The U.S. Department of Justice announced a $400 million settlement with TikTok, ByteDance, and affiliated companies over allegations that they violated the Children’s Online Privacy Protection Act (COPPA).

The TikTok social media platform, owned by the Chinese technology company ByteDance, allows users to create, watch, and share short-form videos.

In 2024, the U.S. Department of Justice filed a lawsuit against TikTok and its parent company, alleging violations of COPPA dating back to 2019.

In 2019, Musical.ly, TikTok’s predecessor, agreed to a $5.7 million settlement with the Federal Trade Commission (FTC) over allegations of illegally collecting personal data from users under 13 without parental consent.

Last year, the FTC referred a new investigation to the DoJ, claiming that TikTok continued to breach COPPA rules despite its 2019 commitment to comply with the rules.

As a result of the investigation, the DoJ alleged that TikTok knowingly allowed children under 13 to create regular accounts outside its restricted “Kids Mode,” collected and retained their personal information without parental consent, failed to delete accounts and data when parents requested it, and maintained inadequate procedures for finding and removing underage accounts.

The newly announced agreement resolves the litigation, with the DoJ now recognizing that TikTok has made significant changes to its ownership, data management, and legal compliance operations since 2024.

The U.S. state also recognized that TikTok implemented important changes to its privacy retention practices, improved age-related controls, and strengthened parental oversight.

As part of the settlement agreement, one of the largest ever for COPPA cases, TikTok will now pay $300 million immediately, and another $100 million if a court vacates an earlier consent decree involving its predecessor, Musical.ly.

“Companies that collect children’s personal information must comply with the law,” stated Assistant Attorney General Brett A. Shumate.

“This resolution secures a significant monetary recovery and reflects the Department’s commitment to ensuring children receive the full protections that Congress mandated.”

The announcement notes that the settlement resolves only allegations, and there has been no judicial determination that TikTok or ByteDance is liable.

Once attackers have valid credentials, only 37% of their actions are blocked

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report