TikTok's $400 Million Child Privacy Settlement Marks End of Multi-Year DOJ Case

A Quarter-Billion-Dollar Resolution

ByteDance and its short-video platform have agreed to pay $400 million to resolve allegations that they systematically violated children's privacy protections, the Department of Justice announced this week. The figure ranks among the highest penalties ever secured under the Children's Online Privacy Protection Act, according to the DOJ, closing a chapter that began with enforcement action filed two years ago.

The financial structure splits the payment: $300 million due immediately, with the remaining $100 million contingent on the dissolution of an earlier Federal Trade Commission consent decree tied to the Musical.ly acquisition. That 2019 FTC settlement, which itself carried a $5.7 million penalty, had established baseline requirements for how the platform handled data from underage users.

At DailyTechWire, we've tracked how acquisition-related compliance failures have become a recurring theme in consumer-tech enforcement. The Musical.ly deal brought TikTok a massive US youth audience but also imported legacy code and data practices that regulators later deemed inadequate.

The Original Complaint

The 2024 lawsuit accused the company of multiple breaches: permitting children younger than 13 to register accounts without parental consent, harvesting data from users who opted into a purportedly safer "Kids Mode," and failing to honor deletion requests submitted by parents. Federal prosecutors argued these practices violated both COPPA's baseline requirements and the specific undertakings ByteDance had made to settle the Musical.ly matter.

COPPA requires verifiable parental consent before collecting personal information from children under 13, a threshold that has proved difficult to enforce at scale. Platforms typically rely on self-reported birth dates, a system that breaks down when economic incentives favor lax verification. The DOJ's complaint suggested that TikTok's internal systems flagged accounts likely operated by young children yet took minimal corrective action.

The deletion-request failures were particularly damaging from a legal standpoint. Parents who discovered their children's accounts and formally requested data removal often received no response or were told the data had been purged when server logs indicated otherwise, prosecutors said.

Ownership Overhaul as Mitigation

In explaining the settlement terms, the Justice Department pointed to "significant changes" in ownership, management, and privacy architecture that have occurred since the original filing. Earlier in 2026, TikTok completed a restructuring that created TikTok USDS Joint Venture, a new legal entity controlling US operations. Oracle, private-equity firm Silver Lake, and Abu Dhabi sovereign fund MGX now hold majority stakes, while ByteDance retains a 19.9 percent interest with limited governance rights.

The deal was engineered to satisfy national-security concerns that had escalated under both the Biden and subsequent administrations. By ceding operational control to US-domiciled investors and routing data flows through Oracle's cloud infrastructure, the platform sought to insulate itself from accusations that Beijing could access American user information.

Federal prosecutors acknowledged these structural reforms as materially advancing the public interests that underpinned their litigation. The DOJ statement credited the company with implementing "extensive measures designed to strengthen safeguards for younger users, improve age-related controls, and enhance parental oversight," though it did not enumerate specific technical changes.

What Changed on the Product Side

Industry observers note that TikTok has rolled out several youth-safety features in the past 18 months, some of which predate the settlement talks. Default screen-time limits now apply to accounts registered by users under 18. A family-pairing mode lets parents link their accounts to their teenagers' profiles, surfacing weekly activity summaries and enabling remote content filtering.

The platform also introduced a more aggressive age-estimation model that uses behavioral signals, device metadata, and optional selfie-based verification to flag accounts that may have lied about birth dates. When the system flags a potential underage user, the account is locked until the holder submits government-issued identification or accepts a downgrade to a restricted experience with no direct messaging, limited content discovery, and disabled e-commerce features.

These moves mirror steps taken by Meta, Snap, and YouTube after their own brushes with COPPA enforcement, suggesting that regulatory pressure is converging on a common set of technical controls. Yet implementation remains inconsistent. A 2025 audit by child-safety researchers found that determined 11-year-olds could still bypass age gates on most major platforms using disposable email addresses and fabricated birth dates.

Broader Implications for Platform Liability

The settlement arrives as Congress debates updates to COPPA that would raise the protected age threshold to 16 and impose stricter design requirements on platforms with large youth audiences. Legislators from both parties have cited TikTok's case as evidence that the 1998 statute, written for an era of static websites, lacks teeth in the age of algorithmic feeds and persistent identifiers.

Some advocacy groups have called the $400 million penalty insufficient given TikTok's scale. The platform reported more than 170 million US users last year, a figure that almost certainly includes millions of children and teenagers. Critics argue that even a nine-figure fine amounts to a rounding error for a company that generated an estimated $23 billion in US revenue in 2025, according to industry analysts.

Others counter that the true cost extends beyond the cash payment. The reputational damage, the engineering resources devoted to remediation, and the ongoing compliance monitoring required under the settlement together represent a substantial drag on the business. Moreover, the precedent may embolden state attorneys general, several of whom have opened parallel investigations into youth-safety practices at TikTok and rival platforms.

Federal Devices Back Online

The settlement coincides with another milestone in TikTok's rehabilitation arc. Earlier this month, the Office of Management and Budget formally rescinded a 2022 directive that had banned the app from most government-issued devices. That ban, enacted amid fears that Chinese intelligence could harvest federal employees' location and contact data, had become a symbolic flashpoint in the broader geopolitical contest over digital infrastructure.

The OMB's reversal reflects a judgment that the ownership restructuring and Oracle-mediated data residency have adequately addressed espionage risks. Federal agencies may now permit installation on a case-by-case basis, though the Defense Department and intelligence community are expected to maintain their own prohibitions.

For TikTok, the policy shift offers a measure of legitimacy. The app remains a cultural force, particularly among users under 30, but years of regulatory turbulence have made advertisers and creators wary. Resolving the child-privacy lawsuit and regaining a toehold in government circles sends a signal that the platform is moving past its compliance troubles.

What Comes Next

The settlement does not foreclose additional action by state regulators or private plaintiffs. Class-action lawyers have filed dozens of suits alleging that TikTok's algorithm promotes harmful content to teenagers, claims that fall outside COPPA's scope but draw on similar factual allegations about data collection and targeting. Those cases are in early stages, and their outcomes will hinge on interpretations of Section 230 immunity and emerging state laws that impose duty-of-care obligations on platforms.

Meanwhile, the FTC is conducting a separate review of TikTok's advertising practices, focusing on whether the platform misrepresented its data-sharing arrangements with third-party marketers. That inquiry, which began in late 2025, could yield another enforcement action if investigators conclude that disclosures to users were inadequate.

At DailyTechWire, we see the $400 million settlement as a data point in a longer story about how democracies regulate platforms that straddle commerce, culture, and geopolitics. The penalty is historic by COPPA standards, yet it leaves unresolved questions about whether financial sanctions alone can compel structural change at companies whose growth models depend on capturing attention early and often. As lawmakers in Washington, Brussels, and other capitals draft the next generation of platform rules, the TikTok case offers both a cautionary tale and a template: enforcement works best when it combines monetary penalties, technical mandates, and transparency requirements that let outside researchers verify compliance.