TikTok has agreed to pay $400 million to resolve a lawsuit brought by the US Justice Department and the Federal Trade Commission, which accused the video-sharing platform of collecting personal data from children without their parents' permission. The settlement, announced on Tuesday, marks one of the largest penalties ever imposed under US children's privacy law.
Under the terms, TikTok will pay $300 million immediately, with a further $100 million due once a court order vacates an earlier consent decree against Musical.ly, the app that TikTok's parent company ByteDance acquired in 2017 and later merged into TikTok. The DOJ said the arrangement ensures "substantial recovery" while reinforcing protections for families.
The case dates back to 2019, when US regulators first sued Musical.ly under the Children's Online Privacy Protection Act (COPPA). That law requires websites and online services to obtain verifiable parental consent before collecting personal information from children under 13. The 2024 lawsuit alleged that even accounts set to "Kids Mode," designed for younger users, still gathered email addresses and other data without proper authorization.
Associate Attorney General Stanley Woodward Jr. called the settlement "a major victory for American children and parents," adding that it "secures a substantial recovery while reinforcing the protections that families expect and deserve."
The DOJ noted that TikTok has "undergone significant changes to its ownership, management, compliance functions, and privacy practices" since the lawsuit was filed. The company has introduced measures aimed at strengthening safeguards for younger users, improving age-related controls, and enhancing parental oversight, according to the statement.
This settlement is part of a broader global scrutiny of TikTok's data practices. In Europe, regulators have also been active: the Irish Data Protection Commission, which oversees TikTok's EU operations under the bloc's General Data Protection Regulation, has previously fined the company for violations related to children's data. The EU's Digital Services Act imposes additional obligations on large platforms, including TikTok, to assess systemic risks and protect minors online.
The case highlights the growing tension between tech companies' business models and privacy protections for minors. As TikTok's influence on teenage behavior continues to be studied, regulators on both sides of the Atlantic are paying closer attention to how platforms handle young users' data.
While the settlement resolves the US lawsuit, TikTok still faces legal challenges elsewhere. In Europe, consumer groups have filed complaints over alleged GDPR breaches, and the European Commission has launched formal proceedings under the DSA. The company has denied wrongdoing in many of these cases, but the pattern of regulatory action suggests that privacy compliance remains a central issue for the platform.
For parents, the settlement may offer some reassurance, but experts caution that enforcement alone is not enough. "Fines are a deterrent, but they don't undo the harm of data misuse," said a privacy advocate based in Brussels. "What matters is whether companies genuinely redesign their products to put children's interests first."
TikTok said in a statement that it is committed to protecting the privacy of its users, especially younger ones, and that it has already implemented many of the changes outlined in the settlement. The company also noted that it cooperated with regulators throughout the process.
The $400 million payout is significant, but it represents a fraction of TikTok's global revenue. Analysts say the real impact may be on the company's reputation and its ability to operate in regulated markets. As European lawmakers push for stricter rules on online platforms, this settlement could serve as a reference point for future enforcement actions.
For now, the focus shifts to implementation. The DOJ will monitor TikTok's compliance with the settlement terms, and the company must report on its progress. Whether this marks a turning point in how tech giants handle children's data remains to be seen, but the message from regulators is clear: privacy protections are not optional.
