TikTok and its parent company, ByteDance, are paying $400 million—equivalent to approximately 343 million euros—to the U.S. Department of Justice. The allegation: For years, the app collected the names and email addresses of children under the age of 13 without their parents’ consent, thereby violating U.S. children’s data protection laws. The Department of Justice announced the settlement on August 21, 2026, thereby bringing to a close a case that had been initiated by the previous administration under Joe Biden in 2024.
Key Points at a Glance
- TikTok and ByteDance will pay $400 million to the U.S. Department of Justice.
- The reason is a violation of the Children’s Online Privacy Protection Act (COPPA).
- $300 million is due immediately, while $100 million will be due only once an earlier condition from the Musical.ly case is lifted.
- TikTok does not admit guilt but has expanded its age verification and parental controls.
- At the same time, the European Commission is conducting a separate investigation into whether TikTok adequately protects minors.
What TikTok Is Specifically Accused Of
According to the Department of Justice’s complaint, TikTok allowed millions of children under 13 to use the platform for years, even though COPPA requires explicit parental consent for this age group. The data from these young users is said to have been used, among other things, for personalized advertising. Another particularly serious allegation is that TikTok is said to have temporarily altered its registration process in a way that made reliable age verification more difficult, even though its own employees had already warned internally about the problem.
U.S. Deputy Attorney General Stanley E. Woodward Jr. described the settlement as a “major victory for American children and parents.” Assistant Attorney General Brett A. Shumate added that companies that collect children’s personal data must comply with applicable laws.
Here’s how the $400 million payment is broken down
The amount is not due in a single lump sum, but in two installments:
| Amount | Due Date |
|---|---|
| $300 million | Immediately upon signing the agreement |
| $100 million | As soon as the conditions imposed in the 2019 Musical.ly case are lifted |
Background: Musical.ly had already paid in 2019
ByteDance acquired the lip-syncing app Musical.ly in 2018 and merged it with its own app, Douyin, to create TikTok. Musical.ly had already paid $5.7 million to the U.S. Federal Trade Commission (FTC) in 2019 for similar COPPA violations and had since been subject to strict conditions, such as consistently preventing accounts from children under 13. It is precisely this old order that will be lifted as soon as TikTok has transferred the second installment of the new payment.
No admission of guilt, but visible improvements
TikTok and ByteDance do not admit to any wrongdoing as part of the settlement. Nevertheless, the Department of Justice acknowledges in the settlement agreement that the platform has significantly improved its compliance since the 2024 lawsuit: Providing a date of birth is now mandatory during registration; an age verification system is designed to detect false information; and parents can monitor and restrict their children’s usage via the Family Pairing feature. According to TikTok, the company now regularly deletes tens of thousands of accounts that are clearly created by children under 13.
However, this does not quite fit seamlessly with the settlement: Just a few days before the announcement, it was revealed that TikTok had temporarily disabled safety features for about 10 percent of U.S. users as part of an internal test. U.S. lawmakers sharply criticized the move, arguing that it contradicts the compromise currently being negotiated.
TikTok’s data protection remains an issue in the EU as well
COPPA is a U.S. law and does not apply in Germany or the rest of the EU. In Germany, the GDPR primarily governs how companies are permitted to handle children’s data. In parallel with the U.S. proceedings, the European Commission is conducting a separate review under the Digital Services Act to determine whether TikTok adequately protects minors from problematic content and addictive mechanisms.
The case is also part of a long history of tensions between U.S. tech companies and data protection authorities, as was most recently evident in the dispute over a new data protection agreement between the EU and the U.S.
Conclusion
A $400 million fine is manageable for a company the size of ByteDance, but it sends a clear signal: U.S. authorities now impose heavy penalties for the mishandling of children’s data. For TikTok, however, the issue of data protection is likely far from over. The EU is conducting its own investigations into the protection of minors, and in Germany, policymakers and the public continue to debate how much social media exposure is appropriate for children and adolescents.
Sources: U.S. Department of Justice
