⚖️ TikTok Settlement

Federal Enforcement of Children's Online Privacy Standards

TikTok Inc. and its parent company, ByteDance Ltd., have agreed to a $400 million settlement with the U.S. Department of Justice (DOJ) to resolve allegations of systemic violations of the Children’s Online Privacy Protection Act (COPPA). Originating from a 2024 federal lawsuit initiated upon referral from the Federal Trade Commission (FTC), regulators alleged that TikTok permitted millions of users under the age of 13 to create standard accounts outside its restricted "Kids Mode," collected personal data without verifiable parental consent, failed to delete accounts upon parental request, and retained child demographic data for targeted advertising. This action followed a 2019 FTC consent decree with TikTok's predecessor, Musical.ly, which imposed a $5.7 million penalty for identical infractions. Under the terms filed in the U.S. District Court for the Central District of California, TikTok will pay $300 million immediately, with an additional $100 million contingent on vacating the prior Musical.ly order. While TikTok admitted no liability, the agreement mandates enhanced age-assurance protocols, strict parental oversight mechanisms, and revised data retention policies, concluding years of litigation alongside broader corporate restructuring of its domestic operations.

Impact

This historic COPPA enforcement action illustrates a fundamental legal shift for consumer software companies: regulators are actively penalizing platforms for procedural friction that enables underage registration or circumvents parental consent. For founders building consumer-facing mobile or web applications, relying on basic age-gating mechanisms—such as self-reported birthdates—is no longer legally sufficient if user behavior, metadata, or internal telemetry indicates the presence of minors. The DOJ's complaint highlights that internal employee warnings regarding underage users create actual knowledge under COPPA, establishing direct regulatory liability if data processing continues. Additionally, the settlement demonstrates that failure to maintain effective data deletion workflows when requested by parents constitutes an independent statutory violation. As federal enforcement agencies increasingly target behavioral tracking and algorithmic profiling involving minors, early-stage companies must recognize that algorithmic engagement features built on child data carry existential regulatory risks.

In addition to our newsletter we offer 60+ free legal templates for companies in the UK, Canada and the US. These include employment contracts, investment agreements and more