TikTok reaches $400M settlement with DOJ over alleged children’s privacy law violations

TikTok Pays $400 Million to Resolve DOJ Probe Into Children’s Data Practices

Provpnadvice.com – A landmark privacy enforcement action concluded Friday when TikTok and its Chinese parent company, ByteDance, agreed to a $400 million settlement with the U.S. Department of Justice, ending a two-year legal battle over whether the short-video platform collected personal information from children under age 13 without obtaining parental permission first. The resolution represents one of the largest monetary recoveries the agency has secured under federal children’s-privacy law and marks a decisive chapter in a dispute that had already reshaped the platform’s corporate structure in the United States.

How the Payment Breaks Down

Under the terms disclosed by the DOJ, TikTok will remit $300 million immediately upon execution of the settlement. A further $100 million becomes payable once a court formally dismisses a prior consent decree that had been entered against Musical.ly, the predecessor service that TikTok absorbed before launching its current consumer-facing application. The two-tier structure reflects the fact that the original decree targeted the earlier entity, while the new settlement addresses the present-day corporate architecture.

The COPPA Case and What the Government Alleged

The Department of Justice filed suit against TikTok and ByteDance in 2024, charging that the platform violated the Children’s Online Privacy Protection Act, commonly known as COPPA. Enacted by Congress in 1998 and administered by the Federal Trade Commission alongside the DOJ, the statute prohibits websites and online services from gathering personally identifiable information from children younger than 13 unless they first secure verifiable parental consent. The government’s complaint identified two core operational failures: permitting minors below the statutory age threshold to register accounts on the platform, and failing to delete those accounts and associated data when parents submitted formal removal requests.

For context, COPPA’s consent requirement is not a mere formality. It obligates platforms to obtain a parent’s or guardian’s affirmative authorization before collecting names, email addresses, precise location data, or other identifiers from a child. The law also mandates clear privacy disclosures, limits on data retention, and a mechanism for parents to review and delete their child’s information. A platform that allows a ten-year-old to create an account, accumulate months of viewing history, and retain device-level metadata without any parental gatekeeping is, in the government’s framing, operating outside the statute’s boundaries.

DOJ Leadership Response

“This settlement is a major victory for American children and parents,” Associate Attorney General Stanley Woodward Jr. said in a statement.

“The Department’s priority is ensuring that children are protected online and that companies entrusted with their personal information meet their legal obligations,” he continued. “This resolution secures a substantial recovery while reinforcing the protections that families expect and deserve.”

Ownership Overhaul and the Divestiture Mandate

The DOJ’s accompanying press release noted that TikTok has “undergone significant changes to its ownership, management, compliance functions, and privacy practices” since the lawsuit was initiated two years ago. Those structural changes trace directly to congressional action in 2024, which required ByteDance to either divest its controlling interest in the U.S. version of the app or face a domestic ban. The legislative push was driven by a combination of national-security scrutiny and privacy anxieties tied to ByteDance’s headquarters in Beijing and its broader corporate ties to China.

Following that divest-or-ban statute, TikTok USDS Joint Venture emerged as the controlling entity for the American operations, majority-owned by domestic investors. President Trump, after taking office, repeatedly extended the enforcement deadline for the ban while pursuing a negotiated arrangement with Beijing to keep the platform accessible to U.S. users. Last September, he approved the final deal: ByteDance retained a 19.9 percent stake, while Silver Lake, Oracle, and MGX each received a 15 percent position and were designated as managing investors with operational oversight responsibilities.

Broader Implications for Tech Regulation and Family Privacy

The settlement lands at a moment when multiple federal and state regulators are intensifying scrutiny of how social-media platforms handle juvenile data. Although COPPA has been on the books for more than two decades, enforcement actions of this monetary scale against large-scale video-sharing platforms have been comparatively rare relative to actions targeting mobile applications, educational websites, and connected toys. A $400 million figure signals that the DOJ views the statute as a serious financial lever rather than a routine compliance checkbox, and it sets a benchmark that other foreign-owned or foreign-influenced digital services may find difficult to ignore.

For parents, educators, and child-advocacy organizations, the case underscores a practical reality: children as young as nine or ten routinely create accounts on mainstream video-sharing services, often without adult supervision. The statutory requirement of verifiable parental consent before data collection is designed to give families a gatekeeping role at the point of entry. When that gate is bypassed at scale, the resulting data trail — viewing histories, location metadata, device identifiers, interaction logs — can persist long after a parent asks for deletion, creating a privacy exposure that compounds over time.

The timing also intersects with the broader geopolitical negotiation over TikTok’s continued operation in the United States. A privacy settlement of this magnitude, layered on top of an ownership restructuring that placed American investors in the majority position, gives the platform a cleaner regulatory footing heading into the next phase of its domestic operations. It simultaneously reinforces the message that corporate restructuring alone does not extinguish prior legal obligations: the entity that inherited the user base inherited the compliance duties as well.