TikTok and its parent company ByteDance agreed on Friday 21 August to pay $400 million to settle a US Justice Department lawsuit alleging that the platform violated federal children’s privacy law. The department called it one of the largest recoveries ever obtained in a case of its kind. The company does not admit wrongdoing, and the settlement requires court approval.

What the case alleged

The Justice Department sued TikTok and ByteDance in 2024, acting on behalf of the Federal Trade Commission. The allegation was that the company allowed millions of children under 13 to create accounts without their parents’ knowledge or consent, collected personal information from them, and made it difficult for parents to have those accounts deleted.

The law involved is the Children’s Online Privacy Protection Act, known as COPPA, passed in 1998. Its central requirement is straightforward: an online service directed at children, or one that knows it has users under 13, must obtain verifiable parental consent before collecting personal information from them, must tell parents what it collects, and must delete the data on request.

The awkward part of COPPA, and the reason it generates recurring litigation, is the knowledge standard. A platform is not required to verify every user’s age, but it cannot ignore what it knows. Regulators have repeatedly argued that large platforms have ample signals about which accounts belong to children and choose not to act on them. Platforms respond that age verification at scale is itself invasive, since establishing that a user is over 13 generally means collecting more data about everyone, not less.

Why the money is split in two

Under the settlement, TikTok pays $300 million immediately. The remaining $100 million is contingent: it becomes payable on entry of an order vacating an earlier consent decree against TikTok’s predecessor, Musical.ly.

That history matters. Musical.ly was a short-video app that ByteDance bought in 2017 and merged into TikTok. In 2019 the US government brought a COPPA case against it, which ended in a consent decree — a court-supervised agreement setting out what the company must do. Part of the 2024 lawsuit was that TikTok had not complied with that older order.

Vacating a consent decree removes that ongoing court supervision. So the structure of this settlement is a trade: the government gets a larger payment, and the company gets out from under a legacy order. Whether that is a good exchange is exactly what the reviewing court has to decide, and it is the sort of term that can attract scrutiny.

What a settlement establishes

Less than the headline suggests. A settlement is not a verdict. No court has found that TikTok broke the law, and the company has not conceded that it did. What the parties have agreed is that the litigation ends in exchange for money and undertakings.

That is a normal and often sensible outcome — trials are slow, expensive and uncertain for both sides — but it means the allegations remain allegations. Anyone wanting to know whether the company in fact knowingly collected data from children under 13 will not find the answer here.

The settlement does include non-monetary terms. According to the Justice Department, the company has implemented measures to strengthen safeguards for younger users, improve age-related controls and enhance parental oversight. Associate Attorney General Stanley E. Woodward Jr. called the outcome a major victory for American children and parents.

The company that is being settled with is not the company that was sued

The Justice Department itself made this point, noting that since the 2024 complaint TikTok has undergone significant changes to its ownership, management, compliance functions and privacy practices.

In January 2026, under a deal brokered by the Trump administration, ByteDance sold a majority stake in TikTok’s US business to non-Chinese investors, including Oracle, Silver Lake and Abu Dhabi’s state investment firm MGX, with each holding around 15 per cent as managing investors. ByteDance retained 19.9 per cent. The restructuring, which created a majority American-owned joint venture, was designed to satisfy the US divest-or-ban law that took effect in January 2025 — a national security matter entirely separate from children’s privacy.

The practical effect is that the entity paying is substantially different from the one accused, which is part of why the government describes the intervening changes as having advanced the public interest behind the case.

Where this sits

For scale: in 2021 ByteDance settled a cluster of US class actions over user privacy for $92 million. This is more than four times that, and among the largest COPPA recoveries recorded.

It is also one item in a long queue. TikTok faces separate state-level litigation, including a Florida suit alleging violations of that state’s child social media law, and the broader wave of cases against major platforms over harm to young users continues. A $400 million payment is a large number in absolute terms and a modest one against the revenues of a platform of this size — which is the standard critique of privacy enforcement by fine, and the reason the non-monetary terms are the part worth watching.

Sources: US Department of Justice; CNN; Axios; Variety.