"Companies that collect children’s personal information must comply with the law," said Assistant Attorney General Brett A. Shumate.
The settlement and its dollar terms
The U.S. Department of Justice announced a $400 million settlement resolving allegations that TikTok, ByteDance, and affiliated companies violated the Children’s Online Privacy Protection Act (COPPA). Under the agreement, TikTok will pay $300 million immediately and another $100 million conditionally if a court vacates an earlier consent decree involving its predecessor, Musical.ly. The announcement described the settlement as one of the largest ever for COPPA-related cases.
What the DOJ alleged in its lawsuit
The Department of Justice filed suit against TikTok and its parent company in 2024, alleging COPPA violations dating back to 2019. The DoJ’s allegations, as set out in the announcement, were specific: that TikTok knowingly allowed children under 13 to create regular accounts outside its restricted “Kids Mode,” collected and retained their personal information without parental consent, failed to delete accounts and data when parents requested it, and maintained inadequate procedures for finding and removing underage accounts.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleHow the settlement reflects changes TikTok has made
The DoJ said it now recognizes that TikTok has made significant changes to its ownership, data management, and legal compliance operations since 2024. The U.S. state also recognized that TikTok implemented important changes to its privacy retention practices, improved age-related controls, and strengthened parental oversight. The announcement framed the monetary recovery alongside those acknowledged operational changes.
Historical precedent: Musical.ly and the 2019 consent decree
The litigation follows earlier enforcement actions. In 2019, Musical.ly — TikTok’s predecessor — agreed to a $5.7 million settlement with the Federal Trade Commission over allegations it illegally collected personal data from users under 13 without parental consent. According to the DoJ announcement, the FTC referred a new investigation to the Department last year, asserting that TikTok continued to breach COPPA rules despite the 2019 commitment to comply.
What this means for parents and for regulators and for platforms’ compliance teams
- Parents and guardians: The settlement centers on allegations about under‑13 accounts, data collection without parental consent, and failures to delete data on request — issues parents may track as evidence of enforcement outcomes tied to children’s privacy protections.
- Policymakers and regulators: The DoJ framed the outcome as a significant monetary recovery and a statement of enforcement intent: “This resolution secures a significant monetary recovery and reflects the Department’s commitment to ensuring children receive the full protections that Congress mandated,” Brett A. Shumate said in the announcement.
- Platforms and compliance teams: The DoJ’s recognition that TikTok has altered ownership, data management, and legal compliance operations — and the conditional structure of part of the payment tied to the status of the Musical.ly consent decree — highlights how historical consent orders and corporate changes can affect present enforcement remedies.
The Department emphasized that the settlement resolves allegations; the announcement explicitly notes there has been no judicial determination that TikTok or ByteDance is liable. That procedural caveat sits alongside a sizeable financial recovery and formal recognition by the DoJ of operational changes TikTok has undertaken since the 2024 suit.
The settlement ties together a multi-year enforcement track — the 2019 Musical.ly consent decree, the 2024 DoJ lawsuit, an FTC referral last year, and the newly announced financial and operational resolution. It leaves open the judicial status of the prior Musical.ly consent decree (since the final $100 million is contingent on that decree being vacated) and underscores the DoJ’s public framing of child‑privacy compliance as a continuing enforcement priority.
