TikTok and ByteDance have agreed to pay $400mn to settle a US Justice Department case alleging they let millions of under-13s use the platform and collected their data without parental consent. Ireland’s regulator fined the company €345mn over children’s accounts in 2023.

TikTok and ByteDance will pay $400mn to end the US government’s children’s privacy case. Three hundred million is due immediately, with the rest payable once a consent decree against TikTok’s predecessor Musical.ly is vacated.

Nobody has been found liable. The Justice Department’s own announcement states that the claims it resolved are allegations only and that there has been no determination of liability.

What was alleged is specific. The 2024 complaint said millions of children under 13 used the platform, that their information was kept and used for targeted advertising, and that registration flows were changed in ways that obscured age checks.

The reason the number is large is that it is the second time. Musical.ly paid $5.7mn in 2019 and undertook to stop children under 13 creating accounts, an undertaking the government says was not kept.

Europe arrived at a similar figure three years earlier. Ireland’s Data Protection Commission fined TikTok €345mn in September 2023 over how the platform handled children’s accounts, in a bloc where a third of fines against social platforms concern children.

That was not an isolated case either. Children’s data has become the most enforced corner of European privacy law, well before any American regulator reached this scale.

Brussels is still going. The Commission has formally charged TikTok under the Digital Services Act over failures to protect minors, a separate process with separate penalties.

The money is not the part that changes behaviour. The settlement obliges TikTok to run stronger age controls, add safeguards for younger users and give parents better oversight tools.

Europe is heading to the same place by legislation rather than settlement. The EU says its age verification app is ready, Ursula von der Leyen is pushing bloc-wide protections, and Norway plans to ban social media for under-16s with liability sitting on the platforms.

All of which runs into the same wall. Verifying that a user is a child means collecting the data that European privacy law exists to restrict.

For a company the size of ByteDance, $400mn is the least consequential thing in the document. The compliance terms are what a regulator can come back and measure.

Get the TNW newsletter

Get the most important tech news in your inbox each week.