TikTok and ByteDance have reached a settlement with the U.S. Department of Justice involving a $400 million payment to resolve a lawsuit over the protection of children's personal information in the United StatesI did.
If you look solely at the amounts involved, the hefty fines imposed on major platforms are what immediately catch your eye. However, there’s a more important aspect to this case. The focus of the regulation is on how platforms verify users’ ages, the extent to which they collect data from users under 13, and how properly they must handle parents’ requests to delete data.
Rather than being limited to TikTok alone, this agreement is likely to serve as a reference point not only for other social media platforms, games, and video platforms, but also for the design of AI services accessible to minors.
The key issue is not the figure of $400 million, but rather “what the platform should do after identifying child users.”
| How will the $400 million be paid?
The settlement amount announced by the U.S. Department of Justice on August 21, 2026, totals $400 million. TikTok will first pay $300 million, and will pay an additional $100 million if the court lifts the existing consent decree issued in 2019 against Musical.ly, TikTok's predecessor.It turns out that way.
The U.S. Department of Justice described this as one of the largest recoveries ever in a COPPA case. Given that Musical.ly paid $5.7 million in 2019 for similar issues involving children’s personal information, this settlement demonstrates just how much the scale of regulatory enforcement has grown.
However, it would be inaccurate to interpret this simply as a case where the fine for the same violation increased from $5.7 million to $400 million between the 2019 case and this one. This settlement is a process to resolve the allegations in a new lawsuit filed in 2024, and the additional $100 million is also linked to the rescission of the existing consent decree. Conditional PaymentWow.
There's another point that must be clarified. The U.S. Department of Justice states that the terms of the settlement The "allegations" raised by the governmentIt also stated that the court has not yet made a final ruling on the legal liability of TikTok and ByteDance. Even if the settlement amount is large, it does not necessarily mean that the court has immediately ruled that they are liable.
| The Starting Point of the Lawsuit
The U.S. Department of Justice filed a lawsuit against TikTok and ByteDance in 2024 following a referral from the Federal Trade Commission (FTC). The complaint at the time stated that Allegations that the two companies allowed children under the age of 13 to create and use regular TikTok accounts and collected and stored their personal information without notifying their parents or obtaining their consentIt's included here.
The government’s concerns weren’t limited to the creation of accounts alone. The core argument of the lawsuit was that even in “Kids Mode,” which was designed for children, certain personal information and device identification data were collected, and there were instances where the company failed to properly process requests from parents to delete their children’s accounts and related data.
Whether TikTok’s age verification process was adequate also became a point of contention. According to the complaint, users were previously able to bypass the age verification step by re-entering their date of birth or signing up with a third-party account. The government argued that this resulted in the creation of a large number of accounts whose ages could not be verified.
The key point here is that the above content represents the U.S. government’s claims as stated in the 2024 complaint. Although the lawsuit has been settled through this agreement, the court has not issued a ruling confirming either side’s claims as fact.
| What COPPA Requires of Platforms
COPPA is a U.S. "Children's Online Privacy Protection Act"Wow. This could apply to businesses that actually discover they are collecting personal information from children under 13—not just websites and apps targeting children under 13, but even services intended for general users.
Businesses subject to these regulations must inform parents of how their children’s personal information will be processed and obtain verifiable parental consent before collecting, using, or disclosing such information. It is also important to establish procedures that allow parents to review or request the deletion of their children’s personal information.
The term “personal information” as used here isn’t limited to information that users enter directly, such as their name or email address. Information that can be used to identify or track users over the long term—such as IP addresses and unique device identifiers—may also be considered personal information depending on the circumstances. Therefore, even if a service has created separate features for children, it’s important to also examine what data is being collected in the background.
Ultimately, from the platform’s perspective, simply stating that “registration is prohibited for users under 13” isn’t enough. Reflect in the product and operational procedures how to identify children’s accounts during actual use, how to restrict or delete data from identified accounts, and how to process parental requestsI have to.
| Why the Issue Resurfaced Even After the Musical.ly Incident
Musical.ly, the predecessor to TikTok, also reached a settlement with the FTC in 2019 over alleged COPPA violations. At the time, the company agreed to pay $5.7 million and implement measures such as complying with children’s privacy regulations and removing content created by users under the age of 13.
However, in the 2024 lawsuit, the U.S. government argued that problems with children’s accounts and data processing had continued even after 2019. For this reason, this case is more than just a one-time mistake— To what extent were the existing directives faithfully implemented in actual service operations?It became a major issue.
It seems the regulatory authorities' criteria have also changed. Factors such as the sign-up screen, account detection, data retention periods, the handling of deletion requests, and whether the internal team responsible is actually functioning have become more important than age restrictions listed in a single policy document or in the terms of service.
The larger the platform, the greater the number of users and the more complex the data flow. Therefore, compliance cannot be left solely to the legal team. It has become more of a product design issue, requiring service planners, developers, the privacy team, and the content operations team to operate under the same standards.
| Changes TikTok Has Made
The U.S. Department of Justice stated that since the lawsuit was filed in 2024, there have been significant changes in TikTok’s ownership structure, management, compliance organization, and approach to privacy protection. The Department of Justice explained that safeguards for young users, age-based controls, and parental management features have also been strengthened.
According to court documents reported by Reuters, TikTok's The U.S. joint venture explained that it requires all users to enter their date of birth and operates an age verification system and a dedicated team to identify accounts suspected of belonging to users under the age of 13.I did. Through this, Claims that minor accounts are being continuously deletedI put it out there, too.
Although these changes were cited as the basis for reaching a settlement, this does not mean that the allegations raised in the past have been dropped. Conversely, it would also be inaccurate to focus solely on the settlement amount and disregard all current protective measures. It is more appropriate to view this case as a settlement reached after taking into account past operational issues, subsequent corrective measures, and the uncertainty surrounding a protracted lawsuit.
| The Key Points of the Next Regulation
To strengthen child protection, we need to verify users' ages more accurately. However, there is a risk that, in the process of strengthening age verification, more personal information—such as identity, facial features, and device information—will be required.That happens, too. In a sense, measures intended to protect children can become a new avenue for collecting personal information.
The FTC's 2026 policy on age verification technology also addresses this dilemma. It stipulates that information collected solely for the purpose of age verification must not be used for any other purpose, must not be retained longer than necessary, and must be accompanied by clear guidance and security measures.
Therefore, a good age verification system isn’t just about accurately determining “how old someone is.” It must minimize the amount of information collected, delete that information promptly once its purpose has been served, and explain the process in a way that parents and users can understand. Achieving both accuracy and the minimal collection of personal information will likely be a key challenge in the next phase of platform competition.
| Beyond Social Media
This agreement does not immediately impose the same legal obligations on all social media or AI services. Whether COPPA applies depends on who the service is targeting, whether the business operator knows the user’s age, and what information it collects and uses.
However, the questions that need to be asked during the product design phase are similar. We need to determine how to identify users under the age of 13 when they access the service, what data—such as conversation content, voice recordings, and device information—to store and to what extent, and how to handle parental consent and deletion requests.
In particular, AI services may contain information such as names, schools, locations, and interests mixed in with conversations that users freely enter. Companies seeking to provide features for minors should design a comprehensive process—covering data minimization, retention periods, parental controls, and account deletion—rather than simply including age restriction notices.There is one.
TikTok’s $400 million settlement signals that protecting children’s personal information is no longer treated as an optional safety feature, but as a core responsibility of platform operations. In future competition, the ability to collect less data from young users in the first place—and to delete it properly when necessary—will become just as important as the technology used to keep users engaged.
Thank you for reading!
Starting today, instead of one post per day, I’ll post based on the number of issues that come up each day.
It looks like the number of posts will change! I'll do my best from now on!!
References
U.S. Federal Trade Commission — Children’s Online Privacy Protection Rule
Reuters — TikTok agrees to $400 million US children’s privacy settlement
#TikTok #ByteDance #TikTok #Children's Personal Information #COPPA #Privacy Protection #Age Verification #Platform Regulation #BigTechRegulation #AI Services
