A $400 million privacy settlement is a number that makes headlines. It does not delete the data already collected, change the algorithm overnight, or stop the next platform from copying the playbook. The DOJ’s settlement with TikTok and ByteDance is one of the largest COPPA (Children’s Online Privacy Protection Act, the US law governing data collection from kids under 13) cases on record. It is also the second time the same company has paid a fine for the same kind of behavior. That history matters more than the dollar figure.
The original complaint, filed in 2024, accused TikTok of letting children under 13 create standard accounts, tracking them, collecting personal data without parental consent, and ignoring deletion requests. None of that is in dispute as part of the settlement. What is in dispute is what comes next, and what parents should actually do with this news.
What changed versus 2019
In 2019, Musical.ly paid the FTC (Federal Trade Commission) $5.7 million for essentially the same set of problems: kids under 13 on standard accounts, no parental consent, no working deletion flow. Musical.ly became TikTok. The complaint in this round says the pattern continued after the 2019 settlement, which is the part that should make any parent stop and read twice. A company that paid once for a behavior and then kept doing the behavior is not a company that learned a lesson. It is a company that decided the second fine was cheaper than the fix.
That is the framing I want to leave with you. The settlement is real. The number is real. The history of repeat behavior is also real, and it tells you more about the next year than the press release does.
Reading the actual settlement terms
The announcement reads like a clean win. $400 million, a public statement from the DOJ, references to platform improvements. The mechanics under the announcement are less tidy.
Of the $400 million, $300 million is firm and due under the settlement. The remaining $100 million is contingent (it only happens if a future court vacates the 2019 Musical.ly consent decree, which is the formal legal term for the agreement that settled the first case). So the maximum is $400 million. The floor, if the 2019 decree survives, is $300 million. That is the headline number versus the likely number, and most outlets will print the headline.
There is also no admission of liability (the company is not conceding that the alleged behavior actually happened). The DOJ’s statement references “changes to ownership, data management, and legal compliance” since 2024. None of those changes were published in detail. The platform took the money, did not confess, and will roll out whatever policy updates it wants on its own timeline. Parents reading this should hold onto the gap between “paid the government” and “is now safe for your kid.”
- Two payments, not one. The first $300 million is due. The second $100 million depends on a court ruling about the 2019 case.
- No admission of guilt. TikTok settled without conceding that the alleged facts were true.
- No published policy changes. The DOJ named the kinds of updates TikTok claims to have made, without listing the specifics.
- No retroactive data deletion. Information collected before the settlement is still out there.
Why age gates keep failing
I have written about age verification (the process of confirming a user’s age, usually through a birthdate field or ID upload) before, and the conclusion stays the same. Most platforms rely on self-reported birthdates. A child who says they are fifteen is treated as fifteen. Even when a platform adds ID upload, the friction kills adoption. Kids borrow a parent’s phone, spoof a date, or just create the account on a friend’s device. The technical control does not catch the human behavior.
The deeper problem is that COPPA assumes a parent in the loop. The law only works if a parent is paying enough attention to approve data collection for their child. That is a reasonable design for a 1998 law, before every kid had a smartphone. In 2026, the loop is silent for most families. The law has not caught up with how devices actually get used. A settlement does not close that gap. A working ID-verification system would, and none of the major platforms have shipped one that survives contact with real teenagers.
- Self-reported birthdates are not a control. Any kid who wants to lie can lie.
- ID upload kills adoption. Requiring a parent’s driver’s license to make an account means most kids just use a different platform instead.
- Borrowed devices bypass everything. If a friend’s account is already 18-plus, the age gate does not apply.
- COPPA assumes a parent in the loop. In 2026, that assumption is shaky.
What parents can actually do this week
The settlement is settled. There is nothing parents can do to undo what was collected between 2019 and 2024. There are three concrete things you can do to make the next year less leaky.
First, set up TikTok’s Family Pairing if your kid uses the app. Both phones need to be in the same room because the link uses a QR code. Once linked, you can restrict direct messages, screen time, and content visibility. It is not airtight, but it raises the friction for an underage account to slip past you.
Second, set a device-level screen time limit on top of whatever TikTok offers. iOS Screen Time and Android Digital Wellbeing (the phone maker’s built-in screen time controls) are independent of the app. If TikTok changes its parental controls tomorrow, your phone-level limit still works.
Third, ask your kid what they post and who they talk to. A weekly five-minute conversation catches more than any setting, because it surfaces the social graph (the map of who follows whom and who messages whom) you cannot see from the outside. None of those three steps depend on the settlement. They all happen on your phone and in your house.
- Family Pairing needs both phones. It is a QR-code handshake, not a remote setting.
- Restricted Mode filters mature content. It is not the same as supervised content.
- Device-level screen time is independent of TikTok. Set it as a backup, not a substitute.
- A weekly conversation catches what settings miss. Algorithms change. Stories from your kid do not.
Trade-offs
The settlement is a payment. It is not a fix. The data from 2019 to 2024 is gone, by definition. The algorithm changes that the DOJ referenced are still secret. The next platform that copies this playbook will end up in the same courtroom in 2030, and the headline will be another giant number.
For parents, the path through this is the same path it has always been. Pick a parental control tool. Configure it on the phone. Have the conversation. Repeat. None of that is what a press release wants to hear. All of it is what actually keeps a kid’s data off a third-party server.
- The settlement does not return data. Anything collected before the deal stays where it was.
- The algorithm changes are not public. TikTok chose what to publish and when.
- The pattern has happened before. Musical.ly paid $5.7 million in 2019. The same parent company is paying $300+ million now.
- Headlines will not protect your kid. The settings on your phone will.