The Justice Department announced on August 21, 2026 that TikTok and its Chinese parent ByteDance will pay $400 million to resolve a 2024 lawsuit alleging the platform let children under 13 open accounts, harvested their data through a supposedly child-safe "Kids Mode," and routinely ignored parental requests to delete that data. DOJ called it "one of the largest recoveries ever obtained" under the Children's Online Privacy Protection Act (COPPA) — and the number backs that up. DOJ's press release puts the figure at more than 70 times the $5.7 million TikTok's predecessor, Musical.ly, paid the FTC in 2019 — at the time itself a record COPPA penalty.
The Steelman for Aggressive Enforcement
The case for treating this as a floor, not a ceiling, is straightforward. COPPA exists because children can't meaningfully consent to data collection, and "Kids Mode" was marketed as the safe harbor that let TikTok claim compliance while, DOJ alleged, still ingesting behavioral and device data from users the company knew were under 13. A platform with TikTok's reach — and its 2019 history with the exact same statute — arguably earned a penalty large enough to change the economics of the decision, not just absorb it as a cost of doing business. Sen. Ed Markey and other COPPA advocates have long argued that penalties calculated as a fraction of ad revenue are the only signal platforms actually respond to. On that logic, $400 million is the number that finally clears the bar.
Where the Structure Complicates the Punitive Story
But the settlement's mechanics tell a more proportionate story than the headline number suggests. Only $300 million is due immediately; the remaining $100 million is contingent on a prior FTC order — the 2019 consent decree tied to the Musical.ly acquisition — being formally vacated, per DOJ's own announcement. That is not how a punitive fine is normally built. Fines are owed on the date of judgment; here, a quarter of the total is deliberately deferred and tied to procedural cleanup of the very order TikTok was accused of violating. TechCrunch's reporting on the deal notes explicitly that the agreement does not require TikTok or ByteDance to admit wrongdoing — standard in civil settlements, but worth noting alongside a number DOJ is billing as historic.
More telling: DOJ's own statement credits TikTok with having "undergone significant changes to its ownership, management, compliance functions and privacy practices" since the 2024 complaint was filed, crediting "extensive measures" on age verification and parental oversight, according to Engadget's coverage. That timeline lines up with the platform's 2026 restructuring into a majority US-owned entity backed by Oracle and Silver Lake, with ByteDance retaining roughly a 19.9% stake — a deal negotiated separately, under a different statute, for different reasons, but one that plainly gave DOJ more confidence a settlement would stick than a straight monetary penalty against ByteDance alone would have.
The Real Signal Is the Ceiling, Not the Total
The more useful number for assessing deterrence isn't $400 million — it's the FTC's current COPPA civil penalty cap: up to $53,088 per violation per day, per the agency's enforcement framework as summarized by Reed Smith's analysis of the FTC's amended COPPA Rule that took effect in June 2025. Multiply that per-violation cap across millions of under-13 accounts collecting data over years, and $400 million is almost certainly a steep discount from statutory maximum exposure — which is exactly what a negotiated settlement with a cooperating, restructuring defendant should look like. Regulators routinely accept a fraction of theoretical maximum liability in exchange for a fast resolution and forward-looking compliance commitments, rather than years of appeals that delay both payment and remediation.
What This Means Going Forward
The amended COPPA Rule — requiring separate verifiable parental consent before sharing children's data with third parties, and new data-retention limits — took effect only in mid-2025, meaning this settlement was negotiated under the old regime and enforced under a statute now materially stricter. The FTC has already brought two more COPPA cases since, against Disney and Apitor Technology, in the weeks after the rule change. That pattern — not the $400 million figure — is the better predictor of what comes next: penalties calibrated to genuine harm and verified compliance improvements, layered on a rule that gives platforms clearer, narrower obligations than the ambiguous "actual knowledge" standard courts have wrestled with for two decades. A COPPA regime that rewards demonstrated compliance change alongside real penalties, rather than one that treats every settlement as a chance to extract maximum headline value, is the version most likely to survive appellate scrutiny and actually change platform behavior — which is the point regulation is supposed to serve.