued over consent forms and age gates rather than over harm.
The number that matters is the ratio
In 2019 the FTC settled with Musical.ly, the app that became TikTok, for $5.7 million over the same conduct under the same statute. The company undertook then to keep under-13s from creating accounts and added age verification.
The current settlement is roughly seventy times larger, and the government's case is essentially that the first one did not work: that TikTok continued to struggle to identify and remove underage users despite the earlier commitments.
That escalation is deliberate and it is the point of the case. A penalty of $5.7 million against a company of ByteDance's size is an operating expense. A penalty of $400 million is still not existential, but it is large enough to change what a compliance team can argue for internally, which is the mechanism by which enforcement of this kind is supposed to work.
What TikTok has to change
The settlement requires stronger age controls, additional safeguards for young users, and better tools for parents to see and manage what is collected about their children.
The practical difficulty behind all of it is that verifying a user's age on the open internet is genuinely hard. Asking produces lies. Requiring identity documents excludes people and creates a much larger privacy problem than the one being solved. Inferring age from behaviour is intrusive and unreliable. Every platform facing this rule is choosing among bad options, which is why the same companies keep returning to the same enforcement docket.
The wider frame
This lands while regulators on both sides of the Atlantic are pressing the same industry from different directions: the EU has accused Meta's platforms of addictive design, US states are litigating against Meta on a theory about minors, and Australia is tightening enforcement of its teen social media ban.
The American cases are still being fought largely on data-protection statutes written for a different internet, because that is the law Congress has passed. The European ones increasingly are not. That difference, more than the size of any single settlement, is what will determine which jurisdiction actually changes how these products are built.
