TikTok and its parent ByteDance will pay US$400 million to settle a United States Justice Department case that alleged the company let children under 13 open accounts, collected their data without a parent's consent, and did not act on parents who asked for their children's accounts and information to be deleted. The settlement was announced in Washington on Friday.
US$300 million is payable now. The remaining US$100 million falls due only if a court vacates an earlier consent decree entered against Musical.ly, the app TikTok grew out of. The case was filed in August 2024 alongside the Federal Trade Commission under the Children's Online Privacy Protection Act, the US law that governs the collection of data from children under 13. Associate Attorney General Stanley E. Woodward Jr said the settlement was "a major victory for American children and parents".
TikTok said many of the allegations concerned past events and practices that were either factually inaccurate or had since been addressed, and pointed to changes it has made to age controls and parental oversight.
None of that money or any of those obligations reach an Australian user. COPPA is US law and it stops at children under 13. The Australian rule is a different one aimed at a different age group, and TikTok is already inside it.
Since 10 December 2025, TikTok has been one of ten platforms required to take reasonable steps to stop Australians under 16 from holding an account. The others are Facebook, Instagram, Kick, Reddit, Snapchat, Threads, Twitch, X and YouTube. On 31 March 2026 the eSafety Commissioner published the first compliance report on that obligation and confirmed investigations into five of them, Facebook, Instagram, Snapchat, TikTok and YouTube, for alleged non-compliance. No platform has been penalised.
The report set out what the platforms were doing wrong, and the detail is the mechanism rather than the intent. Platforms were prompting children to attempt an age check even where a declared age had already been established. Under-16s were able to retry the same age assurance method until it returned a 16-plus result, and eSafety recorded one 14-year-old who was estimated at 16 by facial age estimation and kept the account. There was no accessible or effective way for a person to report an account that should be age-restricted, and the measures in place were not enough to stop new under-16 accounts being created.
Maximum penalties for systematic breaches were doubled on 28 June 2026, from $49.5 million to $99 million. The same changes gave eSafety power to compel evidence of compliance efforts and to demand documents not just from the platforms but from age assurance providers and app store operators. Prime Minister Anthony Albanese said the changes reflected "the seriousness with which we take any failure by social media companies to comply with our world-leading law". Communications Minister Anika Wells said the government was "doubling down on our efforts to hold big tech to account".
The two cases sit either side of the same store of data. The United States has fined a company for holding information about children it should not have had. The Australian obligation requires the same company to work out how old every one of its users is, which means obtaining an age signal from adults as well, whether that is a face scan, a document, or an inference drawn from behaviour on the account. The compliance report measures whether those checks work. It does not measure what they collect, who ends up holding it, or for how long.
What is known: the US settlement is agreed and US$300 million is payable, with the balance contingent on a court order. What is not: eSafety has not said when it will decide on enforcement against any of the five platforms, and no Australian penalty has been issued against TikTok or anyone else under the minimum age law.
