TikTok's children's privacy settlement leaves COPPA enforcement open

A 2019 complaint against Musical.ly took seven years, two corporate mergers, and a change of administration to resolve. The number at the end was four hundred million dollars — three hundred paid immediately, one hundred contingent on a prior consent decree being vacated. Associate Attorney General Stanley Woodward Jr. called it a major victory for American children and parents. That framing is worth examining before accepting it.

The original case was filed under the Children's Online Privacy Protection Act, which requires verifiable parental consent before any personal information is collected from a child under thirteen. What the DOJ and FTC alleged was not an edge case — accounts in a mode explicitly designed for children under thirteen were still collecting email addresses. The "Kids Mode" label was doing the opposite of what it promised.

ByteDance acquired Musical.ly in 2017, merged it into TikTok, and inherited the liability. The 2024 suit updated the complaint to reflect the combined entity. What you are looking at in this settlement is not a tech company paying for a mistake. You are looking at the accumulated cost of a product decision made at scale, across years, with full knowledge of the regulatory framework.

The DOJ noted that TikTok has made significant changes to ownership structure, compliance functions, and privacy practices since the suit was filed. That sentence does a lot of work. It is the mechanism by which a settlement becomes possible — the company demonstrates it is no longer doing the thing it was sued for — but it does not establish what changed and what did not. Whether the parental consent controls are now technically compliant or genuinely protective are different questions, and this settlement does not answer the second one.

Here is where I break from the "major victory" read: four hundred million dollars against ByteDance's revenue base is a compliance cost, not a deterrent. The structural question COPPA was designed to answer — whether platforms can be trusted to self-enforce age restrictions on data collection — remains as open after this settlement as before it. The consent decree being vacated as part of the deal is the detail that matters most. The prior decree was the enforcement mechanism. Its removal, contingent on a payment, is a cleaner ledger for TikTok, not a stronger one for regulators.

The more durable outcome here is what it signals to every other platform with an active children's data practice: that a COPPA enforcement cycle, end to end, costs roughly this much, takes roughly this long, and resolves in a payment rather than a structural injunction. That is the number the industry will actually use.