TikTok will pay up to $400 million to settle US claims it collected children's data, one of the largest COPPA settlements yet
The US Justice Department announced on 21 August that TikTok and ByteDance will pay up to $400 million to resolve a 2024 lawsuit accusing them of letting under-13s make accounts and collecting kids' data without parental consent, in breach of the COPPA child-privacy law and an earlier settlement. The deal is $300 million now plus $100 million tied to lifting an old consent order, adds new age checks and parental controls, and, notably, requires no admission of wrongdoing.
On 21 August 2026, the US Department of Justice said TikTok and its parent ByteDance agreed to pay $400 million to settle a lawsuit, first filed in 2024, alleging they violated the Children's Online Privacy Protection Act (COPPA). The government alleged TikTok let millions of children under 13 create accounts and collected their personal data without the parental consent the law requires, including data gathered in the app's "Kids Mode," and that this also broke an earlier settlement tied to TikTok's predecessor, Musical.ly. The payment is structured as $300 million now and $100 million once a court vacates that older order. The DOJ called it one of the largest COPPA recoveries ever. The settlement also requires stronger age checks, extra safeguards for young users and better parental oversight, but it does not require TikTok or ByteDance to admit wrongdoing.
A $400 million cheque for mishandling children's data is a big number even by big-tech standards. Here is what the TikTok settlement actually covers, how it is structured, and what it does and does not resolve.
What the settlement is about
According to the Justice Department's announcement, TikTok and ByteDance will pay $400 million to end litigation the government brought in 2024. The core allegation is a violation of COPPA, the Children's Online Privacy Protection Act, the US law that requires online services to obtain verifiable parental consent before collecting personal information from children under 13.
The DOJ said TikTok:
- Allowed millions of under-13s to create regular TikTok accounts, rather than reliably keeping them out.
- Collected personal data from children, including from users in the app's restricted "Kids Mode," without the required parental consent.
- In doing so, also breached an earlier settlement the company was already bound by, tied to its predecessor app, Musical.ly.
That last point is the backstory: Musical.ly, which merged into TikTok, had already settled COPPA charges with the Federal Trade Commission back in 2019 (a then-record $5.7 million penalty) and was operating under a consent order. The 2024 case argued TikTok kept violating children's-privacy rules despite that order.
How the money is structured
The $400 million is not a single lump sum. As reported from the settlement terms, TikTok will pay $300 million immediately, with a further $100 million due once a court enters an order vacating the older Musical.ly consent decree. In other words, part of the payment is tied to formally closing out the previous case.
The DOJ described the total as one of the largest recoveries ever obtained under COPPA. For scale, it tops the previous headline COPPA penalties in the US, the $170 million Google and YouTube paid in 2019 and the $275 million COPPA penalty Epic Games paid over Fortnite in 2022 (which was part of a larger $520 million FTC settlement that also covered separate charges). Two caveats on the "largest" framing: the comparison holds specifically for COPPA penalties, and only $300 million of TikTok's figure is guaranteed, with the other $100 million contingent on the court vacating the old order.
What TikTok has to change, and what it did not have to concede
Money aside, the settlement imposes non-monetary obligations meant to actually change how the platform treats minors: stronger age-related controls to keep under-13s out, additional safeguards for young users, and measures giving parents more oversight of their children's activity and personal information. Those product changes, if enforced, may ultimately prove more consequential for families than the dollar figure.
One detail cuts the other way, though, and it is standard for cases like this: the agreement does not require TikTok or ByteDance to admit wrongdoing. They pay, they change some practices, and they close the case without conceding the legal allegations. That is a common outcome in regulatory settlements, but it is worth stating plainly rather than reading "settlement" as "admission."
It is also worth noting the timeline neutrally: the suit was filed in 2024 under the previous administration's Justice Department and has now been settled, the kind of long tail these enforcement cases usually have.
Why it matters
Strip away the specific company and the pattern is the one to watch: children's data is now an expensive thing to get wrong. This lands amid a broader wave of scrutiny of how platforms treat minors, from age-verification laws to the Meta child-safety trial, and a $400 million COPPA figure sets a marker for what non-compliance can cost. It does not, by itself, prove any particular platform is now safe for children, and a settlement without an admission leaves the underlying legal questions untested in court. But as a signal to the industry about the price of collecting kids' data without consent, the number speaks clearly.
The settlement at a glance
| Announced | 21 August 2026, by the US Department of Justice |
| Who pays | TikTok and its parent ByteDance |
| Amount | Up to $400 million ($300M guaranteed now + $100M contingent on vacating the old Musical.ly consent order) |
| Law | COPPA (Children's Online Privacy Protection Act), consent required to collect under-13 data |
| Allegations | Let under-13s make accounts; collected kids' data (incl. "Kids Mode") without parental consent; breached a prior order |
| Origin | Lawsuit first filed in 2024 |
| Non-monetary terms | Stronger age checks, extra safeguards for minors, more parental oversight |
| Admission of wrongdoing | None required |
| Scale | DOJ calls it one of the largest COPPA recoveries ever (above the 2019 $170M YouTube and 2022 $275M Epic COPPA penalties) |
Frequently asked questions
What is COPPA?
The Children's Online Privacy Protection Act, a US law that requires online services to get verifiable parental consent before collecting personal information from children under 13, and to handle that data carefully. The Federal Trade Commission administers it, and the Justice Department litigates cases like this one.
What did TikTok allegedly do wrong?
The DOJ alleged TikTok let millions of children under 13 create accounts and collected their personal data, including from the app's "Kids Mode," without the parental consent COPPA requires, and that this also violated an earlier settlement tied to its predecessor app Musical.ly.
Did TikTok admit wrongdoing?
No. The settlement requires payment and changes to how the platform handles minors, but it does not require TikTok or ByteDance to admit the allegations. That is common in regulatory settlements.
Why is the payment split into $300 million and $100 million?
TikTok pays $300 million now, and a further $100 million once a court formally enters an order vacating the older Musical.ly consent decree, so part of the sum is tied to closing out the previous case.
Is $400 million a lot for a child-privacy case?
Yes. The DOJ called it one of the largest COPPA recoveries ever obtained; it tops the previous notable US COPPA penalties, the $170 million paid by Google/YouTube in 2019 and the $275 million COPPA penalty paid by Epic Games in 2022 (part of a larger $520 million FTC settlement). Note that only $300 million of TikTok's figure is guaranteed, with $100 million contingent.
Meta's child-safety trial is under way, and the states revealed what they will seek: about $200 billion
Opening statements in the 29-state case against Meta began on 18 August in Oakland. The headline moment was financial: after months of only Meta's $1.4 trillion worst-case figure being public, the state coalition signalled it could seek around $200 billion, roughly three years of Meta's after-tax profit. California's deputy attorney general told an eight-person advisory jury that Meta was built to 'hook the users, hold them, harvest their data, and then hide the truth.' Meta calls the claims unsubstantiated. Nothing is decided; this is the argument beginning, not ending.
Three crypto breaches exposed the names and home addresses of about 250,000 customers. No coins were stolen, but the leaked data fuels phishing and, for large holders, physical 'wrench attacks'
Between 13 and 16 August, SafePal, Trezor's shipping partner ShipMonk, and Israel's Bits of Gold each disclosed data breaches, together exposing about a quarter of a million customers' names, phone numbers and physical shipping addresses. No wallets were drained and no keys were stolen. The harm is downstream: for the Bits of Gold cohort, whose national ID and bank details also leaked, identity theft and fraud; for many, convincing targeted phishing; and, for identifiable large holders, the physical 'wrench attacks' researchers say are rising. Two of the three breaches are linked to the same critical Metabase flaw, CVE-2026-72898.
Poland calls the MyDr breach one of its largest ever, with nearly 19 million people potentially exposed
A cyberattack on MyDr, a company whose software is used by more than 12,000 Polish medical facilities, may have exposed the personal and medical data of nearly 19 million people. The digital affairs minister called it one of the largest incidents in the country's history. Here is what officials have confirmed, what is still only claimed, and why a breach at one private vendor can reach so many patients at once.