TikTok and ByteDance agree to $400 million settlement over children's privacy violations

TikTok and its Chinese parent company ByteDance have agreed to pay $400 million to settle a US Department of Justice lawsuit over systematic violations of children's privacy laws, the DOJ announced Friday. The settlement ranks among the largest ever obtained under the Children's Online Privacy Protection Act (COPPA).

The complaint, filed jointly by the DOJ and the Federal Trade Commission in August 2024, accused TikTok of collecting personal data — including email addresses — from users under 13 without obtaining verifiable parental consent. Critically, this happened even in accounts designated as "Kids Mode" — specifically designed for younger users. The lawsuit also alleged that TikTok failed to honor parental requests to delete children's accounts and associated data.

Under the payment structure, TikTok will pay $300 million immediately. The remaining $100 million becomes due once a court formally vacates a prior consent decree against Musical.ly — the short-video app ByteDance acquired in 2018 before converting it into TikTok for Western markets. That earlier consent decree, from 2019, carried a $5.7 million penalty.

A record-setting COPPA penalty

The $400 million figure dwarfs every prior children's privacy settlement on record. The FTC's 2022 settlement with Epic Games over Fortnite reached $275 million and was the previous high-water mark. The jump to $400 million is a clear message from regulators: children's privacy enforcement is escalating in both scope and financial consequence.

The DOJ noted that since the 2024 complaint was filed, TikTok has made significant changes to its ownership structure, internal compliance functions, and data handling practices. The platform has implemented stronger age-verification controls, expanded parental supervision tools, and tightened data governance for accounts associated with minors.

The settlement still requires court approval. For TikTok — which navigated a threatened US ban in early 2025 before reaching a data governance arrangement — the payment marks the formal resolution of one of the most prominent children's privacy enforcement actions of the social media era. The Guardian and Axios first reported the settlement terms.