The Department of Justice and ByteDance agreed to a landmark $400 million consent decree resolving federal allegations of children’s online data privacy violations under COPPA.
WASHINGTON — The Department of Justice and the Federal Trade Commission have secured a $400 million settlement with TikTok Inc. and parent company ByteDance Ltd., resolving extensive federal litigation over alleged violations of federal child privacy safeguards.
Federal prosecutors filed the comprehensive consent decree in federal district court, marking one of the largest recoveries ever obtained in a federal enforcement action under the Children’s Online Privacy Protection Act (COPPA). Under the terms of the settlement, TikTok will pay an immediate civil penalty of $300 million, with an additional $100 million due upon formal entry of an order vacating a prior 2019 consent decree involving Musical.ly.
Structure of the Federal Settlement
The federal government’s complaint alleged that TikTok knowingly allowed children under 13 to create accounts, collected and maintained their personal information without verifiable parental consent, and failed to honor parental requests to delete children’s data.
In addition to the monetary penalty, the settlement imposes stringent structural requirements on TikTok’s domestic operations. The company must implement comprehensive data deletion protocols, establish independent third-party compliance auditing, and maintain dedicated parental oversight tools.
The enforcement action follows ongoing congressional scrutiny over algorithmic protections for minors, including the Kids Online Safety Act, and debates in school districts expanding AI literacy and online safety courses.
Corporate Compliance and Youth Protections
According to federal filings, TikTok has made substantial revisions to its age-screening mechanisms and account default settings for teen users. Accounts for users under 16 now incorporate default private settings, restricted direct messaging, and daily screen-time limits.
Justice Department officials emphasized that the settlement sends an unambiguous signal to social media platforms regarding compliance with federal child privacy statutes. Federal regulators affirmed that enforcement teams will monitor ByteDance’s compliance through mandatory biennial assessments conducted by an approved independent assessor.
What Happens Next
The consent decree awaits final formal approval by the presiding federal district judge. Once entered, TikTok will begin compliance reporting to the FTC and DOJ on a quarterly basis.
Congressional committees have requested a briefing from the FTC and DOJ regarding implementation timelines and enforcement metrics for algorithmic compliance.
Sources
- U.S. Department of Justice: Consumer Protection Branch Litigation and Regulatory Filings
- Federal Trade Commission: Children’s Online Privacy Protection Act Enforcement Notices
- U.S. District Court: DOJ Office of Public Affairs Case Announcements
- Reuters Technology: Federal Child Privacy Regulatory Coverage
What COPPA Requires — and What TikTok Did Wrong
The Children’s Online Privacy Protection Act prohibits companies from collecting personal information from children under 13 without verifiable parental consent. The law also restricts behavioral targeting of minors and requires companies to delete collected data upon request. The Justice Department’s complaint against ByteDance and TikTok alleged that the platform knowingly allowed children under 13 to create accounts, collected detailed behavioral data on those minors — including location, browsing patterns, and content consumption habits — and failed to implement age verification systems sufficient to prevent underage access despite having the technical capability to do so.
What the Consent Decree Requires
The \$400 million consent decree is not merely a financial penalty — it imposes ongoing compliance obligations that the Department of Justice can enforce through contempt proceedings. Under the decree, ByteDance and TikTok are required to implement enhanced age verification systems, purge previously collected data on users who were minors at the time of collection, restrict data-sharing practices involving minors, and submit to periodic independent compliance audits for a defined period. The consent decree structure is designed to create accountability beyond a single payment, making future violations actionable without requiring DOJ to re-litigate the underlying conduct.
Implications for the Broader Platform Industry
The \$400 million settlement is the largest COPPA enforcement action in the law’s history, surpassing even the FTC’s \$170 million 2019 settlement with Google and YouTube. The scale of the penalty sends a clear signal to other platforms — social media companies, gaming platforms, and streaming services — that COPPA compliance will be treated as a material enforcement priority. Companies including Meta, Snapchat, and YouTube have all faced scrutiny over their handling of minor users, and the DOJ’s willingness to pursue a nine-figure settlement through the consent decree mechanism rather than civil penalty proceedings establishes a new enforcement ceiling.
