TikTok's $400M settlement puts a price on the parental deletion request nobody actioned

By the arithmetic of the two tranches, a quarter of this money does not move until a court vacates a consent decree that predates the TikTok brand entirely, the one entered against Musical.ly ^[2][11]. Read that as a valuation. A live order sitting on a corporate predecessor was worth $100 million to retire, which is a more useful number for anyone currently operating under an FTC order than the headline figure is.

The complaint carried two theories, and they fail in different places inside a company. Knowingly allowing under-13s to open accounts and collecting data from Kids Mode users is a product and age-assurance decision, argued at the level of design reviews ^[3]. Failing to comply with parents' requests to delete their children's accounts and information is not a decision at all ^[4]. It is a queue. Inbound requests arrive with timestamps and identifiers, and each one either has a matching deletion event downstream or it does not. A regulator with discovery does not need to understand your data architecture to line those two lists up and count the gaps. That is the cheapest enforcement theory in the file and the one most consumer platforms have the least instrumentation for.

The remediation credit is where the settlement gets instructive. TikTok's position when the case was filed was that much of it concerned past events and practices that were factually inaccurate or already addressed ^[5]. The DoJ, announcing the deal, agreed on the second half of that: it noted the company has since implemented extensive measures on safeguards for younger users, age controls and parental oversight ^[7]. It still took $400 million ^[1], and called the recovery one of the largest ever under COPPA ^[6]. Fixing the control bought a favourable paragraph in the government's own press release. It did not buy a discount on the period when the control was missing.

Nor is this a single-regulator reading of the same conduct. TikTok was fined 345 million euros in September 2023 over its processing of children's personal data under GDPR ^[9]. Two agencies in two jurisdictions have now attached nine-figure numbers to the same subject matter, which removes the argument that children's-data exposure is a quirk of one statute.

Worth noting who is paying. The complaint was filed in August 2024 ^[3], and the settlement was reported roughly two years later ^[13], in a market TikTok still has because a U.S. joint venture let the app keep operating under the divest-or-ban law the Supreme Court upheld ^[10]. This is the cost of staying, not of leaving. Associate Attorney General Stanley E. Woodward Jr. framed the resolution around companies entrusted with children's personal information meeting their legal obligations ^[8], which is the sentence a general counsel should expect to see quoted back at them the next time someone asks why the deletion queue needs staffing rather than a policy page.