TikTok's $400M COPPA deal prices children's-data failure, and prices exit from supervision

Against the last benchmark in this area of law, the number is enormous. The FTC's February 2019 penalty against the company was $5.7 million, then the largest civil penalty in a children's privacy case ^[4]. Four hundred million is roughly seventy times that ^[18]. Set the same total against the user base government lawyers described in court, more than 170 million teenagers on the platform ^[5], and it works out to about $2.35 a head at most ^[20]. Both readings are accurate, which is the difficulty with headline penalties as deterrents.

The structure is more instructive than the total. Three hundred million is payable immediately ^[2]. The final quarter of the money ^[19] is released only if a court enters an order vacating the consent decree against Musical.ly, the app ByteDance bought in 2017 and folded into TikTok ^[3]. That decree is the instrument that required parental consent for under-13 accounts and removal of videos those users posted ^[4]. The August 2024 complaint from the DOJ and FTC is the government's own account of how little it achieved: under-13 users opening standard accounts, data collected without telling parents, deletion requests ignored ^[8]. The complaint also alleged the registration process was altered to make underage users harder to identify, and that data useful for targeted advertising was retained over staff objections ^[9].

So the government is accepting $100 million to lift an order whose violation it had just spent a year litigating, and it has not set out any conduct requirement beyond the payment ^[12]. Associate Attorney General Stanley E. Woodward Jr. called the settlement "a major victory for American children and parents" ^[7]. What stands in for continuing supervision, in the department's telling, is corporate change: US operations moved into a joint venture controlled by Oracle, Silver Lake and MGX with ByteDance retaining 19.9% ^[11], along with strengthened age controls and parental oversight that DOJ says materially advanced the public interests behind the litigation ^[10].

Nor has the department said what the money is for ^[12]. AFP reported that ABC News found in May that the administration was weighing directing settlement funds toward beautification projects, among them resurfacing the Lincoln Memorial Reflecting Pool ^[13]. On that reporting, the $400 million is revenue rather than remedy, and the affected users receive process changes instead of a fund.

The exposure nobody has priced sits with the Senate. Marsha Blackburn and Richard Blumenthal, co-authors of the Kids Online Safety Act, wrote on Wednesday to Shou Chew and US spinoff head Adam Presser, according to Fortune, accusing the company of withholding a critical safety measure to see whether protecting users would affect its bottom line ^[16]. The underlying document, per the reporting, describes a 2021 algorithm change meant to stop users being served the same harmful content repeatedly, withheld from 10% of US users, a control group of about 15 million, as an engagement test ^[14]. Chase Nasca, 16, was placed in that group in January 2022 and died by suicide the following month ^[15]. The senators want 13 answers by September 1, including a list of every US experiment in which a safety feature was withheld ^[17]. A COPPA case covers data handling. It does not cover experiments run on minors, and the letter is asking for the inventory that would define that second liability.