TikTok to pay $400 million to settle US children's privacy lawsuit
The largest COPPA recovery to date shows why age gates, deletion workflows and data minimisation are engineering problems as much as legal ones.
The US Department of Justice announced on Friday that TikTok, owned by ByteDance, has agreed to pay $400 million to resolve a lawsuit over its handling of children's personal data, The Hacker News reported on 22 August. The payment is split in two parts: $300 million is due immediately, and a further $100 million becomes payable once a court vacates an earlier consent decree that had been entered against Musical.ly, the app TikTok absorbed.
The case dates to August 2024, when the DOJ and the Federal Trade Commission filed a complaint accusing TikTok of large-scale intrusions into children's privacy. According to the complaint, the company knowingly let users under 13 open accounts and gathered data from children using its "Kids Mode" experience. The government also alleged that TikTok and ByteDance did not act on parents' requests to delete their children's accounts and associated information.
TikTok contested the allegations when the suit was filed, saying many of the claims concerned past practices that were either inaccurate or had already been addressed. The DOJ described the outcome as one of the largest recoveries ever obtained under the Children's Online Privacy Protection Act, the US law that governs the collection of personal information from children under 13.
The settlement notice also pointed to changes the platform has made since the complaint was filed, including additional safeguards for younger users, tighter age controls and expanded parental oversight features. Details of any ongoing compliance monitoring, or of how the payment will be distributed, were not included in the report.
Why it matters
Privacy enforcement is increasingly measured in the hundreds of millions of dollars, and regulators are treating age verification and data deletion as operational obligations rather than policy statements. For engineers, this shifts responsibility onto the systems that classify users, store their data and honour deletion requests. Expect more scrutiny of how consumer platforms prove, with logs and audits, that they actually did what their privacy policy promised. The gap between a written policy and the code that enforces it is now where the liability lives.
- Paid immediately$300M
- Paid once the Musical.ly consent decree is vacated$100M
Figures: US Department of Justice announcement, as reported by The Hacker News
What you can learn from this
- Age gating is a classification problem with asymmetric costs. A platform that asks a user for a birthdate is running a very weak classifier, because the input is self-reported and easy to falsify. Stronger signals, such as behavioural patterns, account linkages or verified parental consent, reduce the chance of a false negative (a child treated as an adult) but also add friction and collect more data. Regulators tend to punish false negatives far more than false positives, which is why "knowingly allowing" under-13 users carries such weight in COPPA actions.
- Deletion requests are only as good as the data map behind them. When a parent asks for a child's account to be removed, the request has to reach every place that data lives: primary databases, caches, search indexes, analytics warehouses, backups and third-party processors. If a system has no authoritative inventory of where personal data flows, a deletion job silently misses copies and the organisation cannot prove compliance. This is why privacy engineering starts with data lineage rather than with a delete button.
- Data minimisation reduces both risk and cleanup cost. Collecting less personal information in the first place means fewer records to protect, fewer places to purge and a smaller blast radius if something goes wrong. In practice this means designing features so they work with the coarsest data that still serves the purpose, for example an age band rather than a full birthdate, or session-scoped identifiers rather than persistent ones. Systems built this way are cheaper to audit because there is less to account for.
- Consent decrees and settlements create long-lived technical obligations. A settlement is rarely a one-time payment; it usually binds the company to specific practices, reporting cadences and sometimes independent assessments for years. The reference to vacating the earlier Musical.ly decree shows how obligations inherited through an acquisition can persist long after the original product disappears. Engineering teams inherit these commitments too, often as requirements that appear in tickets without much explanation of their origin.
- Auditability is a feature you have to build on purpose. Regulators and courts ask for evidence: when the account was created, what age signal was recorded, when the deletion was requested and when it completed. If those events are not logged in a tamper-evident way, the organisation is left arguing from memory. Append-only audit logs, retention rules for those logs and a clear owner for each data flow turn a legal question into a query you can actually run.
We teach this
How to use this in practice
- Draw the data map for one feature you own. Pick a feature that touches user profile data and sketch every store it writes to: the main database, caches, queues, analytics events, logs and any vendor. Then trace what happens when that user is deleted and mark each store as "purged", "anonymised" or "unknown". Done looks like a one-page diagram with no "unknown" boxes left, or a list of the ones you found and who owns them.
- Test your deletion path end to end. Create a throwaway account in a development environment, generate some activity, then trigger the deletion flow and query each store you mapped above. Look especially at search indexes, analytics tables and object storage, which are the usual places where records linger long after the main row is gone. Done means a short script or checklist that returns zero rows for the deleted identifier in every store, which you can rerun after future changes to catch regressions.
- Audit the age signal your application collects. Find where a user's age or birthdate is captured, how it is validated and what happens when the value indicates a minor. Check whether the decision is logged with a timestamp and whether a changed birthdate re-triggers the check. Done means a written note of the current behaviour plus at least one gap, such as a missing log line or an unhandled edge case, filed as an issue.
- Read the primary source, not the headline. Spend twenty minutes with the original 2024 complaint and the settlement announcement on the DOJ website, and list the specific practices the government objected to. Translate each into a question you could ask about any product you work on, such as "what happens when a parent emails asking for deletion?" or "which table records the age a user gave us?". Done means a five-question checklist you can reuse when reviewing a new feature, saved alongside your team's definition of done so it is actually consulted.
Sources
- TikTok Agrees to $400 Million Settlement in U.S. Child Privacy Lawsuit — The Hacker News
Our reporting is an original summary; full coverage is at the links above.
Don't just read about it — build it.
Square 1 teaches the skills behind the headlines, with every line of your work graded by AI. Find your starting point in 3 minutes.
Get your free skill report