TikTok settles US child privacy lawsuit for $400 million and implements stricter age controls

TikTok’s $400 million settlement with the Justice Department resolves a 2024 lawsuit alleging violations of the Children’s Online Privacy Protection Act (COPPA). The case centered on claims that the platform allowed under-13 users to create accounts, improperly collected children’s data in 'Kids Mode,' and failed to comply with parental deletion requests. The settlement is notable for its size, described as one of the largest recoveries in COPPA history, and reflects the growing regulatory pressure on platforms to enforce stricter age verification and data handling practices for minors.

For engineers and product teams, the settlement imposes new technical requirements. The Justice Department highlighted TikTok’s implementation of 'extensive measures' to strengthen safeguards for younger users, including improved age-related controls and enhanced parental oversight. These changes likely involve more robust identity verification systems, stricter data access policies, and automated compliance checks to prevent underage account creation. The cost of these upgrades extends beyond the financial penalty, requiring ongoing investment in monitoring and enforcement mechanisms to avoid future violations.

The settlement also coincides with broader structural changes at TikTok, including the creation of TikTok USDS Joint Venture, a U.S.-based entity with investors like Oracle and Silver Lake. While ByteDance retains a minority stake, the shift may have been intended to address concerns about data sovereignty and regulatory compliance. However, the settlement does not resolve all scrutiny of the platform, as federal workers were only recently permitted to use the app again after a 2022 ban. For engineers, this underscores the need to design systems that can adapt to evolving legal and geopolitical risks.

The case serves as a precedent for other platforms handling children’s data. The Justice Department’s emphasis on 'material advancements' in privacy protections suggests that regulators will expect similar improvements from other companies facing COPPA-related allegations. For engineering teams, this means prioritizing privacy-by-design principles, particularly in features targeting younger users. The settlement’s terms, including a $300 million upfront payment and a $100 million contingent payment, also highlight the financial stakes of non-compliance, making it critical to integrate legal and technical safeguards early in the development process.