What Happened
TikTok agreed to pay $400 million to the Department of Justice to settle allegations of repeatedly violating children's privacy. The DOJ announced the settlement but kept the terms confidential. No details about the specific violations, remedial measures, or compliance commitments were made public.
Timeline
The allegations are described as "long-running complaints," but the timeline of violations, investigation milestones, and settlement negotiations remains undisclosed. The settlement was announced in August 2026.
Which Controls Failed or Were Missing
We don't know. That's the problem.
Without access to the settlement terms, we can't identify which specific safeguards broke down. We can infer that children's privacy protections failed somewhere in TikTok's data collection, retention, or sharing practices. Did the company lack adequate age verification? Did it collect more data than necessary? Did it fail to obtain verifiable parental consent? Did it share children's data with third parties without proper controls?
These aren't academic questions. They're the building blocks of your own privacy compliance program. When a settlement of this size happens and you can't see the underlying failures, you lose the chance to stress-test your controls against a real-world breakdown.
The opacity also means we don't know what remedial measures TikTok committed to implement. You can't benchmark your program against theirs. You can't see which technical controls, training protocols, or monitoring systems the DOJ considered sufficient to prevent recurrence.
What the Relevant Standard Requires
Children's privacy in the United States falls primarily under COPPA, the Children's Online Privacy Protection Act. COPPA requires operators of websites and online services directed to children under 13 to:
- Post a clear privacy policy describing data collection practices
- Obtain verifiable parental consent before collecting, using, or disclosing personal information from children
- Give parents the option to consent to collection and use without consenting to disclosure to third parties
- Provide reasonable access to the information collected
- Maintain reasonable security procedures to protect the confidentiality and integrity of children's personal information
These aren't vague aspirations. COPPA spells out specific consent mechanisms, disclosure requirements, and data minimization principles. A $400 million settlement suggests systemic failures across multiple requirements, not a single technical glitch.
ISO 37301 Compliance Management Systems requires organizations to establish processes for identifying, assessing, and treating compliance risks. For a platform handling children's data, this means mapping data flows, identifying collection points, implementing age-gating controls, and monitoring for drift. It also requires periodic compliance evaluation and corrective action when gaps appear.
The Federal Sentencing Guidelines for Organizations emphasize that an effective compliance program must include ongoing monitoring and periodic evaluation. When you're handling children's data, "periodic" needs to mean continuous. Age verification can break. Consent flows can bypass required steps. Third-party integrations can create unexpected data paths.
Lessons and Action Items for Your Team
Map Your Data Collection Touchpoints. If your organization collects any data from users who might be under 13, document every collection point. This includes account registration, in-app purchases, social features, customer support interactions, and analytics. You can't protect what you can't see.
Test Your Age-Gating Controls Monthly. Age verification isn't a one-time implementation. Run regular tests with different user paths, device types, and edge cases. Document the results. When controls fail in testing, you have time to fix them. When they fail in production, you're writing a check.
Review Your Third-Party Data Sharing Agreements. COPPA applies not just to what you collect, but to what you share. If you're passing user data to analytics providers, advertising networks, or cloud services, you need to know whether children's data is in that flow. If it is, you need contracts that explicitly prohibit further use or disclosure without consent.
Build a Parental Consent Audit Trail. Verifiable parental consent isn't just about collecting it. It's about proving you collected it, stored it correctly, and honored it across all systems. Your consent records should be tamper-evident and tied to specific user accounts. If you can't produce a complete consent record for every child account, you have a gap.
Create a Children's Privacy Incident Response Plan. When you discover that children's data was collected without proper consent or shared beyond permitted uses, you need a documented process for containment, notification, and remediation. This plan should specify decision-makers, notification thresholds, and documentation requirements. Don't wait for an incident to figure out who makes the call.
Train Your Product and Engineering Teams on COPPA Requirements. Privacy compliance isn't just a legal checkbox. It's a design requirement. Your developers need to understand consent flows, data minimization, and age-gating before they ship features. Your product managers need to know that "we'll add parental consent later" isn't a viable launch strategy.
Document Your Compliance Evaluation Process. ISO 37301 requires periodic evaluation of your compliance management system. For children's privacy, this means scheduled audits of age verification accuracy, consent flow completeness, and data sharing controls. Document what you checked, what you found, and what you fixed. If you ever face an enforcement action, this documentation demonstrates good faith and systematic attention.
The $400 million settlement tells us that children's privacy violations carry serious financial consequences. What it doesn't tell us is how to avoid them. That's on you. Build the controls, test them regularly, and document everything. When the next big settlement happens and the terms stay secret, you'll already know your program works.
