The U.S. Department of Justice has announced a $400 million settlement with TikTok, ByteDance, and affiliated entities over alleged violations of the Children's Online Privacy Protection Act (COPPA). This is one of the largest privacy enforcement actions in U.S. history, and it lands at a moment when regulators on both sides of the Atlantic are treating children's data as a zero-tolerance domain.
For security and privacy practitioners, this is not just a consumer-app headline. It is a compliance signal flare. If your organization operates any website, mobile app, SaaS platform, gaming service, EdTech product, or connected device that could be accessed by children under 13 — even incidentally — the enforcement posture demonstrated here applies to you. The DOJ and FTC have now made clear that "we didn't know kids were on our platform" is not a defense, and that internal knowledge of underage users combined with continued data collection is an aggravating factor that produces nine-figure outcomes.
This post breaks down what COPPA actually requires, why TikTok's alleged conduct crossed the line, and — most importantly — the concrete steps your organization should take now to avoid becoming the next enforcement headline.
Background: What COPPA Actually Requires
COPPA (15 U.S.C. §§ 6501–6506, enforced via 16 C.F.R. Part 312) applies to operators of websites and online services that are directed to children under 13, or that have actual knowledge they are collecting personal information from children under 13. The core obligations:
- Verifiable parental consent must be obtained before collecting, using, or disclosing personal information from a child.
- A clear, comprehensive privacy policy describing data practices for children's information must be posted.
- Data minimization: operators may only collect information reasonably necessary for the child's participation in the activity.
- Retention limits: children's data may not be retained longer than necessary to fulfill the purpose for which it was collected, and must be securely deleted afterward.
- Reasonable security: operators must establish and maintain procedures to protect the confidentiality, security, and integrity of children's personal information.
- No conditioning participation on excess data: a service cannot require a child to disclose more information than is reasonably necessary.
The FTC's COPPA Rule was substantially updated in 2025 (with compliance deadlines phasing into 2025–2026), tightening retention and security requirements further — including explicit mandates for written data retention policies and prohibitions on indefinite retention of children's data. The regulatory floor has risen, and this settlement demonstrates the ceiling of enforcement exposure.
Analysis: Why TikTok's Conduct Triggered Enforcement
Based on the DOJ's allegations, the violations center on several patterns that map directly to COPPA's core requirements:
1. Actual knowledge without action. TikTok allegedly knew — through internal reports, moderation activity, and its own age-screening data — that significant numbers of children under 13 were using the platform, yet continued collecting personal information (persistent identifiers, device data, behavioral profiles) from those users without verifiable parental consent. This mirrors the 2019 Musical.ly/FTC settlement ($5.7M), meaning regulators treated this as a repeat-offender pattern — a key driver of the penalty's scale.
2. Failure of age gates to function as designed. An age gate that can be trivially bypassed (e.g., a child re-entering a different birth year after being rejected) is not a compliance control — it is a cosmetic one. Regulators increasingly evaluate age-assurance mechanisms on effectiveness, not intent.
3. Retention of children's data beyond necessity. Allegations included retaining data associated with accounts of known underage users instead of deleting it as COPPA requires. With the updated COPPA Rule's explicit retention mandates now in force, this category of violation will only draw harsher scrutiny going forward.
4. Corporate structure as non-shield. The settlement names TikTok, ByteDance, and affiliated companies jointly. Practitioners should note: parent companies, subsidiaries, and holding structures do not insulate any entity in the chain that participates in or benefits from the data practices.
Exploitation status, in compliance terms: This is not a theoretical risk. The FTC and DOJ have active, funded children's privacy enforcement programs. State attorneys general are running parallel actions against TikTok and other platforms. The EU has separately fined TikTok hundreds of millions of euros under GDPR for children's data processing. Enforcement is current, coordinated, and escalating.
Executive Takeaways
This is a governance and compliance event rather than a technical vulnerability, so the defensive value here is organizational. The following actions are what I would put in front of any CISO, DPO, or general counsel whose organization touches data that may originate from minors:
1. Inventory your exposure to under-13 users — honestly. Map every consumer-facing property (web, mobile, API, IoT companion apps) and determine whether it is "directed to children" under the FTC's multi-factor test (subject matter, visual content, language, advertising, audience composition data). Critically: if your analytics, support tickets, or moderation logs reveal underage users, you have actual knowledge — and the compliance clock is already running. Ignorance preserved by policy is still knowledge in the eyes of regulators when internal data shows otherwise.
2. Audit your age-assurance mechanism for bypass resistance. Test your age gate the way a determined 10-year-old would: back-button resubmission, birth-year re-entry, account re-creation after rejection. A compliant design applies neutral age screening (no defaulting or nudging toward an "adult" answer), blocks simple re-entry loops within a session, and routes under-13 detections into a parental-consent flow or a restricted, non-collecting experience. Document the testing — demonstrable diligence matters in enforcement posture.
3. Implement verifiable parental consent before any collection from identified children. Accepted mechanisms include signed consent forms, credit/debit card micro-transactions, government-ID verification, video conference verification, and knowledge-based authentication — per the FTC's approved methods. "Check this box if you're a parent" is not verifiable consent. Ensure consent records are themselves retained per your retention schedule and are auditable.
4. Enforce data minimization and retention limits technically, not just contractually. A privacy policy that says "we delete children's data after 90 days" is meaningless without enforcement in the data platform. Implement automated retention jobs against data stores, tag records associated with under-13 or consent-pending accounts, and verify deletion propagates to backups, analytics pipelines, data warehouses, and third-party processors (ad networks, analytics SDKs, crash reporters). The updated COPPA Rule now requires a written data retention policy for children's information — if you don't have one, drafting it is a this-quarter deliverable.
5. Audit third-party SDKs and advertising integrations for child-directed surfaces. Many COPPA violations are executed not by the operator's own code but by embedded third-party SDKs silently collecting persistent identifiers (IDFA/GAID, device fingerprints) from child users. Configure ad and analytics SDKs into child-directed mode where supported, strip identifiers server-side where possible, and flow COPPA obligations down contractually. "We didn't know the SDK was collecting" has not survived regulatory scrutiny.
6. Establish an underage-account remediation pipeline. When moderation, support, or reporting surfaces an account belonging to a child under 13, there must be a defined, SLA-backed workflow: suspend collection, obtain verifiable parental consent or delete the account, purge associated personal data across systems, and log the action. TikTok's alleged failure was not that underage users existed — it was that the company knew and the data kept flowing. Your incident-response runbooks should treat "confirmed underage account detected" as a compliance incident with the same rigor as a data breach.
Remediation and Compliance Roadmap
For organizations that discover gaps against the above, sequence remediation as follows:
- Weeks 1–4: Complete the exposure inventory (Takeaway 1) and SDK data-flow audit (Takeaway 5). These two artifacts define your actual risk surface and are what regulators will ask for first.
- Weeks 4–8: Deploy or harden age assurance and parental consent flows (Takeaways 2–3). Engage counsel to confirm your consent mechanism matches an FTC-approved method.
- Weeks 8–12: Implement technical retention enforcement and the underage-account remediation pipeline (Takeaways 4 and 6), including deletion propagation verification across downstream processors.
- Ongoing: Add COPPA compliance checks to your SDLC for any new feature touching user data, include children's-privacy scenarios in tabletop exercises, and monitor FTC/DOJ enforcement actions — each settlement's complaint is effectively free guidance on current regulatory interpretation.
Relevant official references:
- FTC COPPA Rule (16 C.F.R. Part 312) and updated rule guidance: https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa
- FTC COPPA business guidance: https://www.ftc.gov/business-guidance/privacy-security/childrens-privacy
- DOJ press release on the TikTok settlement: https://www.justice.gov
- Original reporting: https://www.bleepingcomputer.com/news/legal/tiktok-reaches-400m-settlement-with-us-over-coppa-violations/
Conclusion
A $400 million settlement is not a cost-of-doing-business number — it is a message. Regulators have moved children's data from the "privacy policy boilerplate" category into the "existential enforcement risk" category, and they are measuring compliance by what your systems actually do, not what your policy says. Organizations that treat age assurance, consent, minimization, and retention as engineering problems — tested, automated, and audited — will weather this enforcement era. Those that treat them as legal disclaimers will eventually meet the DOJ.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.