TikTok promised to stop collecting kids' data in 2019. It cost $400 million to find out it didn't
The U.S. Department of Justice says TikTok let children under 13 open normal accounts, kept their data, and ignored parents who asked for it to be deleted — years after promising it had fixed exactly that.
In 2019, TikTok's predecessor Musical.ly paid $5.7 million to settle claims it was collecting personal data from kids under 13 without asking their parents. That was supposed to be the end of it. There was a commitment to comply.
Last week the Department of Justice announced a $400 million settlement with TikTok, ByteDance and affiliated companies over the same law — the Children's Online Privacy Protection Act, the American rule that says you can't harvest data from a child under 13 without a parent's permission. The government's allegation is not that a filter leaked. It's that TikTok knowingly let children under 13 create regular accounts outside its restricted Kids Mode, collected and kept their personal information, failed to delete accounts and data when parents asked, and had inadequate procedures for finding underage accounts in the first place.
The interesting part isn't the number. It's the gap between the two numbers. In 2019 this behaviour cost $5.7 million. In 2026 it costs $400 million — 70 times more. For seven years, whatever was happening inside the company was cheaper to keep doing than to stop.
A promise to a regulator is not a product change.
And here's the part most coverage will skip: the DoJ says the deal resolves allegations only, and no court has found TikTok or ByteDance liable. So we get the money without the finding of fact. Which means the detailed story of how many children, for how long, and who inside the company knew — that story now has no reason to ever come out in public. That's usually what a settlement buys.
The payment is also split in a way worth noticing: $300 million now, and $100 million more only if a court throws out that old 2019 consent decree tied to Musical.ly. In plain terms, a quarter of the penalty depends on TikTok getting free of the paperwork from the first time it got caught.
Any parent whose kid has a phone — because the government just confirmed that the app's own age gate was, by its account, easy to walk around, and that deletion requests went unanswered. And anyone in their twenties who was 11 or 12 when they first opened a TikTok account: the data collected from you then is what this case is about, and nothing in the announcement tells you what happened to it. Also everyone who builds or works on consumer apps: $400 million is now the going rate for treating a compliance promise as a press release.
Watch the court. $100 million of the $400 million is only paid if a judge vacates the earlier consent decree involving Musical.ly — so that ruling is the next real event in this story, and it decides whether the government collects the full amount or stops at $300 million. Beyond that, the DoJ says it now recognizes TikTok has changed its ownership, data management, privacy retention and age controls. No deadline, no monitor and no reporting schedule was named in the announcement. What checks that those changes hold, nobody has said.
The DoJ credited TikTok for changes to its "ownership" — listed right alongside data management and legal compliance. Read that again. Fixing who owns the company was treated as part of fixing how it handles children's data. That tells you what this case was really about, and it wasn't only privacy.
Sources: Bleeping Computer, "TikTok reaches $400M settlement with US over COPPA violations" (Bill Toulas, August 24, 2026), reporting the U.S. Department of Justice announcement.
Written by THE TELL’s AI newsroom. how we work · corrections