TikTok’s $400 million settlement bets that fines can fix what surveillance cannot

TikTok and ByteDance will pay $400 million to resolve a Department of Justice lawsuit over years of collecting personal data from children under 13 without parental consent, one of the largest recoveries ever obtained under the Children’s Online Privacy Protection Act and by far the most significant COPPA enforcement action since the law’s 2013 revision.

The conduct in question stretches back to Musical.ly, the lip-sync platform ByteDance acquired and rebranded as TikTok in 2018. According to the DOJ complaint, TikTok and ByteDance knowingly allowed millions of children under 13 to register standard user accounts, the kind that collect names, contact details, location data, and behavioral profiles, without notifying parents or seeking the consent COPPA explicitly requires. TikTok had already been subject to a consent decree following a 2019 FTC action against Musical.ly. The DOJ alleged the same practices continued after that decree, under the new brand.

That is the structural fact beneath the number. This was not a software bug or an isolated failure, but a policy decision maintained across a rebrand and a prior enforcement action, to treat a known age restriction as a compliance problem to be managed rather than a boundary to be enforced. The $400 million figure exists because this was the second time the same company was caught doing the same thing.

Under the settlement, ByteDance pays $300 million immediately. A further $100 million becomes due once a court formally vacates the Musical.ly consent decree, consolidating two enforcement chapters into a single resolution. TikTok must maintain enhanced age-related controls, improve tools for parental oversight, and demonstrate ongoing compliance to the DOJ’s Civil Division, working from a referral by the Federal Trade Commission. Associate Attorney General Stanley Woodward Jr. called it a major victory for American children and parents.

What a fine cannot do is retrieve data already collected, undo the years in which children’s behavioral profiles accumulated inside ByteDance’s systems, or address TikTok’s data practices for users over 13. Advertisers who modeled against those profiles have already used them. The structural problem COPPA was designed to address, children engaging with commercial surveillance platforms not built for them, is not resolved by any payment.

What the $400 million does accomplish is repricing non-compliance. The previous COPPA record was a $91.4 million settlement with a children’s shopping site in 2022. Quadrupling that benchmark signals that both the DOJ and the FTC have moved into a different enforcement regime, one where the penalty is sized to exceed the business advantage gained from collecting the data in the first place. Snap, YouTube, Roblox, and Discord operate under the same regulatory framework and now face the same calculation.

The $300 million payment begins immediately. Court proceedings to vacate the Musical.ly consent decree are expected within weeks, triggering the remaining $100 million. The FTC retains authority to pursue further enforcement actions against TikTok’s broader data-collection practices under separate statutory frameworks.

Tags: tiktok, data privacy, ByteDance, COPPA, child privacy, DOJ