A Second Strike Under the Same Law
On August 21, 2026, the Justice Department announced that TikTok and parent company ByteDance will pay $400 million to resolve a federal lawsuit alleging violations of the Children's Online Privacy Protection Act (COPPA) — $300 million payable immediately, with a further $100 million due once a court vacates a prior consent decree against TikTok's predecessor, Musical.ly (DOJ). Associate Attorney General Stanley E. Woodward Jr. called it "a major victory for American children and parents."
The underlying suit, filed August 2, 2024 in the Central District of California, alleged TikTok let children evade its own age gate, collected personal data from under-13 users without verifiable parental consent, and — critically — kept processing that data even after learning specific accounts belonged to children, including inside the platform's supposedly locked-down "Kids Mode" (Hunton). The government sought civil penalties of up to $51,744 per violation, per day, running back to January 2024 — a figure that, multiplied across millions of accounts, dwarfs the $400 million actually collected.
This is not TikTok's first COPPA reckoning. In February 2019, the FTC fined Musical.ly $5.7 million — then a record children's-privacy penalty — for the same category of conduct: knowingly hosting under-13 users without parental consent. That case produced the consent decree DOJ says TikTok kept violating for years afterward.
What the Government Got Right
COPPA is not an ambiguous or novel statute. Enacted in 1998, it requires "verifiable parental consent" before a service collects personal information from a child under 13, and it gives parents an enforceable right to have that data deleted (15 U.S.C. § 6502). The strongest case for this settlement is that TikTok wasn't caught in a gray area — it was caught doing the exact thing a 2019 consent decree already told it to stop doing. A platform that generates billions of dollars from engagement has an obvious incentive to look the other way on age verification, and a regulator that lets a second violation of the same order go unpunished invites a third. Data collected from an eight-year-old without parental knowledge is a real harm — for stalking risk, targeted advertising, and permanent data trails a child never consented to — not a technicality.
Where Proportion Matters
Still, two things about this settlement deserve scrutiny rather than applause on their own terms. First, $400 million is real money, but TikTok's global advertising revenue runs into the tens of billions annually — this settlement functions as a cost of doing business rather than a deterrent-level penalty, and the $100 million second tranche is explicitly conditioned on getting the old consent decree lifted, which reads less like accountability and more like a negotiated exit from ongoing court supervision.
Second, and more importantly for the broader policy debate: this is what functioning enforcement of an existing, narrowly-scoped privacy statute looks like, and it should be read as an argument against — not for — the sprawling "platform duty of care" and content-moderation mandates now circulating in Congress under banners like the Kids Online Safety Act. COPPA works precisely because it is procedural and narrow: it regulates data collection practices (consent, notice, deletion), with clear, auditable obligations a court can measure a company against. DOJ didn't need to litigate what content harms children, censor recommendation algorithms, or impose vague "reasonable care" standards to win $400 million — it needed evidence that TikTok collected data from known children without consent and didn't delete it. That is a factual, falsifiable claim, not an editorial judgment.
Don't Let This Become the Case for KOSA
The risk is that this settlement gets cited in the coming legislative session as proof that Congress needs to go further — layering content-based duty-of-care obligations on top of COPPA's data rules. That would be a mistake. COPPA succeeded here because it stayed in its lane: data minimization and consent, enforced with real penalties, adjudicated on facts. A duty-of-care standard tied to content a minor might see, by contrast, pushes platforms toward blanket age-verification systems and default over-moderation to avoid liability — chilling speech for adults and teenagers alike in the name of protecting under-13 users already covered by COPPA.
Bottom Line
TikTok's $400 million settlement is a legitimate, evidence-based enforcement action against conduct a court already told the company to stop. It's a good outcome precisely because COPPA is a narrow, well-drafted statute doing exactly what it was built to do — which is the strongest argument for leaving it, and not a broader speech-adjacent mandate, as the primary tool for children's online privacy.