TikTok and ByteDance settle US children's privacy lawsuit for $400m
DoJ sued in 2024 alleging COPPA violations; settlement resolves claims of collecting under-13 data without parental consent.
Briefing
- TikTok and ByteDance will pay $400m to resolve DoJ allegations that they illegally collected personal data from children under 13 without parental consent, one of the largest children's privacy settlements on record.
- The DoJ filed suit in August 2024 under the Children's Online Privacy Protection Act, which requires online services targeting children to obtain verifiable parental consent before gathering user data.
- Federal prosecutors alleged TikTok not only collected the data but retained it without notifying parents, compounding the original violation.
- The settlement closes a two-year enforcement action but leaves open questions about ByteDance's ongoing compliance obligations under US law, given its separate ownership restructuring.
Analysis
- The $400m COPPA settlement establishes a new floor for US children's privacy enforcement that raises compliance cost expectations across all ad-supported platforms with youth audiences. The DoJ's dual allegation structure (collection plus retention without notification) signals that enforcement will target data lifecycle practices, not just consent mechanics. Meta, Snap, and Google each face materially higher regulatory provisioning risk given their documented exposure to under-13 user data and ongoing FTC scrutiny.
- ByteDance's compliance obligations under US law remain unresolved despite the settlement, creating a persistent regulatory overhang on any TikTok ownership restructuring timeline. Acquirers or investors evaluating TikTok US assets must now price in the cost of a prospective compliance regime that includes real-time parental consent verification infrastructure, which the settlement implies was absent at scale. This structurally reduces the standalone valuation of the US TikTok entity in any divestiture scenario.
Historical Context
- 2019
The FTC fined TikTok's predecessor Musical.ly $5.7m for COPPA violations, the largest children's privacy fine at the time. That action failed to produce sustained compliance, directly enabling the conduct underlying the current $400m settlement, illustrating how insufficiently scaled penalties invite recidivism.
- 2012
Google paid $22.5m to settle FTC allegations that it bypassed Safari browser privacy settings, then a record privacy fine. The DoJ and FTC have since reset enforcement scales dramatically upward; the TikTok settlement at $400m reflects a 17x escalation in penalty benchmarks for digital privacy violations over that period.
Connected Events
Austria's FMA issues first published MiCA fine, hitting Bitpanda for €70,000
Austria's FMA issued the first published MiCA enforcement fine against Bitpanda for disclosure failures, demonstrating that regulators across jurisdictions are now using public penalty decisions as a deterrent mechanism rather than private warnings. The TikTok settlement follows the same template: public, scaled enforcement designed to reshape industry compliance behavior rather than simply punish a single actor.
Disney and ABC sue FCC over forced early broadcast licence renewals
Disney and ABC sued the FCC over forced early broadcast licence renewals, framing it as content-based retaliation. Both cases involve federal agencies using regulatory levers against large media or tech platforms, accelerating the trend of platform compliance obligations becoming a direct input to asset valuation and deal structuring.
Further reading
See Indexa more often on Google
Mark Indexa as a preferred source — your Top Stories will surface more Indexa coverage.
