TikTok settles US claims over how it collected children’s data

$400 million

The Justice Department alleged that TikTok did not follow the Children’s Online Privacy Protection Act and its rules on collecting personal information from children. TikTok agreed to pay $400 million: $300 million straight away and $100 million when an earlier consent decree is vacated. The department also pointed to changes TikTok had already made, including stronger age controls and more parental oversight.

On 21 August 2026, the U.S. Department of Justice announced a $400 million settlement with TikTok, its parent company ByteDance and related companies. The case is in the U.S. District Court for the Central District of California, where the department filed its complaint in 2024 after a referral from the Federal Trade Commission. The department called the settlement one of the largest amounts ever recovered under the Children's Online Privacy Protection Act, known as COPPA.

According to the complaint, as the FTC described it in August 2024, TikTok let millions of children under 13 onto its app without telling their parents or getting their consent. It claimed that children could get past the age screen by signing in with a Google or Instagram account, and that these accounts were then labelled "age unknown". It also alleged that even in Kids Mode, the version of the app for younger children, TikTok collected more data than it needed and shared some of it with companies such as Facebook and AppsFlyer to bring users back. Parents who asked for a child's account to be deleted, it said, faced extra forms and often saw nothing happen.

To resolve the claims, TikTok agreed to pay $400 million: $300 million straight away and $100 million once the court sets aside an earlier consent decree against Musical.ly, the app TikTok grew out of. The department said TikTok had already made changes since the complaint was filed, including stronger age controls and more parental oversight. The department noted that the claims are allegations only, and no court has ruled on them.

None of this involved a hacker or a leaked database. It came down to a sign-up screen, an age check, the data an app sends to its partners, and a delete request that, by the government's account, did not do what parents expected.

TikTok is not the only case on this theme. In December 2025, a federal court approved an order requiring Disney to pay $10 million, after the FTC alleged that Disney did not label children's videos on YouTube as made for kids, so data was collected from young viewers without their parents' consent.

For any site or app that young people use, the questions are the same. How does it learn a visitor's age, and can that step be skipped? What data goes to ad and analytics partners before anyone has agreed? And when a parent asks for a child's data to be deleted, does it actually happen?

Why it matters for your siteHow an app screens ages and gets parental consent is examined as closely as what its privacy policy says.

The transcript

Four hundred million dollars. That's what TikTok and its parent company, ByteDance, agreed to pay to settle claims from the US Justice Department over children's data. The department called it one of the largest amounts ever recovered under the children's privacy law, COPPA.

So what was it accused of? The government's complaint, filed in 2024, claimed TikTok let millions of children under thirteen onto the app without telling their parents or asking for consent. It said children could get past the age screen by signing in with a Google or Instagram account.

It didn't stop there. The complaint also alleged that even in Kids Mode, TikTok collected more data than it needed, and shared some with companies like Facebook to win users back. And it claimed parents who asked to delete a child's account often saw nothing happen.

And what did it pay? Three hundred million dollars straight away, and one hundred million more once a court sets aside an earlier order against Musical.ly, the app TikTok grew out of. The department said TikTok has since added stronger age controls. The claims were settled, and no court has ruled on them.

Notice what this was not. No hacker. No leaked database. Just a sign-up screen, an age check, the tags inside an app, and a delete request that, it was claimed, went nowhere.

And it's not alone. At the end of 2025, a court approved an order for Disney to pay ten million dollars, after the Federal Trade Commission alleged that children's videos on YouTube weren't labelled as made for kids.

Regulators now look past the privacy policy, to what the product actually does. How does a site learn a visitor's age? What goes to ad partners before anyone agrees? And when a parent asks for deletion, does it happen?

That's what Tolbrook checks. We go through your site the way a shopper would, and show you what we find, with the evidence.

Read our sector reviews at tolbrook dot com slash reports. Find it. Fix it. Watch it.

Children’s dataSource: U.S. Department of Justice

Each summary is ours, drawn from the public announcement it links to. Allegations are the regulator’s own, and a settlement usually comes without any admission. This page reports what was announced. It is not legal advice, and it says nothing about any site we audit.

Find these problems before anyone else does

The digital compliance problems behind actions like these are the ones we look for. We find them on your site and show you exactly where each one sits.

Order a report

All news