The Justice Department announced Friday a $400 million settlement with TikTok and its Chinese parent company ByteDance to resolve allegations that the platform violated the Children’s Online Privacy Protection Act — marking one of the largest COPPA recoveries in history. But the settlement, negotiated under the Biden administration and finalized months into President Donald Trump’s second term, reveals more about the structural limits of American tech regulation than it does about accountability.
What Happened
The DOJ’s complaint, filed in August 2024, alleged that TikTok knowingly permitted children under 13 to create accounts and collect their personal information — including location data, device identifiers, and browsing history — without obtaining verifiable parental consent as required by COPPA. The settlement requires TikTok to pay $300 million immediately, with an additional $100 million due upon entry of a court order vacating a 2019 consent decree against Musical.ly, the lip-sync app ByteDance acquired and merged into TikTok in 2018. That earlier decree, secured by the Federal Trade Commission, had already imposed a $5.7 million penalty for identical COPPA violations — a fact that underscores the recidivism at the center of this case.
Under the agreement, TikTok must also implement a comprehensive compliance program, including annual third-party audits, enhanced age-gating mechanisms, and a dedicated children’s privacy officer reporting directly to the board. The company neither admitted nor denied liability. In a statement, TikTok spokesperson Alex Haurek characterized the settlement as resolving “legacy issues” and emphasized the platform’s “industry-leading protections for young users.”
Why It Matters
The $400 million figure will dominate headlines, but the settlement’s structural terms deserve closer scrutiny. COPPA, enacted in 1998 and updated in 2013, caps civil penalties at $50,120 per violation — a figure adjusted for inflation but still trivial against the revenue scale of a platform generating an estimated $16 billion in U.S. advertising revenue annually. Even at $400 million, the penalty represents roughly 2.5% of a single year’s domestic ad revenue. For ByteDance, valued at approximately $220 billion in its most recent funding round, the settlement is a rounding error — the cost of doing business in the world’s most lucrative digital advertising market.
More consequential is the compliance framework. The consent decree mandates architectural changes: TikTok must disable algorithmic recommendation engines for users under 13, restrict data collection to what is “reasonably necessary” for service provision, and delete personal information collected from child users within 90 days. These provisions, if enforced, strike closer to the platform’s core business model than any fine. The algorithmic feed — the engine of TikTok’s engagement and advertising dominance — is explicitly constrained for the youngest users. Whether the company can segregate its under-13 user base without degrading the experience that drives growth remains an open engineering and economic question.
The settlement also arrives at a precarious political moment. President Trump, who in 2020 attempted to ban TikTok via executive order over national security concerns, has since reversed course — crediting the platform with helping him win younger voters in 2024. His administration has signaled a broader deregulatory posture toward Big Tech, with FTC Chair Andrew Ferguson and DOJ Antitrust Chief Gail Slater both indicating a preference for “targeted enforcement” over sweeping rulemaking. Career staff at both agencies, who spent years building the TikTok case, now operate under leadership that has publicly questioned the premises of their work. The settlement may represent the high-water mark of federal children’s privacy enforcement for years to come.
Historical Context
This is not the first time a landmark COPPA settlement has failed to produce systemic change. In 2019, Google and YouTube paid $170 million to resolve FTC and New York Attorney General allegations — then the largest COPPA penalty. Five years later, researchers at the University of California, Berkeley found that YouTube’s recommendation system continued to surface child-directed content to users of all ages, and that data collection practices on “made for kids” channels remained opaque. The FTC’s 2020 COPPA Rule Review, prompted in part by that settlement, concluded without substantive updates to the regulatory framework.
The Musical.ly precedent is even more direct. The 2019 consent decree required the company to delete data collected from children, implement age gates, and obtain parental consent. ByteDance acquired Musical.ly months later, rebranded it as TikTok, and — according to the DOJ’s 2024 complaint — continued the same violations at vastly greater scale. The $5.7 million penalty did not deter recurrence. The $400 million penalty may not either, absent structural remedies that alter the platform’s economic incentives.
What to Watch
Three developments will determine whether this settlement becomes a turning point or another footnote. First, the compliance monitor. The consent decree requires an independent third-party auditor approved by the DOJ — but the selection process, scope of authority, and reporting transparency remain undefined. In the Google-YouTube case, the monitor’s reports were never made public, limiting external accountability. Second, state enforcement. The DOJ settlement does not preclude state attorneys general from pursuing parallel actions under COPPA or state consumer protection laws. California’s Attorney General, Rob Bonta, has already signaled intent to investigate TikTok’s compliance with the California Consumer Privacy Act’s provisions on minors’ data. A multi-state coalition could impose requirements the federal settlement does not.
Third, and most consequential, is the pending federal legislation. The Kids Online Safety Act (KOSA) and COPPA 2.0 — both passed by the Senate in 2024 but stalled in the House — would impose a duty of care on platforms, raise the age of protection to 17, and create a private right of action. President Trump has not endorsed either bill, and House Republican leadership has expressed skepticism about “expanding the regulatory state.” If Congress fails to act, the TikTok settlement stands as the ceiling of federal enforcement — a ceiling defined by negotiated consent decrees rather than statutory mandate.
Key Takeaway
The TikTok settlement is a tactical victory for career prosecutors who built a rigorous case under existing law. But it is a strategic reminder that in the absence of legislative modernization, COPPA enforcement remains a game of whack-a-mole — extracting increasingly large checks from companies for whom the fines are a manageable operating expense. Until Congress raises the cost of non-compliance beyond the revenue generated by children’s data, or imposes structural obligations that cannot be settled away, each record-setting penalty will simply set the baseline for the next one.
