TikTok pays $400 million to settle children’s privacy case

TikTok and parent company ByteDance have agreed to pay $400 million to settle US government allegations that the video-sharing platform collected and retained children’s personal information without parental consent.

The settlement resolves litigation brought by the US Department of Justice following an investigation by the Federal Trade Commission (FTC). It ranks among the largest recoveries ever secured in a case involving the Children’s Online Privacy Protection Act (COPPA), according to the DOJ.

Key takeaways

• TikTok and ByteDance have agreed to a $400 million settlement over alleged violations of US children’s privacy law
• The companies will pay $300 million immediately then $100 million under a condition linked to an earlier consent decree
• US authorities alleged that TikTok knowingly allowed millions of children under 13 to use regular accounts
• The complaint accused TikTok of collecting children’s data without parental consent and failing to honor some deletion requests
• The settlement contains no determination that TikTok or ByteDance are liable for the alleged violations

One of the largest COPPA recoveries

Under the settlement, TikTok will pay $300 million immediately. An additional $100 million will become payable if a court enters an order vacating an earlier consent decree involving Musical.ly, TikTok’s predecessor.

The Justice Department described the agreement as one of the largest recoveries ever under COPPA.

COPPA restricts how online services collect, use and disclose personal information belonging to children under 13. Services covered by the law must notify parents and obtain verifiable parental consent before gathering this information. Parents must also be able to request its deletion.

The DOJ and FTC sued TikTok, ByteDance and affiliated entities in 2024, alleging widespread failures to meet those obligations.

The settlement resolves those claims without a trial. The DOJ emphasizes that the accusations remain allegations and that there has been no determination of liability.

What US authorities alleged

According to the original government complaint, TikTok knowingly allowed children under 13 to create regular accounts, post and exchange messages, and interact with adults and other users.

Authorities alleged that the platform collected and retained personal information from these children without properly notifying their parents or obtaining consent.

The government also claimed that TikTok’s guardrails for identifying and removing accounts of underage users were ineffective. In some instances, children could allegedly bypass the platform’s age gate by registering through third-party services such as Google or Instagram, leaving the account holders classified as having an unknown age.

The FTC further alleged that TikTok collected more information than necessary from users of its Kids Mode service, including persistent identifiers and activity data used to build profiles.

Parents who tried to have their children’s accounts and data removed allegedly met complicated procedures, duplicative forms and cases in which TikTok failed to complete deletion requests.

An earlier case involving Musical.ly

The allegations carried additional weight because TikTok’s predecessor, Musical.ly, had already faced government action over child privacy.

In 2019, Musical.ly agreed to pay $5.7 million to settle FTC allegations that it unlawfully collected information from children under 13. The resulting court order required the company to take specific steps to comply with COPPA.

The 2024 lawsuit accused TikTok and ByteDance of breaching both the law and the earlier order.

The DOJ says TikTok has since overhauled its ownership, management, compliance functions and privacy practices. According to the department, the company has strengthened safeguards for younger users, improved age controls and expanded parental oversight.

Reddit case reflects wider pressure on platforms

The TikTok settlement follows a separate major enforcement action against Reddit in the UK.

As we reported earlier this year, Britain’s Information Commissioner’s Office fined Reddit £14.47 million—around $20 million at the time—after concluding that the platform had failed to use children’s personal information lawfully.

The cases involve different laws and allegations, but they share a central concern: simply stating that children under 13 are not allowed on a platform does little if the service can’t reliably identify underage users or protect their data.

Reddit said it planned to appeal the UK fine.

TikTok’s US settlement, meanwhile, ends the litigation without a finding of liability.

What families can do

Enforcement action can push platforms toward stronger privacy safeguards, but parents should not assume that age limits and default settings will keep children safe on their own.

Parents can reduce the risks by:

• Using supervised accounts and built-in family controls where available
• Reviewing privacy, messaging and profile-visibility settings together with their children
• Checking which apps collect location, contacts, photos or other personal information
• Explaining why children should avoid sharing their full name, school, address or daily routine
• Periodically reviewing installed apps, accounts and follower lists
• Reporting underage accounts, unwanted contact or suspected data misuse to the platform

Bitdefender Family Plans help keep your child safe online, protecting them from scams, suspicious links, malicious apps, and other online risks, complete with parental controls to support safer digital habits – and peace of mind for parents.

On topic:

Is your child ready for ride-sharing apps? What parents should know

The online safety act is changing the internet for kids — but families say it’s not enough

Reddit fined $20 million for children’s privacy failures