TikTok's $400mn settlement prices the second offence at about 70 times the first

The allegation doing the work in the 2024 complaint is not simply that under-13s were present. It is design. The Justice Department said TikTok changed aspects of its registration policies in ways that made it harder to determine whether users were old enough to join ^[7], and that the company kept and used children's information, including data usable for ad targeting, after employees had raised concerns about young users on the platform ^[8]. Both of those are artefacts rather than impressions. A registration flow has versions. An internal concern has a sender and a date.

That is what makes the arithmetic worth doing. Musical.ly paid $5.7mn in 2019 and committed to preventing under-13s from creating accounts ^[6], and the DOJ's case was that the terms of that earlier FTC settlement were violated, along with data collection in "Kids Mode" and frequent failures to honour parental deletion requests ^[10]. The second visit costs roughly seventy times the first ^[23]. For scale, Google paid $170mn in 2019 and Epic Games $275mn in 2022 for COPPA violations ^[13], so $400mn lands about $125mn above the previous high mark without reaching the two of them added together ^[25]. The DOJ calls it one of the largest recoveries ever obtained under the statute ^[26].

The payment structure is the tell about what the government still wants. Three hundred million is due immediately and the last $100mn only once the 2019 FTC consent decree is vacated ^[3], which parks a quarter of the money ^[24] on the disposal of the old order. Nobody was found liable: the agreement requires no admission of wrongdoing ^[4], and the DOJ's announcement states the resolved claims are allegations only with no determination of liability ^[5]. So what is on the record is a theory of the case with a price attached, which is exactly what a compliance function has to plan against.

The terms a regulator can come back and measure are the age-related controls, the additional safeguards for children and the parental oversight tools ^[9]. The DOJ notes the company has already changed ownership, management, compliance functions and privacy practices ^[11], and assistant Attorney General Brett Shumate said children and parents are better protected today than when the case began ^[12].

Europe reached a comparable number earlier and by a different route. Ireland's Data Protection Commission fined TikTok 345mn euros in September 2023 over its handling of children's accounts ^[14], in a bloc where a third of fines against social platforms concern children ^[15], and the Commission has separately charged TikTok under the Digital Services Act over failures to protect minors ^[16]. Legislation is following: the EU says its age verification app is ready, Ursula von der Leyen is pushing bloc-wide protections, and Norway plans to ban social media for under-16s with liability sitting on platforms ^[17]. All of it hits the same obstacle, which is that establishing a user is a child means collecting the data the privacy regime exists to restrict ^[18].

Meanwhile the scrutiny has not paused. Days before the settlement, Bloomberg reported that TikTok had deliberately disabled an algorithmic safeguard for roughly 10% of US users as an experiment, a safeguard meant to reduce the chance of users being overwhelmed by harmful content ^[19], prompting a letter to CEO Shou Chew and US business head Adam Presser from Senators Marsha Blackburn and Richard Blumenthal ^[20]. The registration flow was a product decision that a federal docket now describes line by line. The next one will be read the same way.