- TikTok and its parent ByteDance will pay $400 million to end a 2024 lawsuit alleging violations of the Children's Online Privacy Protection Act.
The news
The Department of Justice announced that TikTok Inc. and ByteDance Ltd. will pay $400 million to settle claims that the app collected data from children without parental notice or consent and failed to delete accounts when parents requested. The settlement covers a lawsuit filed in 2024 and ranks among the largest recoveries the department has obtained in such cases.
Context
The case originated under the prior administration and focused on practices that allegedly breached federal rules on children's data. TikTok had already faced an earlier consent decree tied to its predecessor Musical.ly. The new agreement requires an immediate payment of $300 million, with the remaining $100 million due once a court vacates that prior decree.
The suit accused TikTok of violating the Children's Online Privacy Protection Act by gathering personal information from users under 13. Parents received no notice of the collection and could not give the required verifiable consent. When parents later asked for account deletion, the company did not act on those requests. Bloomberg Technology described the payment as resolving accusations that the app violated an online privacy law through data collection on children.
Details
The Justice Department stated that TikTok collected information from users under 13 without notifying parents or securing verifiable consent, and it did not honor deletion requests from parents. The Verge reported that TikTok will pay $300 million right away and will pay a further $100 million upon entry of an order vacating a prior consent decree entered against TikTok's predecessor, Musical.ly. The settlement is one of the largest recoveries ever obtained by the department in a COPPA case.
Engadget reported that the department noted TikTok has made significant strides in privacy protections since the suit was filed. Bloomberg Technology added that the agreement resolves a Biden-era lawsuit accusing the social media app of collecting data on children in violation of federal privacy rules. The payment structure ties the second portion of the fine to the resolution of the older Musical.ly consent decree, keeping enforcement open until that matter is formally closed.
No public statements from TikTok or ByteDance appear in the announcements. The sources focus on the department's description of the violations and the payment schedule rather than any company response.
Reactions / counterpoints
The sources contain no direct counter-statements from TikTok or ByteDance. Engadget alone records the department's observation that privacy improvements have occurred since the 2024 filing. The Verge and Bloomberg Technology limit their coverage to the terms of the settlement and the underlying allegations.
Why it matters
For software teams and platform operators, the settlement underscores that regulators will pursue large monetary penalties when data practices affect minors, even after prior agreements. The split payment structure shows how enforcement actions can remain open across corporate changes, such as the shift from Musical.ly to TikTok. Companies that handle user accounts must maintain deletion processes that parents can trigger without friction.
The case also signals that privacy compliance investments after litigation can influence how future disputes are framed, though they do not erase earlier violations. ByteDance and TikTok now face both the financial cost and continued scrutiny over how child accounts are managed. The outcome sets a concrete benchmark for what constitutes a major recovery in child privacy enforcement.
Platform builders who store any data on users under 13 will see the $400 million figure as a reference point for potential exposure. The requirement to vacate the older Musical.ly decree before the final payment is released keeps the prior consent order active in the interim, which may affect how the company structures future compliance reporting. Teams responsible for age gates, consent flows, and account deletion tooling now have a recent, high-value example of what happens when those systems fall short of COPPA standards.
---
Sources:
{"word_count": 612}
No comments yet